Account and session data
If you create an account, Wrapfans processes the email address and account/session identifiers needed for passwordless sign-in, account security and service access. The browser cookie holds an opaque session reference; Supabase access and refresh tokens are held by the server-side session object rather than browser storage. This service does not ask for your Tesla password, VIN or vehicle access.
Designs and creator content
When you upload or publish a design, the service stores its PNG, title, description, exact vehicle template, creator-provided rights evidence and review metadata. Original PNG exports and drafts are private originals. If a work is approved and published, its chosen creator display name, listing details and public low-resolution previews are visible to visitors and may appear in public discovery pages while the work remains sale-ready.
Credits, orders and support
The database records credit balances and ledger entries, purchases, seller settlement status, download entitlements, disputes, refunds, support cases and administrative decisions. Credits are platform units, not cash; this pre-release build does not accept card payments or cash withdrawals. Support messages are private to the user and authorized staff.
AI processing
AI generation is disabled in this pre-release build. If it is enabled later, the design brief and an approved template image will be processed by the configured AI provider; generation status, usage cost and private outputs are also stored for accounting, safety and delivery. Provider identity, processing terms and retention details must be published and reviewed before activation.
Deletion requests and retention
A deletion request immediately blocks normal account operations, cancels queued and not-yet-dispatched AI work, and removes the account’s works from public discovery projections. Provider work already dispatched may still finish; any undelivered result is discarded while actual provider cost is recorded. Submitting a request does not mean data has already been erased. A final retention, anonymization and deletion schedule and its processing worker have not been configured.
Services, contact and pre-launch items
The architecture uses Cloudflare for web/API execution and private object storage, Supabase for authentication and PostgreSQL, and an external AI provider only when AI is enabled. This local pre-release build is not connected to the hosted production accounts. The legal operator identity, jurisdiction, service regions, final provider terms, retention schedule and independent public contact channel must be confirmed before production. Signed-in users can open a private case from the account or help page; a public recovery contact has not been configured.