Privacy Policy

Controller

The data controller is ECU Studio®. Address/contact address: Carrer de l'Actor LLorens 30, Bajo Derecha - Valencia - 46021 (Spain). VAT/NIF: ESY7426782G. DPO not appointed. For privacy requests: support@ecustudio.com.

Data We Process

• Account and profile data: name, surname, email, company, VAT/tax ID, address, phone and app preferences.
• Vehicle and device data: device serials, sharing state, rides, VINs, calibration identifiers, photos and diagnostic data.
• Tune Store and Tune Edit data: purchases, tune identifiers, flash/session state, workspaces and publish requests.
• Payment data: credits, transactions, payment-provider references, invoice or receipt metadata and tax data.
• Support data: support tickets, messages, bookings, attachments and related technical context supplied by the user.
• Security and operational data: login/session records, abuse-prevention data, minimized app events and audit logs.

Purposes

We use personal data to provide the service, manage accounts, devices, vehicles, tuning, payments, support, security, abuse prevention and tax/accounting obligations. We do not sell personal data, we do not share it for third-party marketing, and we do not perform advertising profiling.

If a support or admin assistant is used, the relevant question, recent conversation and limited app context may be processed by an assistant provider to produce an answer. Support assistant conversations are stored for a limited period to improve the service and to detect and prevent abuse. Users and admins must not include passwords, payment card data or unnecessary third-party data in assistant messages.

Legal Bases

The main legal bases are: performance of a contract for account and app functions; legal obligation for payments, invoices and accounting; legitimate interest for security, technical logs, fraud prevention and support; consent only for any non-essential cookies or tools.

Recipients And Providers

We share personal data only where necessary with service providers that help us operate the app, including:

• cloud hosting, database, storage and security providers;
• authentication and anti-abuse providers;
• payment, invoicing and tax validation providers;
• email and customer communication providers;
• device connectivity providers for diagnostics, live data and flash-related commands;
• support and assistant providers, where enabled;
• legal, accounting or public authorities where required by law.

These providers process data under contractual obligations and only for the purposes described in this policy.

International Transfers

Some providers may process data outside the European Economic Area. Where this happens, ECU Studio uses the provider data processing terms and applicable safeguards such as adequacy decisions, the EU-U.S. Data Privacy Framework where applicable, or Standard Contractual Clauses.

Retention

We keep personal data only for as long as necessary for the purposes described in this policy.

Account, profile, vehicle, diagnostic, ride and app data are kept while the account is active. If an account is deleted, we delete or minimize personal data unless we need to keep limited records for legal, accounting, security, fraud prevention, support or dispute purposes.

Payment, invoice and transaction records are kept for the period required by tax and accounting laws. Support records are kept only as long as needed to provide support and maintain service history; attachments may be removed earlier.

Operational and security logs are kept for a limited period needed for security, abuse prevention, troubleshooting and service reliability, then deleted or anonymized. Data export and account deletion requests may be kept as a minimal audit record of the request and outcome.

Your Rights

You can request access, rectification, deletion, restriction, portability, objection and withdrawal of consent where applicable. From the app settings you can request a data export and request account deletion. You can also write to support@ecustudio.com.

Requests are handled after reasonable identity verification. Data export requests are delivered by email after admin review. Account deletion disables access immediately and queues irreversible cleanup in the management process.

Cookies And Local Storage

Strictly necessary cookies and local storage for login, security, language, preferences and consent are always active. reCAPTCHA is used on signup for anti-abuse. Non-essential analytics or similar tools, if added, must be loaded only with consent. Details are available in the Cookie Policy.

Automated Decisions And Minors

ECU Studio does not use personal data for advertising profiling or solely automated decisions with legal or similarly significant effects. The service is not directed to children.

Complaint

You may lodge a complaint with the competent supervisory authority: Agencia Española de Protección de Datos, www.aepd.es.