Privacy Policy

The controller of your personal data is the operator of ECU.EXPERT, available at ecu.expert ("we", "us").

For any question about personal data, write to ecuexpert2026@gmail.com.

This policy covers visitors to the website, people who create an account and use the customer dashboard (such as workshop owners and staff), and people who contact us.

You provide most of the data yourself: when you register, create a project, upload files and submit requests. We receive some data from others:

• from Google, if you sign in with Google: your email address, name and profile picture URL from your Google account;
• from Stripe, when you buy credits: the payment status, amount paid and currency, Stripe payment and customer identifiers, and information about refunds and disputes (chargebacks).

Providing data is voluntary, but you can't create an account without an email address, and we can't carry out a request without the vehicle details and the original file.

• Account data

  Examples

  email address, password (stored only as a hash by the authentication provider), language, account role, sign-up and sign-in dates

  Source

  you

• Google account data

  Examples

  email address, name, profile picture URL, Google account identifier

  Source

  Google (if you choose Google sign-in)

• Projects and vehicle data

  Examples

  make, model, engine, ECU manufacturer and model, notes and request descriptions

  Source

  you

• ECU files

  Examples

  original (ORI) and modified (MOD) files, filenames, size, SHA-256 checksum, version and download history

  Source

  you, our specialists

• Requests

  Examples

  ordered services, statuses, specialist notes, dates, the person handling the request

  Source

  you, our specialists

• Credits

  Examples

  balance, reservations and credit transaction history, including the reason for adjustments

  Source

  the system, administrators

• Purchases

  Examples

  package, credits, amount and currency, payment status, Stripe identifiers (session, payment, customer), refunds and disputes

  Source

  you, Stripe

• Document acceptances

  Examples

  the version of the Terms you accepted and confirmations that a service may start before the withdrawal period ends, the date and the context (credit purchase or request)

  Source

  you

• Emails

  Examples

  recipient addresses, notification type, delivery status and the provider's message identifier

  Source

  the system

• Technical data

  Examples

  IP address, browser type, requested page and time of the request in server and authentication provider logs

  Source

  your browser

We never process full payment card numbers or bank login details: you enter them only on Stripe's payment page.

• Creating and running your account and signing in, including with Google

  Legal basis (GDPR)

  Art. 6(1)(b): performance of the contract for electronic services

• Accepting and carrying out ECU file modification requests, storing file versions and making them available for download

  Legal basis (GDPR)

  Art. 6(1)(b): performance of the contract

• Keeping your credit balance, selling credit packages and handling payments

  Legal basis (GDPR)

  Art. 6(1)(b): performance of the contract

• Recording acceptance of the Terms and confirmations required by consumer law, so we can show the terms of the contract

  Legal basis (GDPR)

  Art. 6(1)(b), (c) and (f): performance of the contract, legal obligation and our legitimate interest (evidence of the contract)

• Issuing accounting documents and keeping tax records

  Legal basis (GDPR)

  Art. 6(1)(c): legal obligation under tax and accounting law

• Transactional emails about requests (such as request received, status changed, MOD file ready) and account emails (address confirmation, password change)

  Legal basis (GDPR)

  Art. 6(1)(b): performance of the contract

• Security of the service, abuse prevention, the administrative action log, handling refunds and payment disputes

  Legal basis (GDPR)

  Art. 6(1)(f): our legitimate interest in protecting the service and its accounts

• Establishing, exercising or defending legal claims

  Legal basis (GDPR)

  Art. 6(1)(f): our legitimate interest

We don't send marketing emails and don't process data on the basis of consent. If that changes, we'll ask for your consent separately and update this policy.

We don't make decisions based solely on automated processing, including profiling, that produce legal effects for you. Every MOD file is prepared and checked by a person.

ECU files are vehicle control unit software. They can, however, contain data identifying a specific vehicle, such as the VIN or component serial numbers, and together with your account and request description they may make the vehicle's owner identifiable. We therefore treat them as personal data.

• Files are kept in private file storage. They are never publicly accessible; downloading requires signing in and works only through a short-lived signed link.
• Files can be accessed by you (files in your projects) and by our specialists and administrators who carry out the requests.
• We don't sell files or share them with anyone other than the infrastructure providers listed below.

If you upload files or vehicle data belonging to your own customers, you decide what data you give us and you're responsible for being allowed to share it. Send only the data needed for the request (such as vehicle and ECU details), without your customers' personal data.

You buy credit packages on Stripe's payment page (Stripe Checkout). There are two separate sets of data:

• Stripe processes the payment details you enter on its payment page (such as card, BLIK or bank transfer details, email address, billing country or address) and data needed for fraud prevention. When a payment is handled through Stripe Managed Payments, Stripe is the merchant of record for that transaction and processes this data as an independent controller under its own privacy policy.
• We keep only the purchase record: the package, credits, amount and currency, status, Stripe session, payment and customer identifiers, dates, and refund and dispute information. We use this record to add credits to your balance. We pass Stripe your email address (to prefill the form) and our internal purchase and account identifiers.

We send only account and request-related emails. Request notifications are sent through Resend and contain the vehicle and ECU details, ordered or completed services, the status, the specialist's note, the filename and a link to the dashboard. They contain no attachments and no file download links. Account emails (email address confirmation, password change) are sent by the Supabase authentication provider through: Resend.

We record who we sent a notification to, when, and its status, so it isn't sent twice and delivery problems can be investigated.

