My Garage

Privacy policy

This store sells Tesseract boxes in the name of TSSTBOX OÜ, the company that makes them. This page explains what we do with your personal data. Questions and requests: [email protected].

Who is responsible

The controller of your personal data is TSSTBOX OÜ, registry code 16689914, VAT EE102594197, Veerme tn 23, 11625 Tallinn, Estonia. The person in charge of protecting personal information can be reached at [email protected].

What we collect and why

  • Orders: your email address, phone number, delivery address, what you bought and what you paid. We need them to deliver the order, answer questions about it and keep accounting records.
  • Payments: you pay on Stripe’s checkout page. Stripe handles your card or wallet details; we receive the payment status and amount, not your card number.
  • Account: your email address. Sign-in links and codes are stored only as one-way hashes. Each signed-in browser keeps a session that records its IP address and browser details, and we keep a short sign-in history (time, IP address, browser) so we can email you when your account is used from a new device.
  • My Garage: the machines you add (make, model, year, rack type) and, if you tick the box, the time you agreed to email alerts and the form you used.
  • VIN lookup: if you enter a VIN, it is sent to the vehicle database of the U.S. National Highway Traffic Safety Administration (vPIC) to find the year, make and model. We don’t store or log the VIN.
  • Dealer applications: business name, contact name, email address, phone number, country, region and your message.
  • Emails you send us and our replies.
  • Server logs: each request to the site (page address, time, result, IP address, browser) is logged to keep the site working and secure. Logs contain no payment details and no passwords.
  • Analytics: the site uses Umami, analytics hosted by us on a separate server in the EU. It is cookieless: it sets no cookies and stores nothing on your device. Your browser sends it the page address (campaign UTM parameters kept, other parameters and identifiers removed), the referring site, your browser, device type, screen size and language, page-load speed, and a few actions: choosing a machine, adding to the cart, going to payment, sending a dealer application, requesting a sign-in link and saving a machine. From your IP address and browser details Umami derives your country and a visit code that is reset periodically; the IP address itself is not stored. When an order is paid, our server also sends Umami the order number, amount, currency and market, without your name, email or address. Umami runs without asking for consent; you can turn it off for your browser in our Cookie policy.

Legal bases

As an Estonian company we follow the EU General Data Protection Regulation (GDPR). We process order, payment, account and garage data to perform our contract with you (GDPR Art. 6(1)(b)), and keep accounting records because the law requires it (Art. 6(1)(c)). Sign-in history, server logs, analytics and dealer applications rely on our legitimate interest in a secure site, in understanding how the store is used and in answering business enquiries (Art. 6(1)(f)). Alert emails are sent only with your consent (Art. 6(1)(a)), which you can withdraw at any time in your account.

Who receives your data

Only the services we need to run the store, each for its own task:

  • Stripe — payments.
  • Resend — sends order, sign-in and account emails.
  • Cloudflare — network and security service in front of the site and of our analytics server; it handles every request to them.
  • Our hosting provider — runs the site and its database.
  • The courier that delivers your order — your name, delivery address, phone number and email address.
  • NHTSA vPIC — only the VIN, and only if you use the VIN lookup.

Some of these companies are in the United States. Transfers from the EU rely on the EU–U.S. Data Privacy Framework or on the European Commission’s standard contractual clauses. We don’t sell your personal information, don’t share it for advertising and don’t use advertising or tracking pixels.

How long we keep it

  • Orders and the records behind them: 7 years, as Estonian accounting law requires.
  • Your account, garage and alert consent: until you delete the account. You can do it yourself in your account; sessions end when you sign out or after 400 days without use.
  • Sign-in history: as long as the account exists.
  • Alerts already sent: which new products we told you about, so each is announced once; until you delete the account. Every alert has a one-click unsubscribe link.
  • Addresses our emails could not reach, or that reported an email as spam: kept on a do-not-email list, also after the account is deleted, so we never write to them again.
  • Dealer applications and emails: as long as we are in contact about them; ask us and we delete them sooner.
  • Carts: an unpaid cart is linked to your browser for 60 days.

Your rights

You can ask for a copy of your data, have it corrected or deleted, receive it in a portable format, object to processing based on our legitimate interest and withdraw consent. Write to us from the email address the data is about; we answer within 30 days.

If you are in the EU, you can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or your local authority. In Canada you can contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information. California residents have the right to know, correct and delete their personal information, and we treat these requests the same way; we don’t sell or share personal information.

Security

The site is served only over HTTPS. Sign-in codes are stored as hashes, payment details never reach our servers, and access to the database is limited to the people who run the store.

Children

The store is not meant for children under 16, and we don’t knowingly collect their data.

Changes

If we change what we collect or who receives it, we update this page and the date below. Last updated 1 November 2026.