Privacy Policy
This policy explains how FlashXCode Consulting (“we”, “us”) handles personal data when you use FlashXTool at tool.flashxcode.com. We are the controller of this data. Contact: contact@flashxcode.com.
1. Data we collect
- Account: email address, password (stored only as a secure hash), role, sign-up and last login dates, the date you accepted the Terms, a profile picture if you upload one, and the 2FA secret if you turn on two-factor authentication.
- Vehicles and results: the VINs you search, the results returned (vehicle data, options, ECU list, CarPlay data, factory order, SFA tokens, NCD files) and the cars in My Cars.
- Files: files you upload (for example FA and SVT exports) and files we generate for you (FA XML, NCD ZIP, SFA token files).
- Wallet and payments: top-ups, charges and balance; for PayPal payments the PayPal order and capture IDs and the payer email PayPal returns. We never receive your card or bank details.
- Desktop Tool: if you use the desktop agent or Remote Tool: agent token, device (hardware) ID, connection status and the IP address used for remote sessions.
- Technical: IP address, browser information and timestamps in server logs, and the cookies described in the Cookie Policy.
2. Why we use it
- To provide the Service: your account, running services, saving results and files (performance of our contract with you).
- To take payments and keep financial records (contract and legal obligations).
- To keep the Service secure and prevent fraud and abuse (our legitimate interest).
- To answer your questions and support requests.
We don't sell your personal data and we don't use it for advertising.
3. Who we share it with
- PayPal, to process top-ups. PayPal handles your payment under its own privacy policy.
- Our vehicle data provider, which receives the VIN (and for NCD 2.0 the FA and SVT files) to produce the result. It doesn't receive your email or name from us.
- Our hosting provider, which stores the Service and its data on our behalf.
- Google Fonts, which serves the typeface and receives your IP address when pages load fonts.
- Authorities, when the law requires it.
Some of these providers may process data outside your country. Where required, we rely on appropriate safeguards such as standard contractual clauses.
4. How long we keep it
- Files (uploads and generated files such as PDFs, ZIPs and token files): 30 days, then they are deleted automatically. You can delete them sooner yourself.
- Account data, orders and results: while your account exists. When your account is closed we delete or anonymise its data.
- Payment and wallet records: for as long as accounting and tax law requires.
- Server logs: for a limited time, for security.
5. Your rights
Depending on where you live (for example under the EU/UK GDPR), you can ask to access, correct, delete or export your data, object to or restrict its use, and withdraw consent. Write to contact@flashxcode.com; we answer within 30 days. You can also complain to your data protection authority.
6. Security
Passwords are hashed, connections use HTTPS, sessions expire after 24 hours and you can turn on two-factor authentication. No system is completely secure, so keep your password private.
7. Children
The Service isn't meant for anyone under 16 and we don't knowingly collect their data.
8. Changes
We may update this policy. The date at the top shows the latest version.