Privacy Policy

This policy explains what personal data the HULKTUNE portal collects, why, and the rights you have over it. It applies to everyone who creates an account or otherwise uses the portal.

1. Controller

The controller of your personal data is:

2. What we collect

• Account details: your name, email address and password (stored only as a secure hash).
• Profile and billing details: phone number, business name, company email, VAT number, postal address and country, EVC number and the tuning tools you use.
• Service request data: vehicle make, model, generation, engine, ECU, year, power, gearbox and, if you provide it, the licence plate; the read method and tool; the original and additional files you upload; and the tuning files we deliver.
• Messages: what you write in service request conversations and support tickets.
• Transactions: credit purchases, usage, refunds and invoices. Card details are handled by our payment provider; we do not see or store full card numbers.
• Technical data: IP address, browser and device information, and timestamps of sign-ins, collected for security and to keep you signed in.

3. Why we use it and our legal basis

• To provide the service (performance of a contract): running your account, processing requests, delivering files, answering support tickets and sending service emails such as sign-up confirmation and password resets.
• Billing and accounting (legal obligation): issuing invoices and keeping tax records.
• Security and fraud prevention (legitimate interests): protecting accounts, preventing automated sign-ups and investigating abuse.
• Improving our service (legitimate interests): using vehicle and ECU details from requests to improve our tuning work. We do not sell your data or use it for advertising.

4. Who we share it with

We share data only with service providers that help us run the portal, under contracts that require them to protect it and use it only on our instructions:

• Database hosting (Turso) for account and request data.
• Cloud file storage for uploaded and delivered files.
• Resend, to send transactional email.
• Cloudflare Turnstile, to protect forms from bots.
• Our payment provider, to process credit purchases.
• Our accountants and tax authorities, where the law requires.

Our tuners and administrators can see the requests and messages they work on. We may also disclose data if required by law or to protect our rights.

5. International transfers

Some providers process data outside the UK and the European Economic Area. Where they do, we rely on adequacy decisions or standard contractual clauses to keep your data protected.

6. How long we keep it

• Account, profile and request data: while your account is open, and deleted within 90 days of closing it.
• Invoices and transaction records: for as long as tax law requires, usually six years.
• Security logs and sessions: for as long as needed for security, typically no more than 12 months.

7. Cookies and local storage

We use only what is needed for the portal to work: a session cookie that keeps you signed in, cookies set by Cloudflare Turnstile to tell people from bots, and local storage for your light or dark theme choice. We do not use advertising or analytics cookies.

8. Your rights

Under the UK GDPR and EU GDPR you can ask to access, correct or delete your data, restrict or object to how we use it, and receive a copy in a portable format. You can update most profile details yourself in the portal. To exercise any other right, contact us using the details in section 1. We will reply within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk) or the data protection authority where you live.

9. Security

We protect your data with encrypted connections, hashed passwords, access controls that limit staff to the data they need, and private file storage served through short-lived links. No system is completely secure, so please use a strong, unique password.

10. Children

The portal is not intended for anyone under 18, and we do not knowingly collect their data.

11. Changes

We may update this policy. The date at the top shows when it last changed, and material changes will be announced in the portal. See also our Terms of Service.