This policy explains what personal data the Haldex.Flash mobile app sends to us, why we need it, who else handles it, how long we keep it and how you can have it deleted.
1. Who is responsible for your data
Road Rage Performance Ltd is the data controller for the personal data described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
- Controller: Road Rage Performance Ltd, company number 10542607
- Registered office: Unit D5 D6 Forstal Business Park, Paddock Wood, Tonbridge, England, TN12 6PY
- Contact for privacy matters: info@roadrageperformance.co.uk
2. What we collect
Account details
- Your name and email address.
- Your password, which we store only as a one-way hash. We cannot read it.
- Your account type (user or dealer), the dealer your account is linked to if there is one, and whether the account has been approved.
- The date you accepted our terms.
Vehicle details
- The vehicle identification number (VIN).
- The control unit's box code and software version.
The app sends these every time it checks for a licence and when you assign a licence to a vehicle. We need them to confirm the licence, pick the correct file for your control unit and lock the tune to your vehicle.
Licence and flash records
- The licences on your account, the VIN each is assigned to, and the order they came from.
- A record of each flash session: the licence used, the type of file, when it happened and whether it finished, was cancelled or failed.
Support reports
If you choose to send a report from the app, it uploads a diagnostic log to our support team. Reports are only ever sent when you ask for one. Nothing is uploaded automatically.
A report contains:
- the message you write and the category you pick;
- the app's diagnostic log, which by design includes your VIN and account email address so that we can match the report to your vehicle and account;
- app version and build, phone model, operating system and version, adapter firmware version, and whether the previous run of the app crashed.
Passwords and sign-in tokens are stripped from the log before it leaves your phone.
Performance and update data
The app reports screen performance measurements, such as how long screens take to load, along with basic app and device information, and it contacts an update service to check for new versions. See section 5.
Payment details
If you buy a licence from us, payment is taken by Stripe. We receive a record of the order and the billing details Stripe passes back, but we never see or store your full card number. The app itself does not take payments.
What we do not collect
The app does not collect your location, contacts, photos or advertising identifiers, and it contains no advertising or cross-app tracking. It uses Bluetooth only to talk to the OBD adapter.
3. What stays on your phone
After you sign in, the app keeps a sign-in token in the iOS Keychain or Android Keystore, the secure storage your phone provides, so you do not have to sign in each time. It is removed when you sign out or delete the app. Diagnostic logs also stay on your phone unless you send a support report.
4. Why we use it, and our legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Running your account | Account details | Performing our contract with you |
| Checking and assigning licences, delivering VIN-locked files | Vehicle details, licence and flash records | Performing our contract with you |
| Support | Support reports, account and vehicle details | Performing our contract with you, and our legitimate interest in fixing faults |
| Preventing misuse and licence sharing | Account details, VIN, flash records | Our legitimate interest in protecting our software |
| Keeping the app reliable | Performance and update data, server logs | Our legitimate interest in running a working service |
| Tax and accounting records | Order and payment records | Legal obligation |
| Service emails, such as password resets and account approval | Name, email address | Performing our contract with you |
We do not sell your data, use it for advertising, or make automated decisions about you that have a legal or similarly significant effect.
5. Who we share it with
We use the following companies to run the service. They act as our processors, handling data on our instructions.
| Company | What they do | Data involved |
|---|---|---|
| DigitalOcean | Hosts our server and database in London, United Kingdom, managed through Laravel Forge | Everything described in this policy |
| Stripe | Takes payment for licences bought from us | Name, email, billing and card details, order details |
| Expo (EAS) | Delivers over-the-air app updates (expo-updates) and collects screen performance metrics (expo-observe) | App version, device and operating system details, performance measurements, IP address |
| Resend | Sends our service emails | Name, email address, email content |
| Laravel Nightwatch | Monitors our server for errors and performance problems | Technical request data, which can include your account identifier and IP address |
We also share data in these situations:
- Your dealer. If your account is linked to a dealer, that dealer can see your name, email address and licences so they can support you.
- Apple and Google. You download the app from their stores, and they handle that under their own privacy policies.
- Legal reasons. We will disclose data if the law requires it, or to establish or defend a legal claim.
This website loads its fonts from Google Fonts, which means your browser sends your IP address to Google when you view it.
6. Transfers outside the UK
Our own server and database are in the United Kingdom. Some of the companies above are based in the United States or process data there. Where personal data leaves the UK we rely on a safeguard recognised by UK law, such as UK adequacy regulations (including the UK-US data bridge) or the International Data Transfer Agreement or Addendum.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account details | While your account is open. Erased within 30 days of a deletion request. |
| Applications we decline | Up to 90 days after the decision, then deleted. |
| Licence and flash records | For the life of the licence. They stay attached to the VIN, not to you, after your account is deleted. |
| Support reports | 12 months from the date sent, or sooner if your account is deleted. |
| Order and payment records | 6 years after the end of the financial year of the purchase, as tax law requires. |
| Server and monitoring logs | Up to 90 days. |
| Backups | Deleted data can remain in backups for up to 30 days before it is overwritten. |
8. Deleting your account
You can delete your account at any time:
- in the app, from your account screen, by choosing Delete Account; or
- by emailing info@roadrageperformance.co.uk from the address on your account.
When an account is deleted:
- your name, email address, password and sign-in tokens are erased within 30 days, and your support reports are deleted;
- licences already assigned to a vehicle stay with that vehicle. The licence record is kept against the VIN with no active account attached, so the vehicle remains licensed and the installed tune keeps working. Whoever owns the vehicle can claim the licence into their own account from the app, including you if you register again; until someone does, nobody can manage it from the app. The claim does not tell the new owner who held the licence before;
- licences that have not been assigned are lost. If one is still within its refund period, ask for the refund before you delete the account;
- order and payment records are kept for the 6 years the law requires, then deleted.
Deletion cannot be undone. Removing the app from your phone does not delete your account.
9. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, as described above;
- ask us to restrict how we use your data;
- object to processing that we carry out on the basis of legitimate interests;
- receive the data you gave us in a portable format.
To use any of these rights, email info@roadrageperformance.co.uk. We will reply within one month and there is normally no charge. We may ask you to confirm your identity first.
If you are unhappy with how we have handled your data, please tell us so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
10. Security
Data travels between the app and our server over an encrypted connection. Passwords are hashed, sign-in tokens are held in your phone's secure storage, and access to customer data is limited to the staff who need it for support and administration. No system is perfectly secure, so please use a password you do not use anywhere else.
11. Children
The app is for people aged 18 and over. We do not knowingly collect data from children.
12. Changes to this policy
We may update this policy as the app changes. The date at the top shows when it was last revised, and we will tell you in the app or by email about any significant change.