Privacy Policy
MyEcuFile – https://myecufile.com and https://panel.myecufile.com
Effective date: 5 November 2026 Last updated: 5 November 2026
1. Introduction
This Privacy Policy explains how [LEGAL ENTITY NAME] ("MyEcuFile", "we", "us", "our") collects, uses, discloses, stores and protects personal data when you visit our website, create an account, use our customer panel and related services (together, the "Services"), or otherwise communicate with us.
MyEcuFile provides ECU (engine control unit) file services to professional customers such as vehicle tuning workshops and dealers. Our Services are intended for business users aged 18 or over.
By using the Services you acknowledge that you have read this Policy. Where the law requires your consent for a particular activity, we will ask for it separately; this Policy is not itself a request for consent.
2. Who is responsible for your data (controller)
| Controller | [LEGAL ENTITY NAME], [registered address], [country], company/trade register no. [NUMBER], tax no. [NUMBER] |
| Privacy contact | support@myecufile.com |
| General contact | hello@myecufile.com |
| Data Protection Officer | [Name / contact – or: "We have not appointed a DPO because we are not legally required to do so; privacy enquiries go to the address above."] |
| EU representative (Art. 27 GDPR) | [Name and address – required if we have no establishment in the EU/EEA and the GDPR applies to us] |
| UK representative (Art. 27 UK GDPR) | [Name and address – if applicable] |
For the personal data contained in customer orders that we process on behalf of the customer's own end clients (for example vehicle identification numbers), see section 4.3 – the roles of controller and processor may differ.
3. Personal data we collect
3.1 Data you give us
- Account data: name, company name, email address, password (stored only as a salted hash, never in plain text), phone number, country, language, time zone, billing address, tax/VAT number, profile picture.
- Order data: vehicle make, model, generation, engine, ECU type, gearbox, model year, selected services/options, order notes, the ECU file(s) you upload, files delivered to you, and messages exchanged about an order. Uploaded files may contain vehicle identifiers (for example a VIN) or other information that can relate to an identifiable person.
- Payment and billing data: credit purchases, wallet balance and transactions, invoices, currency, payment status and refund history. Card details are entered on our payment provider's page and are not stored on our servers; we receive only a payment reference, status, and limited card metadata (such as brand and last four digits).
- Communications: messages sent through live chat, support requests, the contact form, email, and notification preferences.
- Security data you choose to set up: two-factor authentication secrets and recovery information.
3.2 Data collected automatically
- Log and device data: IP address, approximate location derived from the IP address (country/city), browser and operating system, device type, referring page, pages and features used, date/time and error logs.
- Session and security data: login history, active sessions, failed login attempts, rate-limiting and abuse-prevention signals, and online/presence status within the panel.
- Cookies and similar technologies: see section 9.
3.3 Data from other sources
- Fulfilment partner: status updates, messages and delivered files relating to your orders from our fulfilment platform (see section 5).
- Payment provider: confirmation of payment, fraud-check results and refund status.
- Public sources and authorities: where needed for legal compliance, such as sanctions or fraud checks.
We do not intentionally collect special-category data (such as health, biometric or political data), and we ask you not to include any in messages or files.
4. Why we use your data and our legal bases
| Purpose | Data used | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Create and manage your account; authenticate you; provide the panel | Account, security, log data | Performance of a contract (Art. 6(1)(b)) |
| Process orders, deliver files, provide support and live chat | Account, order, communication data | Contract (Art. 6(1)(b)) |
| Process payments, credits, invoices and refunds; accounting and tax compliance | Payment, billing data | Contract; legal obligation (Art. 6(1)(c)) |
| Send service notices (order status, security alerts, policy changes) | Account, order data | Contract; legitimate interests (Art. 6(1)(f)) |
| Protect the Services: fraud and abuse prevention, security monitoring, bot and attack mitigation | Log, device, session data | Legitimate interests (Art. 6(1)(f)) – keeping our Services and customers safe |
| Improve and develop the Services, troubleshoot, produce aggregated statistics | Usage, log data | Legitimate interests (Art. 6(1)(f)) |
| Marketing emails and newsletters to business contacts | Name, email, company | Consent where required by law; otherwise legitimate interests, with an easy opt-out |
| Non-essential cookies/analytics (if enabled) | Cookie data | Consent (Art. 6(1)(a)) |
| Establish, exercise or defend legal claims; comply with law and respond to lawful requests | Any relevant data | Legal obligation; legitimate interests |
| Corporate transactions (merger, sale of assets) | Any relevant data | Legitimate interests |
Where we rely on legitimate interests, we balance them against your rights and interests. You may ask us for details of that assessment (section 12).
