1. Who is responsible
Trancka, Kennedylaan 51, 5571 KB Bergeijk, the Netherlands, is the controller for the personal data described here. Contact: contact@psdfuel.com.
2. What we store, and why
- Account: email address, display name, a hashed password (or your Google account id if you sign in with Google), and the time you signed up. Needed to run your account and your membership (contract).
- Membership and payments: your Stripe customer id, plan, status and renewal date. Stripe stores your payment details and invoices; we never see your card number. Needed to deliver what you paid for (contract) and for our accounting (legal obligation).
- Downloads: which asset you downloaded, when, from which country and city (derived from your IP address by our hosting provider), your browser’s user-agent string and a keyed hash of your IP address. Needed to enforce fair use, prevent abuse and improve the library (legitimate interest).
- Free assets: the email address you enter, the assets sent, the time, and a keyed hash of your IP address. Needed to deliver the files and prevent abuse (contract, legitimate interest). If you tick the box, we also use the address to send you new free assets and drops (consent, withdraw anytime via the link in every email or by writing to us).
- Saved assets: the favourites you mark, so we can show them to you (contract).
- Support email: what you write to us, so we can answer (legitimate interest).
- Requests: what you ask for, vote for and follow on the request board, and any screenshot you add. The request and the screenshot are shown publicly on the board. If you follow a request by email without an account, we store that address to tell you when the asset ships, together with a keyed hash of your IP address to prevent abuse (contract, legitimate interest).
- Cancellation: the reason and any comment you give in the billing portal when you cancel, so we can improve the service (legitimate interest).
- Withdrawal: if you use the withdrawal function, your declaration with your email address, date and time, kept for our administration even after your account is deleted (legal obligation).
- Profile photo: the photo you upload, stored in a public bucket so the site can show it to you; remove it from your account at any time (contract).
- Sent mail: which emails we sent you, when, and whether they reached our email provider, kept to spot failures (legitimate interest).
- Referral attribution: if you arrive through an affiliate’s link, we store a random identifier for your browser, which affiliate sent you, the page you landed on, the affiliate’s own campaign label, the country your request came from and a keyed hash of your IP address. If you then create an account, that identifier is linked to it so any membership you buy can be credited to the affiliate. Needed to run the affiliate programme and pay commission correctly (legitimate interest). We never tell an affiliate who you are: they see that a signup or a sale happened, never your name, email address or payment details.
3. Cookies
We set the cookies needed to keep you logged in and to keep a session on the checkout. There are no advertising cookies, no third-party tracking scripts and no fingerprinting, and we do not follow you across other websites.
One further cookie is set only if you arrive through an affiliate’s referral link. It holds a random identifier for your browser, it lasts 30 days, and its only purpose is to credit the right affiliate if you later subscribe. It is first-party, it is not shared with anyone, and it is not used to profile you or to show you advertising. If you never follow a referral link, it is never set.
4. Who processes data for us
- Supabase (database, authentication and file storage; servers in Frankfurt, Germany, EU).
- Vercel (hosting and delivery of the website; may process request data on servers inside and outside the EU under standard contractual clauses).
- Stripe (payments, invoices, the billing portal; Stripe is an independent controller for the payment itself).
- Resend (sending transactional email such as the welcome, payment and free-asset emails).
Each of them is bound by a data-processing agreement. We do not sell or rent personal data to anyone.
5. How long we keep it
- Account and membership data: for as long as your account exists, then 30 days.
- Invoicing data at Stripe: 7 years (Dutch tax law).
- Download log: 24 months.
- Free-asset leads: until you ask us to remove the address, or 24 months after the last request.
- Referral clicks: 24 months. Commission and payout records are kept for 7 years, because they are part of our accounts.
6. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to limit or object to its use, and to receive it in a portable format. Write to contact@psdfuel.com; we answer within 30 days. Deleting your account removes your profile, favourites and download log; invoicing data at Stripe is kept for the legal period. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
7. Security
Files are served through short-lived signed links, passwords are hashed, database access is restricted per user, and IP addresses are stored only as keyed hashes. No system is perfectly secure; if a breach ever affects your data we will tell you and the authorities as the law requires.
8. Changes
We update this page when the service changes. The date at the top tells you when.