Skip to content
Last updated

Privacy policy

What MFS Connect collects, why it needs it, and how to get rid of it. Written to be read, not to be survived.

In short
  • We collect what we need to identify your car and flash it safely — not a copy of the software on it.
  • We do not sell your data, run advertising, or profile your driving for anyone else.
  • Going back to standard uses the manufacturer's own original software, matched to your car, so we never need to hold a copy of yours.
  • You can get a copy of your data, correct it, or have it deleted. Email info@mobileflashsolutions.com.

Who we are

MFS Connect is built and operated by Mobile Flash Solutions Ltd, a company registered in England and Wales with company number 15604123, at 5d Folgate Road, North Walsham, England, NR28 0AJ. In this policy "we", "us" and "our" mean that company.

We are the data controller for the personal data described here, which means we decide what is collected and why.

For anything on this page, email info@mobileflashsolutions.com or write to us at the address above. We have not appointed a Data Protection Officer, as we are not required to; privacy questions go to the address above and are handled by a director.

What this policy covers

This policy covers the mfsconnect.com website, the MFS Connect mobile app, and the MFS OBD adapter when it is paired with the app. It also covers the launch waitlist and the dealer enquiry form on this site. It does not cover other MFS products with their own sites and policies, or third-party sites we link to.

What we collect, why, and how long we keep it

We collect the minimum needed to run the service and to keep a record you can fall back on. Each entry below states the lawful basis we rely on under the UK GDPR and how long the data is retained.

Waitlist signups
Your email address, plus the referring page and any campaign tags in the link you arrived through, and the IP address and browser the form was submitted from. The campaign tags tell us which posts actually reach owners; the IP and browser exist only so we can deal with automated abuse of the form.
Lawful basis · Consent Kept · Until launch, or until you unsubscribe
Confirming that address
Submitting the form only sends you one email asking you to confirm the address. Nothing else is sent until you click that link, so nobody can put you on our list without access to your inbox. If you never confirm, the record is deleted and you hear nothing further.
Lawful basis · Consent Kept · Unconfirmed signups deleted after 30 days
Email delivery records
For each email we send you, whether it was accepted, delivered, delayed or rejected, and the reason the receiving mail server gave. Our email provider reports this back to us and we keep it so we can tell a mistyped address apart from a mailbox that is blocking us, and notice if our email stops arriving at all. We do not record whether you opened an email or clicked a link in one. These records are deleted with your signup if you never confirm it.
Lawful basis · Our legitimate interests Kept · 6 months
Addresses we have stopped mailing
If email to you permanently fails, or you report one of our emails as spam, we add your address to a list of addresses we do not send to. The entry is your address, which of those two things happened, and when. Keeping it is the only way to be certain we honour the decision, so it survives the deletion of everything else we hold about you — see Your rights. Email us and we will tell you whether your address is on it.
Lawful basis · Our legal obligations, and our legitimate interests Kept · Kept indefinitely
Dealer enquiries
Company name, country and email address, plus the IP address and browser the form was submitted from. We use these to assess and reply to a dealer application, and to keep a record of who we have spoken to.
Lawful basis · Steps prior to a contract Kept · 24 months from our last contact
Account details
Your email address and a hashed password. We never store your password in a readable form and cannot recover it for you, only reset it.
Lawful basis · Contract Kept · While your account is open
Vehicle and ECU data
VIN, engine code, ECU part number, and the identifiers and version of the software already on your ECU. The VIN identifies which car a licence belongs to. We record those identifiers rather than copying the software itself — returning your car to standard writes the manufacturer's own original file for that identifier, which comes from our library and is not personal data about you.
Lawful basis · Contract Kept · While your account is open
Flash records
What was written to your ECU, when, from which app and adapter version, and whether it completed. We need this to support you if a flash goes wrong, and to answer a warranty or liability question years after the fact.
Lawful basis · Contract, and our legitimate interests Kept · 6 years
Logging sessions
Sensor data from a drive you chose to record, and any log you upload to us for support. Logs are recorded only when you start them. You can delete a log from the app.
Lawful basis · Contract Kept · While your account is open, or until you delete the log
Purchases and licences
Which licences are attached to which vehicle, the amount paid, and a receipt. Card details are handled entirely by our payment provider and never reach our systems. UK tax law requires us to keep transaction records for six years.
Lawful basis · Contract, and our legal obligations Kept · 6 years from the end of the tax year
App diagnostics
Crash reports, device model and operating system version, app version, and adapter firmware version. We use these to fix faults. They are not used to profile you and are not linked to marketing.
Lawful basis · Our legitimate interests Kept · 12 months
Support correspondence
Emails and in-app messages you send us, and our replies. Kept so the next person who helps you can see what has already been tried.
Lawful basis · Our legitimate interests Kept · 3 years from the last message