Automated decisions. We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing. Automated tools are used for security and abuse prevention (for example blocking abusive traffic).
4.3 Customer-provided end-client data
If you upload files or enter information that relates to your own customers (for example a vehicle owner), you are responsible for having a lawful basis and for informing those individuals. In respect of that data we act as your processor/service provider and process it only to perform the order and on your instructions. On request we will enter into a data processing agreement (DPA) with you.
5. Who we share data with
We do not sell your personal data. We share it only as follows:
- Fulfilment partner (main platform). To complete orders, your order data, uploaded files, messages and related status information are transmitted to the technical platform operated by our fulfilment partner, [CareCuFile / legal entity name and country], which prepares and returns the files. The partner processes this data on our behalf under a written agreement [or: as an independent controller for its own platform – confirm and keep one].
- Payment provider: Stripe (Stripe Payments Europe Ltd. / Stripe, Inc.) processes payments as an independent controller for its regulatory duties and as our processor otherwise.
- Hosting and infrastructure providers: servers and storage located in [country / region, e.g. Germany/Finland (EU)].
- Email and communication providers: used to send transactional and service emails.
- Professional advisers: lawyers, accountants, auditors and insurers under duties of confidentiality.
- Authorities and legal requests: courts, regulators, tax and law-enforcement authorities where we are legally required or to protect rights, safety and security.
- Business transfers: a successor entity in the event of a merger, acquisition, financing or sale of assets, subject to this Policy.
- With your direction: anyone else you ask us to share with.
- Analytics/marketing providers: [none at present / list providers] – only if you consent where required.
Our service providers may use data only to provide services to us and under confidentiality and security obligations. An up-to-date list of sub-processors is available on request.
6. International transfers
We and our providers may process data in countries other than your own, including countries outside the European Economic Area (EEA), the United Kingdom or Switzerland that may not offer the same level of protection. Where required we rely on safeguards such as:
- an adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified);
- Standard Contractual Clauses approved by the European Commission, and the UK International Data Transfer Addendum/Agreement;
- other mechanisms permitted by applicable law (including, for Turkish law, transfers under Article 9 of Law No. 6698 – see section 14), together with supplementary measures where appropriate.
You may request a copy of the relevant safeguards using the contact details in section 2.
7. Retention
We keep personal data only as long as needed for the purposes in this Policy, unless a longer period is required by law. Typical periods:
| Data | Retention |
|---|---|
| Account data | While the account is active and for up to [24] months afterwards, unless you delete it earlier |
| Order data, uploaded and delivered files | [Up to 24 months after the order, to allow re-delivery, support and dispute resolution] |
| Invoices, accounting and tax records | As required by law (commonly 6–10 years, depending on the country) |
| Payment references | As required for accounting, chargeback and fraud-prevention purposes |
| Security and access logs | [Up to 12 months] |
| Support and chat messages | [Up to 36 months] |
| Marketing preferences | Until you opt out, then a minimal suppression record |
| Cookies | See the cookie table (section 9) |
Account deletion. You can request deletion of your account at any time in the panel or by contacting us. Where records must be kept (for example invoices, financial and legal-claim records), we anonymise or restrict them and delete the remainder. Anonymised data no longer identifies you and may be retained.
Backups are overwritten on a rolling schedule; deleted data may remain in backups for a limited time before removal.
8. Security
We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS/TLS), salted password hashing, optional two-factor authentication, role-based access control, access logging, rate limiting and abuse detection, segregated storage outside the public web root, and regular backups. No system is completely secure. Please use a strong, unique password, enable two-factor authentication and keep your credentials confidential. If a personal data breach is likely to put your rights at risk, we will notify the competent authority and affected individuals as the law requires.
9. Cookies and similar technologies
We use:
- Strictly necessary cookies/local storage: authentication tokens and sessions, security, load balancing, language and theme preferences. These do not require consent.
- Functional storage: remembered interface settings.
- Analytics/marketing technologies: [We do not currently use analytics or advertising cookies. / We use [PROVIDER] for aggregated analytics, only after consent where required.]
