CAFlash Tuning

Legal

Privacy Policy

Last updated

CAFlash provides ECU calibration files and related services for the BMW N54 engine and DCT transmission. This policy covers the CAFlash website and the order process behind it.

1. Who is responsible for your data

CAFlash is the data controller. For anything in this policy - access, correction, deletion, or a complaint - contact richard@caflash.app.

2. Information We Collect

a. Information you give us

  • Name and email address
  • Vehicle details - VIN, vehicle type, ECU/DME type, ROM identifier, ISN
  • Details of your modifications, where you choose to provide them
  • Anything you write in the enquiry form

b. Payment information

Card details are entered on Stripe's own payment pages and are never sent to, seen by, or stored on this website. We receive from Stripe only the confirmation that payment succeeded, the amount and currency, and your billing email address. Stripe's own privacy policy governs what they hold: stripe.com/privacy.

c. Technical data

  • Your approximate country, derived at Cloudflare's network edge, used only to preselect a currency. It is read during the request and not stored.
  • Standard server logs kept by Cloudflare as our hosting provider, which include IP addresses. See Cloudflare's privacy policy.
  • Your chosen currency, stored in your own browser. See our Cookie Policy.

This site runs no analytics, no advertising, and no third-party tracking.

3. How We Use Your Information

  • To produce and deliver the calibration file you ordered
  • To contact you about your order, or to answer an enquiry
  • To keep records required for tax and accounting
  • To prevent abuse of the free demonstration request form

We do not use your data for marketing, and we do not build customer profiles.

4. Legal basis for processing (UK/EU)

  • Contract - producing and delivering the tune you paid for.
  • Legal obligation - retaining transaction records for tax purposes.
  • Legitimate interests - keeping the site working and preventing abuse of the free demo form.
  • Consent - where you have asked us to contact you about something.

5. How We Share Your Information

We do not sell or rent your personal data.

It is shared only with the services needed to run the business:

  • Stripe - payment processing
  • Cloudflare - website hosting and delivery
  • Google Cloud - the order-processing APIs that generate your file
  • Legal or tax authorities, where the law requires it

6. Data Security

The site is served over HTTPS. Payments are handled entirely by Stripe. API credentials are held as encrypted secrets and are not present in the website code. No system is completely secure, so we cannot guarantee absolute protection.

7. Your Rights (UK/EU Residents)

You have the right to:

  • Access the data we hold about you
  • Correct inaccurate data
  • Request deletion of your data
  • Object to or restrict processing
  • Receive your data in a portable format
  • Lodge a complaint with a supervisory authority - in the UK, the Information Commissioner's Office

To exercise any of these, email richard@caflash.app. We will respond within one month.

Note that a VIN identifies a vehicle rather than a person, but because it can be linked to you as the customer, we treat it as personal data.

8. Children's Privacy

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal data from children.