Privacy Policy

1. Who we are

DriveFlow is run by DriveflowLTD, a company registered in England and Wales. We are the "controller" of the personal information described in this policy, which means we decide how and why it's used. You can contact us about privacy at any time using Contact DriveFlow in your account settings.

2. How we keep your work confidential

Trust is the most important thing we offer. Tuning businesses depend on their files and their customers, so DriveFlow is designed to protect both.

Our promises

• We don't open your files or read your conversations.
• We only look at a job's records if you ask us to (for example, to send you a record of everything you've sent and received), to deal with a dispute or a report of misuse, or if the law requires it.
• We never sell your information, and we never contact or market to a dealer's customers.
• We never use a dealer's files or customer list for anything except delivering their jobs.

3. What we collect

When you create an account

• Your name or business name, email address and account type
• Your password, which is stored by our sign-in system in a form we can't read
• The dealer you're linked to, and when you agreed to our terms

When you send or work on a job

• Vehicle details: make, model, engine, ECU, VIN, mileage, fuel type, and the tool and method used to read the file
• The files you upload, such as ECU and TCU reads and datalogs, and the tuned files sent back
• Notes, messages and photos in the job thread. Photos are made smaller on your device before they're sent, which also removes hidden information such as the location where they were taken.
• The job's progress: when it was sent, delivered, changed or closed

When you pay or get paid

• What was paid, when, who to, and how (card or DriveFlow credit), plus refunds and your credit balance
• Card payments are handled by Stripe. We get a payment reference and the payment status. We never see or store your full card number.
• Dealers: your prices, plan settings, fees and payout status. To pay you, Stripe collects your identity and bank details directly, under Stripe's privacy policy.

Dealers' branding

If you're a dealer, we also store the business name and logo you add. Your customers see them.

Technical information

Our servers process your IP address, device and browser details, and sign-in tokens. They need these to run DriveFlow, keep you signed in and protect against misuse.

When you contact us

We keep the messages you send us so we can help you.

4. How we use it, and why we're allowed to

We don't send marketing emails. If we ever want to, we'll ask you first or give you an easy way to opt out. We don't make decisions about you using only automated means that have legal or similarly significant effects.

5. Who sees your information

• Your dealer. When you send a job, the dealer it goes to sees your name, email, vehicle details, files, messages and photos, and whether you've paid. Dealers are responsible for how they use your information once they have it, under their own privacy notices.
• Partners your dealer brings in. Your dealer may hand your job to another tuner they work with, who may pass it on to one of theirs. Each of them sees your vehicle details, files and messages. They don't see your name or email unless your dealer chooses to share them, and they never see what you paid. Depending on your dealer's account, you may or may not be told who the other tuner is.
• The companies that run DriveFlow for us. Our secure cloud hosting and database providers store and run DriveFlow on our behalf, under contracts that only let them use your information to provide that service.
• Stripe processes card payments and dealer payouts. For some purposes, such as fraud prevention and its own legal duties, Stripe makes its own decisions about your information, under its privacy policy.
• Others when we have to: the police, regulators or courts when the law requires it; our professional advisers, such as accountants and lawyers; or a buyer, if the business is ever sold, who would have to keep these same promises.

We never sell your personal information.

6. Information stored outside the UK

Some of the companies that run DriveFlow for us store or process information outside the UK, including in the European Union and the United States. When they do, the transfer is protected by UK "adequacy" rules (including the UK–US data bridge for certified companies), or by the UK International Data Transfer Agreement or Addendum.

7. How long we keep it

• Your account, jobs, files, messages and photos: while your account is open, so you and your dealer can get to them. A dealer may make tuned files downloadable for a limited time, but the files are kept until they're deleted.
• When you close your account: we delete or anonymise your information within 90 days. The exceptions are below.
• Payment, refund and fee records: 6 years, for tax and accounting.
• Information needed for a complaint, dispute or legal claim: until it's resolved.

Dealers may keep their own copies of your jobs under their own policies.

8. Your rights

Under UK data protection law you have the right to:

• get a copy of your personal information, including a record of the jobs and files on your account
• have wrong or incomplete information corrected
• have your information deleted
• limit how we use it, or object to us using it
• get information you gave us in a format you can take elsewhere
• withdraw your consent, where we rely on it

To use any of these rights, use Contact DriveFlow in your account settings. We'll reply within one month. There's normally no charge.

If you're unhappy with how we've handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

9. Cookies and browser storage

DriveFlow doesn't use advertising or analytics cookies, and our pages don't load anything from advertising or tracking companies. We use your browser's storage to keep you signed in and to remember your choices, such as dark mode and simple mode. These are needed for the service to work as you've asked, so we don't need to ask for your consent.

When you pay by card, Stripe's checkout page uses its own cookies to process the payment and prevent fraud. See Stripe's cookie policy.

10. Children

DriveFlow is for people aged 18 and over. We don't knowingly collect information about children.

11. Changes to this policy

We'll update this page if anything changes, and we'll tell you in DriveFlow about significant changes.

12. Contact us

Use Contact DriveFlow in your account settings. If you can't sign in, ask the dealer you use to pass your message to us.