You can manage cookies in your browser settings and, where offered, through our cookie banner. Blocking strictly necessary cookies may prevent the panel from working.
| Name / key | Purpose | Duration | Type |
|---|---|---|---|
| [session / auth token] | Keeps you signed in | Session / [x] days | Necessary |
| [language, theme] | Remembers preferences | [12 months] | Functional |
| [add all others] |
10. Marketing communications
We may email business contacts about our services. You can opt out at any time through the unsubscribe link or by contacting us; service and security messages are not marketing and will still be sent.
11. Third-party links and services
Our site may link to third-party websites (for example social media profiles such as Instagram and Medium). Those parties have their own privacy policies, and we are not responsible for them.
12. Your rights
Subject to applicable law, you may have the right to:
- access your personal data and receive a copy;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten");
- restrict processing;
- object to processing based on legitimate interests, and to direct marketing at any time;
- data portability (receive data in a structured, machine-readable format);
- withdraw consent at any time, without affecting earlier lawful processing;
- not be subject to solely automated decisions with significant effects;
- lodge a complaint with a supervisory authority (in the EU/EEA, the authority in your country of residence, workplace or the place of the alleged infringement; in the UK, the Information Commissioner's Office; in Turkey, the Personal Data Protection Authority – KVKK).
How to exercise them: email support@myecufile.com from your registered address. We may need to verify your identity. We respond within one month (extendable by two further months for complex requests, as permitted by law) and generally do not charge a fee, unless requests are manifestly unfounded or excessive. Where we cannot fully comply, we will explain why.
13. Additional information for specific regions
13.1 European Economic Area, United Kingdom and Switzerland
The legal bases in section 4 and the transfer safeguards in section 6 apply. For Switzerland, references to the GDPR include the revised Federal Act on Data Protection (FADP).
13.2 California and other US states (CCPA/CPRA and similar laws)
In the preceding 12 months we may have collected the following categories: identifiers; customer records; commercial information (orders, purchases); internet and network activity; geolocation (approximate); professional/business information; and inferences used only for security. We collect them for the business purposes in section 4 and disclose them to the service providers in section 5.
- We do not sell personal information and do not share it for cross-context behavioural advertising. We do not knowingly sell or share data of persons under 16.
- Residents may request to know/access, correct, delete and port their data, and to limit use of sensitive personal information (we do not use it beyond what is permitted). We will not discriminate against you for exercising your rights.
- You may use an authorised agent. We will verify requests and respond within 45 days (extendable once by 45 days).
- We honour recognised opt-out preference signals (for example Global Privacy Control) where required.
- Residents of Virginia, Colorado, Connecticut, Utah, Texas and other states with comprehensive privacy laws have similar rights, including the right to appeal a refusal by replying to our decision within 60 days.
13.3 Türkiye (KVKK – Law No. 6698)
Data controller: see section 2. Personal data is processed for the purposes in section 4 on the grounds stated in Article 5 of Law No. 6698 (performance of a contract, legal obligation, legitimate interest, establishment/exercise of a right, and explicit consent where required). You may apply to us under Article 11 to learn whether your data is processed, request information, learn the purpose, learn recipients in Türkiye or abroad, request correction, deletion or destruction, request notification of those actions to third parties, object to results produced exclusively by automated analysis, and claim compensation for damage. Applications are answered free of charge within 30 days; the Authority may impose a fee if the process requires additional cost. Transfers abroad are made in line with Article 9. Registration with VERBİS and the Information Obligation notice are handled as required: [confirm].
13.4 Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act 1988), South Africa (POPIA), UAE, Saudi Arabia and other jurisdictions
Where these laws apply, you have the rights they provide, which are substantially covered in section 12 (including confirmation of processing, access, correction, anonymisation or deletion, portability, information on sharing and withdrawal of consent). You may contact the competent authority in your country. For Brazil, our contact for data subjects is the address in section 2 [DPO/Encarregado: name].
14. Children
The Services are directed to businesses and are not intended for anyone under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided data, contact us and we will delete it.
15. Changes to this Policy
We may update this Policy from time to time. We will post the new version here with a new "Last updated" date and, for material changes, notify you by email or in the panel in advance where the law requires. Continued use after the effective date means you have been informed of the changes; where consent is required, we will request it again.
16. Governing language
This Policy is originally drafted in English. Translations are provided for convenience; if there is a conflict, the English version prevails, unless local mandatory law requires otherwise.
17. Contact
[LEGAL ENTITY NAME] [Street address, postcode, city, country] Privacy: support@myecufile.com General: hello@myecufile.com Website: https://myecufile.com