1. Who is responsible
Trancka, Kennedylaan 51, 5571 KB Bergeijk, the Netherlands, is the controller for the personal data described here. Contact: contact@psdfuel.com.
2. What we store, and why
- Account: email address, display name, a hashed password (or your Google account id if you sign in with Google), and the time you signed up. Needed to run your account and your membership (contract).
- Membership and payments: your Stripe customer id, plan, status and renewal date. Stripe stores your payment details and invoices; we never see your card number. Needed to deliver what you paid for (contract) and for our accounting (legal obligation).
- Downloads: which asset you downloaded, when, from which country and city (derived from your IP address by our hosting provider), your browser’s user-agent string and a keyed hash of your IP address. Needed to enforce fair use, prevent abuse and improve the library (legitimate interest).
- Free assets: the email address you enter, the assets sent, the time, and a keyed hash of your IP address. Needed to deliver the files and prevent abuse (contract, legitimate interest). If you tick the box, we also use the address to send you new free assets and drops (consent, withdraw anytime via the link in every email or by writing to us).
- Saved assets: the favourites you mark, so we can show them to you (contract).
- Support email: what you write to us, so we can answer (legitimate interest).
3. Cookies
We set only the cookies needed to keep you logged in and to keep a session on the checkout. There are no advertising cookies, no third-party tracking scripts and no fingerprinting. Because these cookies are strictly necessary, no cookie banner is shown.
4. Who processes data for us
- Supabase (database, authentication and file storage; servers in Frankfurt, Germany, EU).
- Vercel (hosting and delivery of the website; may process request data on servers inside and outside the EU under standard contractual clauses).
- Stripe (payments, invoices, the billing portal; Stripe is an independent controller for the payment itself).
- Resend (sending transactional email such as the welcome, payment and free-asset emails).
Each of them is bound by a data-processing agreement. We do not sell or rent personal data to anyone.
5. How long we keep it
- Account and membership data: for as long as your account exists, then 30 days.
- Invoicing data at Stripe: 7 years (Dutch tax law).
- Download log: 24 months.
- Free-asset leads: until you ask us to remove the address, or 24 months after the last request.
6. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to limit or object to its use, and to receive it in a portable format. Write to contact@psdfuel.com; we answer within 30 days. Deleting your account removes your profile, favourites and download log; invoicing data at Stripe is kept for the legal period. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
7. Security
Files are served through short-lived signed links, passwords are hashed, database access is restricted per user, and IP addresses are stored only as keyed hashes. No system is perfectly secure; if a breach ever affects your data we will tell you and the authorities as the law requires.
8. Changes
We update this page when the service changes. The date at the top tells you when.