Privacy policy

A privacy policy you can actually read. We collect as little as the sale needs, and we don’t track you around the web.

Who is responsible

The data controller is Andify OÜ, registry code 16025775, VAT number EE102540811, at Luha tn 2-6, 50703 Tartu, Estonia. Questions or requests: hello@ppfengine.com.

What we store, and for how long

Data	Why	Legal basis	Kept
Order details (email, name, amount, country, VAT ID)	To sell and deliver your presale license	Contract	7 years (Estonian accounting law)
Waitlist email	To send the launch note you asked for	Consent	Until you unsubscribe
Consent record (your cookie choice, timestamp, banner version, user agent)	To prove your choice under GDPR	Legal obligation	2 years
Campaign attribution (landing page, referrer host, UTM values, ad click ID)	To understand which consented campaigns lead to signups and sales	Consent	90 days
Google Analytics identifier and event data	To measure consented visits, signups, checkout starts and sales	Consent	Up to 14 months
Server logs (IP, request)	Security and debugging	Legitimate interest	14 days

We do not store your scans, templates, or any car data. PPF Engine is a desktop app and that data never leaves your computer.

Who processes data for us

• Creem: merchant of record for payments, tax, refunds, and invoices (privacy).
• Resend: transactional and launch emails (privacy).
• Cloudflare: website hosting and CDN (privacy).
• Plausible: cookieless, aggregate analytics, EU-hosted (data policy).
• Google Tag Manager: loads only after analytics consent and routes the events described below (privacy).
• Google Analytics 4: measures consented page views and the events generate_lead, begin_checkout, and purchase. No Google Ads or advertising tags are configured (privacy).

Analytics

Plausible is cookieless and stores no persistent identifier. If you accept analytics, Google Tag Manager loads Google Analytics 4. Google Analytics uses first-party cookies such as _ga and _ga_<stream-id> to distinguish visits and measure page views, waitlist signups, checkout starts, and purchases. These tags do not load before consent and no advertising tags are enabled.

With analytics consent, we also store a first-party attribution cookie containing the landing page, referring host, and campaign parameters already present in the URL. We attach that context to a waitlist signup or order so we can measure which campaigns work. We do not store your full referring URL. You can decline or later withdraw analytics consent from Cookie choices in the footer. Withdrawal stops future analytics loading and removes the Google Analytics and attribution cookies available to this site in your browser.

International transfers

Creem processes payment data under its privacy policy and applicable transfer safeguards. Cloudflare serves this site from a global network; it is certified under the EU–US Data Privacy Framework and processes data under its GDPR commitments. The order records we keep stay in the EU. Google may process consented analytics data outside the EEA under its applicable data-processing and transfer safeguards.

Your rights

You can ask us to access, correct, export, or delete your data, or to object to a use of it, and you can withdraw consent at any time (including reopening the cookie banner from the footer). Email hello@ppfengine.com. You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).