Privacy Policy
This page sets out what data we collect about you, why we need it, who we pass it to and what you can ask of us.
Who is responsible
CarGlowBox — [company name, registration number and registered address: to be filled in]. For anything to do with personal data: carglowbox@gmail.com.
What we collect when you order
Name, email, phone, delivery address and your note, if you left one. We need this to fulfil the order and to reach you about it. The legal basis is performance of the contract between us.
What we collect with a review
Name, email and optionally your car model. The email is never published — it is used only to check whether you bought the product and to stop one person posting several reviews. The legal basis is your consent, given by submitting the review.
What we collect when you message us
Name, email and the text of your message, so that we can reply.
What we do not do
We do not track your behaviour on the site. There is no Google Analytics, no Facebook pixel, no analytics or advertising tooling of any kind. We do not build a profile of you, we do not target you and we sell data to nobody.
Cookies
The site stores only two things in your browser: the contents of your cart, so it survives a reload, and a sign-in cookie, but only if you are an administrator. Both are strictly necessary for the site to work, so we do not ask for consent. If we ever add analytics tooling, we will ask you first.
How long we keep data
Order data is kept for 10 years because it forms part of our accounting records and the law requires us to keep it. Reviews stay until you ask us to remove them. Messages from the contact form are kept for up to a year.
Who we share data with
The order database is hosted by Supabase on servers in Frankfurt. The site runs on Vercel. Emails go out through Resend. These three process the data only on our instructions and under contract with us. Beyond them we pass data to nobody.
Transfers outside the European Union
Supabase and Vercel are US companies, and Resend stores data on servers in the United States. This means some of your data — the order confirmation email, for instance — leaves the European Union. Such transfers are permitted only with specific safeguards, and those are in place: Vercel is certified under the EU-US Data Privacy Framework, while Supabase and Resend operate under the European Commission's Standard Contractual Clauses. The order database itself is stored in Frankfurt. Write to us if you want details of the specific safeguards.
Your rights
You may request access to your data, correction of anything wrong, erasure, restriction of processing, a copy in machine-readable form, or object to processing. Where you gave consent, you may withdraw it at any time. Write to carglowbox@gmail.com — we reply within one month.
When we cannot erase
If you ask us to erase order data while the 10-year accounting period is still running, we cannot delete it entirely — the law requires us to keep the document. In that case we restrict its use to accounting purposes only and use it for nothing else.
Complaints
If you believe we have breached your rights, you may complain to the Bulgarian Commission for Personal Data Protection — kzld.bg. Please write to us first, though: almost everything is settled with one email.
Changes
If we change this policy, we change the date below with it. Significant changes will be announced prominently on the site.
Last updated: 12 August 2026