1. Introduction

This Privacy Policy explains how 1769 Performance Oy ("we", "our", "us") collects, uses, and protects your personal data when you use our ECU programming and chiptuning platform, including our websites at 1769.fi and flash.1769.fi, the dashboard, and the 1769Flash mobile application (collectively, the "Service").

1769 Performance Oy is the data controller responsible for your personal data. If you have questions about this policy or how we handle your data, contact us using the details in the Contact section below.

2. Information We Collect

• Account information: your email address, username, name, account type, and a securely hashed password. For tuner accounts we also collect business details such as company name, address, country, VAT number, and phone number.
• Vehicle and ECU information: vehicle identification numbers (VIN), control-unit identifiers and software versions, serial numbers, immobilizer data, and records of the calibration or flashing operations you perform.
• Device information (mobile app): a per-installation device identifier, the device platform and app version, and a per-device security certificate. We use these to secure your account and to let you see and manage the devices signed in to your account.
• Payment information: payments are processed by Stripe. We receive transaction records such as amount, status, and payment identifiers, but we never receive or store your full card number.
• Files and content: ECU files, calibrations, and project data that you upload or that a tuner provides for your vehicle.
• Communications: messages exchanged between tuners and customers within the Service.
• Technical and usage data: IP address, access timestamps, and server log data. If you enable notifications, we also store a push-notification token.
• Connection history: for each address your account signs in from, we keep the IP address, the approximate country and city it corresponds to, the network operator it belongs to, which of our applications was used, and when it was first and last seen. Location is estimated from the IP address; it is not precise and we do not collect GPS or device location data. You can see this history for your own account at any time by exporting your data (see Your Rights below).

3. How We Use Your Information

We use your personal data to:

• Provide, operate, and maintain the Service
• Manage your account, licenses, and vehicles
• Perform the vehicle and ECU operations that you request
• Process payments and provide proof of purchase
• Secure your account and manage the devices signed in to it
• Detect accounts being shared between different people, and prevent fraudulent or unauthorized use of licenses. Our Terms of Service require an account to be used by one person; the connection history described above is how we identify accounts that are not.
• Communicate with you about the Service and support
• Comply with our legal and regulatory obligations

We do not use your personal data for advertising, and we do not sell it to third parties.

4. Legal Bases for Processing

Under the EU General Data Protection Regulation (GDPR), we process your personal data on the following legal bases: performance of our contract with you (to provide the Service); our legitimate interests (to secure, maintain, and improve the Service); compliance with legal obligations; and your consent (for example, for push notifications), which you may withdraw at any time.

We rely on our legitimate interests to keep the connection history described in section 2 and to use it to detect shared accounts and prevent fraudulent use of licenses. We have weighed that interest against your privacy: the data is limited to what an account's own connections reveal, the location is approximate rather than precise, it is not used to profile you or to make any automated decision about you, and it is deleted on the schedule in section 7. You may object to this processing using the contact details below.

5. How We Share Your Information

We share personal data only as needed to provide the Service:

• Service providers (processors) acting on our behalf: Stripe (payment processing), Google Drive and Amazon S3 (file storage), our email delivery provider (transactional email), Vercel (website hosting and privacy-friendly, cookieless analytics), PostHog (product analytics, EU-hosted), Sentry (error monitoring), Apple (APNs) and Google (Firebase Cloud Messaging) to deliver push notifications to your device, Telegram (internal operational alerts — see below), and the infrastructure providers that host the Service, including our application hosting, database, and cache providers.
• Internal operational alerts: to react quickly to sign-ups, payments and security events, some alerts are delivered to a private team channel on Telegram. These can include the name and e-mail address of a tuner applying for an account. No customer vehicle data or file content is sent this way.
• Between tuners and customers: if you are a customer linked to a tuner, or a tuner serving a customer, the relevant account and vehicle data is shared between those parties as needed to deliver the Service.
• Legal requirements: where required to comply with applicable law, regulation, or a valid legal request.

We do not sell your personal data and we do not share it for advertising purposes.

6. International Transfers

Some of our service providers are located outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission, to protect your data.

In particular: our primary database is hosted in the EU (Stockholm), and a read-only replica is hosted in the United States so that customers outside Europe get a responsive service. That replica contains the same account, vehicle and purchase records as the primary. Push notifications are delivered through Apple and Google, and error diagnostics are processed by Sentry, both in the United States.

7. Data Retention

We retain your personal data for as long as your account is active and as needed to provide the Service. Indicative retention periods:

• Account and vehicle data: for the life of your account; deleted or anonymized after account deletion, except where a longer period is required below.
• Payment and accounting records: retained for 6 years as required by the Finnish Accounting Act (Kirjanpitolaki).
• Server request logs: retained for a limited period (typically up to 90 days) for security and troubleshooting.
• Connection history: retained for 90 days from the last time an address was seen, then automatically deleted.
• Error and diagnostics data (Sentry): retained for up to 90 days.
• Analytics data: aggregate, non-identifying metrics may be retained without a fixed limit.

When data is no longer needed for these purposes, we delete or anonymize it.

8. Your Rights

Subject to applicable law, you have the right to access, correct, and erase your personal data; to restrict or object to certain processing; to data portability; and to withdraw consent where processing is based on consent. To exercise these rights, contact us using the details below. You also have the right to lodge a complaint with your local supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

9. Deleting Your Account

You can delete your account at any time from the mobile app (Settings, then Delete account) or on the web (Profile). When you delete your account, we deactivate it and remove or anonymize personal identifiers such as your email address so that the account can no longer be accessed or signed in to. Certain records may be retained where required for legal, accounting, or security purposes.

10. Data Security

We protect personal data in transit using encryption (HTTPS/TLS), use per-device certificates for the mobile app, and apply access controls to limit who can access your data. No method of transmission or storage is completely secure, but we work to protect your data using appropriate technical and organizational measures.

11. Privacy of Children

The Service is intended for professional and adult users and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

12. Cookies, Analytics, and Error Monitoring

On our websites we use a strictly necessary session cookie to keep you signed in, and we store your cookie choice locally so we do not ask on every visit. These do not require consent.

With your consent, we also use analytics (Vercel Analytics and Speed Insights, which are cookieless, and PostHog, which sets cookies and is hosted in the EU) and browser-based error diagnostics (Sentry) to understand usage and fix problems. These do not run until you accept them, and you can change your choice at any time via "Manage cookie preferences" on our Cookie Policy page. We also run server-side error monitoring on the basis of our legitimate interest in keeping the Service secure and reliable; this processes limited technical data and never the contents of your requests.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date above. Your continued use of the Service after changes take effect constitutes your acknowledgment of the updated policy.

14. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please contact us: