Version: v002
Effective as of:
Privacy policy
01Who we are
Hardsurface is a store and production platform for 3D vehicle assets, operated by the natural person Stef Willemse from Valencia, Spain. Our vehicles are collaborative assets made by incredibly talented Hardsurface Creators, handpicked professionals from the visual effects and commercials industry. Our mission is supplying VFX studios with production-ready vehicles using the latest industry standards.
For the personal data described here, Stef Willemse is the controller within the meaning of article 4(7) GDPR, until Hardsurface commences its commercial launch. That means we decide what is collected and why, and we are the party you hold to this text. You can reach us at info@hardsurface.xyz.
02What this policy covers
Everything on this site: the store and unit records, the roadmap, the creators board and public profiles, registration and sign-in, My Hangar, settings, and the message consoles in the footer and on the catalog grid.
It does not cover sites we link to. A creator profile may point at LinkedIn, IMDb or a personal portfolio; once you follow that link you are on someone else's site, under their policy, and we have no part in what they record.
03What we collect
Browsing the store, the roadmap and the creators board takes no account and no personal data beyond the technical records in the last row below. Everything else starts with something you type.
| Data | Where it comes from | What it is for |
|---|---|---|
| Account: your name, e-mail address, password (stored only as a hash), role and account status | You, at registration | Creating the account, signing you in, telling you apart from other creators |
| The invite code you registered with, and the fact that it is now spent | You, at registration | Admission to the closed alpha; making sure a single-use code is used once |
| Sign-in records: session identifier, IP address, browser user agent, time of last activity | Recorded automatically while you are signed in | Keeping you signed in, and spotting hijacked or abusive sessions |
| Stage submissions: the unit and production stage, a link to your work, and any note you add | You, from the CREATE button | Reviewing the work, listing it in My Hangar, crediting it on the unit |
| Messages to the desk: whether it is an idea, feedback or a message, your e-mail address and what you wrote | You, from the footer console | Reading it and writing back |
| Vehicle requests: the unit, manufacturer and category you are asking for, your e-mail address and any note | You, from the [+] tile in the catalog | Deciding what the catalog carries next and telling you when it lands |
| Creator profile: display name, country, departments, and — only if you fill them in — experience, credits, links, portrait and introduction | You, at registration and later from My Hangar | Your public profile and your place on the creators board |
| Server and application logs: request metadata, IP address, error traces | Recorded automatically | Keeping the site up, diagnosing faults, investigating abuse |
We do not ask for and do not want special categories of data (article 9 GDPR): health, ethnicity, political or religious views, trade union membership, biometrics, sexual orientation. Please keep them out of profile text and messages — there is no field here that needs them.
We buy no data from brokers, we enrich nothing from third-party sources, and we build no advertising or behavioural profile of you. There is no analytics package on this site.
04Why we process it, and on what legal basis
Every purpose below is tied to one of the six grounds in article 6(1) GDPR. Where a purpose has no ground, we do not pursue it.
| Purpose | Legal basis |
|---|---|
| Creating and running your account, signing you in, showing your hangar, accepting and reviewing your submissions | Performance of a contract — article 6(1)(b). Without these details there is no account to give you. |
| Publishing your creator profile and your entry on the creators board | Article 6(1)(b) for the profile itself, which is the point of a creator account. The optional fields — portrait, introduction, credits, links — are published on your consent, article 6(1)(a), and stop being published when you remove them. |
| Answering an idea, a piece of feedback, a message or a vehicle request | Legitimate interests — article 6(1)(f): being reachable and answering the person who wrote to us. Where the message is about your own account, article 6(1)(b). |
| Keeping the platform secure and usable: session integrity, blocking forged posts, rate limiting, abuse and fraud prevention, debugging | Legitimate interests — article 6(1)(f), recognised in recital 49 as a legitimate interest in network and information security. |
| Deciding what the catalog and the roadmap should carry, from what people ask for in aggregate | Legitimate interests — article 6(1)(f): building the platform the people using it are asking for. |
| The cookies the site cannot work without | Legitimate interests — article 6(1)(f) — and exempt from the consent requirement of article 22.2 of Spain’s Law 34/2002 on information society services and electronic commerce (LSSI-CE) because they are strictly necessary to deliver a service you requested. |
| Keeping records the law requires us to keep — tax and accounting records once selling starts | Legal obligation — article 6(1)(c). |
Where we rely on legitimate interests we have weighed them against your rights and freedoms, and we have kept the processing to what the purpose actually needs. You can object to any of it — see your rights below — and we stop unless we can show compelling grounds that override yours.
07Where the data is
The platform and its database are hosted in the European Union, and we choose EU regions for our processors wherever the service offers them.
Where a supplier processes personal data outside the European Economic Area, we transfer it only under chapter V GDPR: an adequacy decision (article 45), or the European Commission's Standard Contractual Clauses (article 46) together with the technical and organisational measures the transfer requires. You can ask us for a copy of the safeguards that apply to a specific transfer.
