Privacy Policy | Peak Time Garage

1. Who is responsible

Peak Time Garage is responsible for the personal information described here. For privacy questions, access requests or corrections, contact info@peaktimegarage.com.

2. Information we collect

Depending on how you use PTG, we collect:

your email address, order reference, purchased products, prices, payment status and download activity;
messages and other information you send to support;
newsletter signup and unsubscribe status;
promoter name, email, country, promoter code, account identifiers, referral activity, sales, commission, payout and terms-acceptance records;
technical request information needed for security, authentication and service operation; and
for promoter attribution, a signed referral cookie and one-way keyed hashes derived from an IP address and user-agent information.

Stripe supplies order and payment-confirmation information to us. We do not receive or store your full payment-card number. If you do not provide required checkout or account information, we may be unable to fulfil an order or operate the promoter account.

3. How we use information

to validate, fulfil, support and refund orders;
to issue secure order-access and temporary download links;
to operate accounts, authenticate users and protect the service;
to run the promoter programme, attribute eligible sales, calculate commission, prevent abuse and record payouts;
to send transaction, account and programme messages;
to send marketing only where we have the required consent; and
to meet legal, tax, accounting and dispute-resolution obligations.

4. Cookies and local storage

The cart is saved in your browser's local storage so it remains after a refresh. Supabase authentication uses cookies when you sign in. These technologies are needed for the feature you request.

Visiting a valid promoter link sets a signed, HttpOnly referral cookie for up to 60 days. If that cookie is unavailable, PTG may use a keyed hash of the visitor's IP address to match a checkout to one promoter whose link was visited within the previous seven days. We store the hash, not the plain IP address, in the referral record. A valid promoter code entered at checkout takes priority over link or IP-based attribution.

5. Email

Order fulfilment and account-access messages are transactional. Joining the PTG crew list is voluntary and is used for marketing updates. Our marketing messages will identify PTG and provide a clear way to unsubscribe. We will action valid unsubscribe requests and may retain a suppression record so we do not add the address again by mistake.

6. Service providers and overseas processing

We use providers that process information on our behalf: Stripe for payments, Supabase for database and authentication services, Cloudflare R2 for private digital files and previews, Resend for email and contact lists, and Vercel for website hosting. A payout provider such as Wise or a bank may process promoter payout details.

These providers may process information outside New Zealand. We take reasonable steps to use providers and arrangements that protect information appropriately. Providers also process information under their own terms and privacy notices when they act independently.

7. Retention and security

We keep information only as long as reasonably needed for the purposes above, including legal, tax, accounting, fraud-prevention and dispute requirements. Orders, promoter consent, commission and payout records may need to be retained longer than routine website logs. Newsletter details are retained until unsubscribe or removal, subject to any suppression record.

We use access controls, server-only credentials, restricted database permissions, signed tokens and short-lived private-file URLs. No system can be guaranteed completely secure, so please protect access emails and notify us promptly if you suspect misuse.

8. Access, correction and complaints

You may ask whether we hold personal information about you and request access to or correction of it, subject to lawful exceptions. You may also withdraw marketing consent. Email info@peaktimegarage.com. If a New Zealand privacy concern is not resolved, you may contact the Office of the Privacy Commissioner.

9. Changes

We may update this statement when our services or privacy practices change. The current version and its date will remain available here.