We entrust data to providers that process it on our behalf and on our instructions (processors), and share it with organisations acting as independent controllers:

• Supabase

  Role

  processor

  Scope

  database, authentication (accounts, sessions, sign-in logs), ECU file storage

• Vercel

  Role

  processor

  Scope

  application hosting and server logs (IP address, requests)

• Resend

  Role

  processor

  Scope

  sending request notification emails and account emails

• Cloudflare (Turnstile)

  Role

  processor

  Scope

  protecting the registration, sign-in and password reset forms against automated submissions (IP address, technical browser and device data)

• Stripe

  Role

  processor or independent controller (see "Payments")

  Scope

  payment processing

• Google

  Role

  independent controller

  Scope

  Google sign-in, if you choose it; the profile picture shown in the dashboard is loaded from Google's servers

Our specialists and administrators may also receive data to the extent needed to carry out requests, as may public authorities where the law requires it.

The data is processed on the infrastructure of the providers listed, in the regions where they provide their services. Processing outside the European Economic Area follows the rules described below.

Some of the providers listed are based in the United States or may process data outside the European Economic Area. Such transfers take place only with the safeguards required by Chapter V of the GDPR: under an adequacy decision of the European Commission (including the EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission.

You can request a copy of the safeguards by writing to ecuexpert2026@gmail.com.

• Account and account data

  Retention period

  For as long as the account exists and, after it is deleted, for as long as needed to establish, exercise or defend legal claims (until the limitation period ends).

• Projects, ECU files and request history

  Retention period

  For as long as the account exists and, after it is deleted, for as long as needed to handle complaints and to establish, exercise or defend legal claims.

• Purchase records, credit history and accounting records

  Retention period

  For the period required by tax and accounting law.

• Server and sign-in logs

  Retention period

  For a short period set by the hosting and authentication providers (Vercel, Supabase).

Data needed to establish, exercise or defend legal claims may be kept until those claims are time-barred.

Under the GDPR, you have the right to:

• access your data and receive a copy of it (Art. 15);
• have your data rectified (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• data portability for data processed to perform the contract (Art. 20);
• object to processing based on legitimate interests (Art. 21).

To exercise these rights, write to ecuexpert2026@gmail.com from the email address linked to your account. We'll reply without undue delay and within one month at the latest. We may ask for additional information to confirm your identity.

The customer dashboard doesn't yet have an account deletion button. To delete your account, write to ecuexpert2026@gmail.com from the email address linked to your account.

Once the account is deleted, you can no longer sign in to it. Projects, ECU files, request, credit and purchase history are deleted or anonymised separately, except for data we must keep by law (such as accounting records) or to establish, exercise or defend legal claims. In our reply we'll tell you what data we kept and why.

If you believe we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or with the supervisory authority in the EU member state where you live or work.

We use technical and organisational measures appropriate to the risk, in particular:

• an encrypted (HTTPS) connection to the website;
• sign-in sessions in httpOnly cookies that scripts on the page can't read;
• database access control: each customer sees only their own projects, files, credits and purchases;
• private file storage with short-lived signed download links;
• server-side administrator permission checks on every administrative operation and a log of account operations;
• service access keys kept on the server only;
• file checksums that make changes to a file detectable.

No system is completely immune to attacks. If a personal data breach is likely to result in a high risk to your rights, we'll inform you as required by the GDPR.

The website uses no analytics, advertising or tracking cookies and contains no analytics tools or advertising pixels. We use only technologies that are necessary for features you ask for, so we don't show a consent banner:

• sb-…-auth-token (cookie)

  Provider

  ECU.EXPERT (Supabase Auth)

  Purpose

  keeps you signed in (httpOnly; a long session may be split into parts .0, .1)

  Type

  strictly necessary

  Duration

  until you sign out, at most 400 days

  Consent

  not required

• sb-…-auth-token-code-verifier (cookie)

  Provider

  ECU.EXPERT (Supabase Auth)

  Purpose

  secures Google sign-in and password reset (PKCE, httpOnly)

  Type

  strictly necessary

  Duration

  until the sign-in completes (it is then deleted); at most 400 days if the sign-in is abandoned

  Consent

  not required

• ecu.sidebar.collapsed (local storage)

  Provider

  ECU.EXPERT

  Purpose

  remembers the collapsed sidebar in the dashboard

  Type

  functional, set by your action

  Duration

  until cleared in your browser

  Consent

  not required

• ecu.operator-shell.v1 (local storage)

  Provider

  ECU.EXPERT

  Purpose

  operator console: remembers the navigation layout (collapsed or expanded, width, folded groups) and the conversation's message order; no customer data

  Type

  functional, set by your action

  Duration

  until cleared in your browser

  Consent

  not required

The page language comes from the URL only and is never stored in a cookie. Stripe's payment page (checkout.stripe.com) and Google's sign-in page use their own cookies under their own policies: Stripe, Google.

The registration, sign-in and password reset forms load Cloudflare Turnstile (challenges.cloudflare.com), which checks that a person, not an automated script, is submitting the form. It is a security measure necessary to protect accounts and the service against abuse, and it runs only on these forms. Cloudflare's policy: Cloudflare.

You can delete cookies and site data in your browser settings; deleting the session cookies signs you out.

We may update this policy when the service, our providers or the law change. The date of the last update is shown at the top of the page. We'll inform signed-in users of significant changes in advance, for example by email or a notice in the dashboard.