Privacy policy

Content version: 23 October 2026

1. Controller

The controller is Tomasz Gibek, Rębiszów 41, 59-630 Mirsk, Polska, operating My Finisher Poster (myfinisherposter.com). For all personal data enquiries, contact kontakt@myfinisherposter.com.

2. Preview and purchase

Your route file, photo, logo and text are processed in your browser. If draft saving is enabled, they may remain on your device. The original photo and route file are not separately uploaded to our order API. When you click “Buy and pay”, we send the finished PDF/JPG, including the route, photo and text visible on the poster, together with language, format and confirmation of the required declaration. We also send a short text description of the design (name, race, time, date, distance, route description, number of photos and number of edits — without the photos themselves or the route file).

Stripe collects payment information, including your email address, and sends us payment confirmation, a payment identifier and your email address for delivery. We do not receive your full card number or CVC. A poster thumbnail is also created for the email sent after purchase.

Map services may receive your IP address, place searches, point coordinates or the map area. We use Cloudflare/Protomaps, OpenStreetMap, Photon, BRouter, Overpass, AWS Terrarium and Open-Meteo. We do not send those map services your photo or order contact details.

3. Purposes and legal bases

Creating and delivering your order and contract-related communication: Art. 6(1)(b) GDPR. Statutory accounting obligations: Art. 6(1)(c). Security, handling claims and correspondence, and improving the product through voluntary feedback: Art. 6(1)(f), our legitimate interests.

Around 7 days after purchase, we may send one request for a rating. You can opt out through the email link or by contacting us. Feedback is optional and does not affect your order. The form stores your rating, comment, language, order number, timestamps and IP address. Feedback is not published automatically.

We do not use advertising pixels or Google Analytics. We do not make solely automated decisions with legal effects and do not sell your data.

4. Recipients and external services

Cloudflare provides website hosting and map data delivery. Fly.io hosts the API and order files in the Frankfurt region. Stripe processes payments and also acts as an independent controller for that processing. Resend delivers email. Bodies authorised by law may also receive data.

Providers may process data outside the European Economic Area, including in the USA. Transfer grounds and safeguards depend on the provider and service; they may include an adequacy decision or standard contractual clauses. Contact the controller for information and copies of safeguards. Providers explain their own processing in their privacy policies.

5. Retention

Full poster files (PDF/JPG): up to 30 days from order creation. The order history — including IP address and device type (browser), the times of consent, payment, file delivery and download, the design description and a reduced 600 px poster preview — is kept for 2 years from order creation to handle complaints, and then deleted (Art. 6(1)(f) GDPR). Download access ends 7 days after payment confirmation. The email address in our order database is removed 60 days after order creation. Data held by Stripe or the email provider is also subject to their own retention periods.

Order number, amount, currency, status and dates may remain for accounting and transaction evidence. Documents required by tax law are kept for the statutory period, generally 5 years from the end of the year in which the tax payment deadline expired.

Feedback and correspondence are kept as needed to handle your comments or enquiry and then, where necessary, to establish or defend claims until the limitation period ends. A browser draft remains until deleted, replaced by a new draft or removed by clearing site data. See “Cookies and browser storage” for details.

6. Your rights

Subject to the law, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Contact kontakt@myfinisherposter.com. Data that must be retained by law may be exempt from erasure.

You may complain to the Polish supervisory authority UODO (uodo.gov.pl) or the competent authority in your country of residence. Providing data is voluntary, but we cannot deliver an order without the finished poster, payment data and email address. Photos, logos and feedback are optional.