08How long we keep it
We keep personal data no longer than the purpose it was collected for needs (article 5(1)(e) GDPR). In practice:
| Data | Kept for |
|---|---|
| Account and creator profile | As long as the account exists. After you close it: deleted or irreversibly anonymised within 90 days, except what we must keep by law |
| Stage submissions | As long as the account exists. Work already published in the catalog keeps its credit to your creator name unless you ask us to remove the attribution |
| Messages, feedback, ideas and vehicle requests | 24 months after the exchange ends, so we can pick up a thread and not ask you the same thing twice |
| Sign-in records | Expire on their own; the rows are cleared within 30 days of expiry |
| Server and application logs | 90 days, and longer only for the specific records under investigation in a security incident |
| Invite code and who spent it | As long as the account it admitted exists |
| Cookie acknowledgement | 12 months, then the notice is shown once more |
09Your rights
Chapter III GDPR gives you the following rights over your personal data. They are yours to use, free of charge, and using them costs you nothing else here either — we will not degrade your account because you asked.
- Access (article 15) — a copy of the personal data we hold about you, and the explanation of what we do with it.
- Rectification (article 16) — have inaccurate details corrected and incomplete ones completed. Your name, e-mail and profile you can also edit yourself in Settings.
- Erasure (article 17) — have your data deleted where we no longer have a ground to hold it. This is the "right to be forgotten"; it does not reach records we are legally required to keep.
- Restriction (article 18) — have us park the processing while a dispute about accuracy or grounds is worked out.
- Portability (article 20) — receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent straight to another controller where that is technically feasible.
- Objection (article 21) — object to processing based on legitimate interests, on grounds relating to your situation. We stop unless we can demonstrate compelling legitimate grounds that override your interests.
- Withdraw consent (article 7(3)) — where we rely on your consent, you can withdraw it at any time, as easily as you gave it. That does not make what we did before it unlawful.
To use any of them, write to info@hardsurface.xyz. We may ask you to confirm who you are before we act — an account's data should not be handed to someone who merely knows the address. We answer within one month of the request, and tell you within that month if the request is complex enough to need up to two more (article 12(3) GDPR).
If you are not satisfied with how we handled it, you can lodge a complaint with a supervisory authority (article 77 GDPR). Ours is the Agencia Española de Protección de Datos (AEPD) — aepd.es — and you may also complain to the authority in the EU country where you live or work. We would rather you came to us first, but nothing here requires you to.
10Automated decisions
We take no decision about you by automated means that produces legal effects or similarly significantly affects you, within the meaning of article 22 GDPR, and we do not profile you.
Ranking on the creators board is a straight count of contributions, not a judgement of you. Registration approval, submission review and moderation are done by a person, and you can always ask that person why.
11How we protect it
Article 32 GDPR requires measures appropriate to the risk. Ours, concretely:
- Passwords are stored as bcrypt hashes. We never hold your password, and nobody here can read it or tell you what it is.
- Everything travels over TLS; the session and consent cookies are encrypted and unreadable to scripts in your browser.
- Every form post and action carries a CSRF token, so another site cannot act as you.
- Access to production data is role-based and kept to the people who need it to do the work.
- Asset uploads go straight from your browser to object storage over short-lived signed links, so files do not linger on intermediate servers.
- Public endpoints are rate limited, and every request is validated and authorised on the server rather than trusted from the client.
If a breach happens anyway, we report it to the Agencia Española de Protección de Datos (AEPD) without undue delay and within 72 hours where the breach is likely to pose a risk (article 33), and we tell you directly, in plain language, when the risk to you is high (article 34).
12Children
This is a professional platform and it is not directed at children. Accounts are for people of 18 or older and we do not knowingly collect data from anyone younger.
If you believe a child has given us personal data, write to info@hardsurface.xyz and we will remove it.
13What is public
A creator account is a public one: the board and your profile page are what a studio is pointed at. Public, and indexable by search engines, are your creator name, country, departments, contribution count, and anything you choose to add to your profile — portrait, introduction, experience, credits and links — plus your credit on catalog entries you worked on.
Not public, ever: your e-mail address, your password, your sign-in records, the notes on your submissions, and anything you send to the desk.
Treat the profile fields as what they are — a published page. Nothing you would not want quoted belongs in them.
14Changes to this policy
The platform is being built, so this text will change with it — when the store starts selling, when a supplier is added, when a feature collects something new. The version and date at the head of this page always say which text you are reading.
A change that materially affects you is announced on the site and, where you have an account, by e-mail before it takes effect. Where a change needs your consent, we ask for it rather than assuming it from your continued use.
15Contact
Questions about this policy, or a request under one of the rights above: info@hardsurface.xyz.
Hardsurface - Valencia, Spain.
Privacy policy · Version v002 · · Contact: info@hardsurface.xyz