Privacy Policy

1. Who We Are

TrailTrace Labs ("we", "us", "our") is a digital and craft manufacturing studio that converts GPS trail recordings (GPX files or Strava activities) into high-precision 3D topographic terrain models from our workshop in the Montseny (Catalonia, Spain).

The data controller for the purposes of European Union data protection law (EU General Data Protection Regulation — GDPR, Regulation (EU) 2016/679) and Spanish Organic Law 3/2018 (LOPDGDD) is:

2. What Data We Collect

We collect only the personal information strictly required to operate our 3D configurator, fulfill custom orders, and deliver physical terrain pieces:

• Waitlist and inquiries — Email address, consent timestamp, and preferred language.
• Drafts and routes — GPS coordinates (GPX files), distance, elevation profile, activity dates, optional athletic metrics if included in the recording (heart rate, power, pace), visual design parameters (colors, scale, base plate inscriptions), and your name and email if linked to your draft.
• Order and delivery details — Full name, email address, complete delivery shipping address (street address, apartment/suite, postal code, city, province/state, country), manufacturing state, and carrier tracking details.
• Payment and billing data — We never collect or store your payment card number, expiration date, or CVC code on our servers. All transactions are processed directly by Stripe Payments Europe, Ltd. on PCI-DSS certified checkout infrastructure. We only receive Stripe transaction handles and metadata required to issue legal invoices.
• Technical and storage data — IP addresses processed transiently in process memory for rate limiting (1-hour TTL, never persisted to SQLite) and opaque draft keys held in your browser local storage.

3. How We Use Your Data

We use the information we collect strictly for the following purposes:

• Manufacturing and delivery — To convert your GPS coordinates into 3D printable files, manufacture your physical relief model, and deliver it to your shipping address.
• Transactional notifications — To send you order confirmations, manufacturing status updates, and courier shipment tracking codes by email.
• Tax and commercial compliance — To issue legally valid invoices and comply with statutory commercial record-keeping and fiscal obligations in Spain.
• Customer support — To respond to your questions and resolve inquiries regarding your piece or order.
• Zero sale of personal data — We never sell, rent, or trade your personal data to data brokers, advertisers, or third parties.

4. Strava Data Usage

When you connect your Strava account via secure OAuth, we request read-only access to your activities solely to display them in the configurator and let you select one to create a 3D topographic map.

We do not store your complete Strava history or personal profile data. We only save the specific GPX coordinate data for the single activity you explicitly choose to import in order to manufacture your piece. Access tokens are scoped to the draft session and can be disconnected at any time.

Strava data is never sold, shared with third parties, or used for marketing.

5. Legal Basis for Processing

We process your personal data under the following legal bases established in GDPR Article 6:

• Performance of a contract (Article 6(1)(b)) — Processing your name, email, delivery address, and route data is necessary to manufacture your custom physical piece and fulfill delivery under our sales agreement.
• Legal obligation (Article 6(1)(c)) — Retaining transaction, invoicing, and accounting records is mandatory under Spanish tax law (Ley General Tributaria) and commercial code (Código de Comercio).
• Consent (Article 6(1)(a)) — Applied when you voluntarily register for our waitlist or authorize Strava OAuth. You may withdraw consent at any time.
• Legitimate interests (Article 6(1)(f)) — Applied to transient rate-limiting and server security measures to protect our infrastructure against fraud and abuse.

6. Data Retention

We adhere to the storage limitation principle (GDPR Article 5(1)(e)):

• Orders and invoices — Completed order details, delivery addresses, and invoice records are retained for the statutory period required by Spanish commercial and tax laws (generally 5 years), after which they are securely deleted or anonymized.
• Unordered drafts — Draft configurations and route previews remain accessible so you can resume customization, and can be removed upon request.
• Waitlist entries — Waitlist records are retained until service launch or until you request deletion.
• Security IP buckets — Transient in-memory rate-limit buckets expire automatically after 1 hour.

7. Data Storage & Security

All application data and databases are stored on infrastructure located within the European Union (Spain), protected with appropriate technical and organizational safeguards.

We share personal information strictly with vetted service providers operating under GDPR-compliant data processing agreements:

• Stripe Payments Europe, Ltd. — Payment processing on certified PCI-DSS Level 1 infrastructure.
• Courier and postal carriers — Logistics operators in Spain who receive the recipient name and shipping address solely to deliver the physical parcel.
• Transactional email services — SMTP mail delivery infrastructure to transmit order confirmations and tracking updates.
• Terrain elevation services — OpenTopoData or equivalent elevation APIs to query altitude samples from geographic coordinates, with no personal identifiers.

8. Your Rights

Under the GDPR and Spanish LOPDGDD, you have the following rights regarding your personal data:

• Access — Request confirmation and a copy of the personal data we hold about you.
• Rectification — Request correction of inaccurate or incomplete information (such as correcting a delivery address before dispatch).
• Erasure ("right to be forgotten") — Request deletion of your personal data where retention is no longer necessary, subject to statutory tax retention requirements.
• Restriction — Request restriction of data processing under certain statutory grounds.
• Portability — Receive your personal data in a structured, commonly used machine-readable format (e.g. your GPX route data).
• Withdraw consent — Withdraw consent at any time without affecting the lawfulness of prior processing.

9. Complaints

To exercise any of these rights, email us at [email protected]. We respond without undue delay and at the latest within 30 days, free of charge.

If you believe that our processing of your personal data infringes data protection regulations, you have the right to lodge a complaint with a supervisory authority:

• Agencia Española de Protección de Datos (AEPD) — C/ Jorge Juan, 6, 28001 Madrid, Spain — www.aepd.es
• Autoritat Catalana de Protecció de Dades (APDCAT) — C/ Rosselló, 214, Esc. A, 1r 1a, 08008 Barcelona, Spain — apdcat.cat

10. Cookies & Local Storage

TrailTrace does not use advertising cookies, third-party tracking pixels, or commercial profiling scripts.

We use client browser localStorage strictly for essential user journey functionality:

• trailtrace3dDraftId — Opaque handle for your active draft so you do not lose your customized relief model.
• trailtrace3dBasket — Local basket array to support configuring multiple pieces.
• trailtrace3dLastPaymentToken — Secure bearer token to look up order and payment status.
• Workshop session cookie — The trailtrace-bypass cookie is used exclusively for authenticated workshop administration and is never issued to customer browsers.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our production methods, delivery carriers, or legal obligations. The "Last updated" date at the top indicates the current effective version.

If material changes occur that affect your rights, we will notify you prominently on our site or by email if you have an active order.