Our legitimate interests

Where we rely on legitimate interests, the interest is running a safe, working, financially sound product: fixing faults before they reach other people's cars, keeping evidence of what was written to an ECU, preventing fraud and abuse of our forms, and answering support properly. We have weighed each of these against your rights and use the least data that does the job. You can object to any of it — see Your rights.

Marketing

If you join the launch waitlist, we will send you one email when MFS Connect goes live, and nothing else. That is what you signed up for and we will not quietly widen it into a newsletter. If you report one of our emails as spam we take that as you telling us to stop, and the launch email will not be sent to you.

If you become a customer, we may email you about products similar to the ones you bought, as UK marketing rules allow. Every such email carries an unsubscribe link, and you can opt out at any time without affecting your account or your licences. We do not share your address with other companies for their marketing.

Who else sees your data

We do not sell your data. We share it only with the suppliers we need to run the service. Each processes it on our written instructions, for no other purpose, and is named here.

DigitalOcean
Cloud hosting and storage — the server this site and your account and vehicle records live on.
Data stored in London, United Kingdom. DigitalOcean is incorporated in the United States. UK Addendum to the EU standard contractual clauses, under their data processing agreement.
Laravel Forge
Provisions, configures and deploys to the server above. It holds administrative access, but does not process your data as part of its normal operation.
United States. UK Addendum to the EU standard contractual clauses.
Resend
Sends our email — waitlist confirmations, the launch announcement, and account and support mail. Receives the recipient address and the message itself.
United States. UK Addendum to the EU standard contractual clauses, under their data processing agreement.

We do not yet take payments or collect crash reports. When the store opens we will add a payment processor, and when the app ships we will add a crash-reporting service. Both will be named on this page before they start processing anything.

Where a tune you buy was produced by a third-party tuning company, that company is told which of their tunes has been licensed and to which VIN, so they can support their own file. They are not given your email address, your account details or your logs unless you ask us to put you in touch.

We will also disclose data where the law requires it, to establish or defend a legal claim, or to protect someone's safety. If our business is sold or merged, data may transfer to the buyer under the same terms; we would tell you before that happened.

Where your data is held

Your account and vehicle records are stored on a server in London, United Kingdom.

The suppliers running that server and our email are all incorporated in the United States, so although the data itself sits where it says above, those companies can in principle be reached by US law. For each of them we rely on the UK Addendum to the EU standard contractual clauses under their data processing agreement, together with a check that the transfer is genuinely protected in practice.

Email us if you would like a copy of the safeguard we rely on for a particular supplier.

How we protect it

Data is encrypted in transit and at rest. Passwords are stored only as salted hashes. Access to production systems is limited to the people who need it, protected by multi-factor authentication, and logged.

Tune files supplied by dealers are encrypted on the dealer's own machine before upload. We hold the file and not the key, which means we cannot read a dealer's tune, and neither can anyone who obtains a copy of our storage.

Your rights

Under UK data protection law you have the right to:

  • ask whether we hold data about you, and get a copy of it;
  • have inaccurate data corrected;
  • have data deleted, where we no longer need it and no legal obligation requires us to keep it;
  • restrict how we use your data while a dispute about it is resolved;
  • object to processing we base on legitimate interests, including any direct marketing, which we will stop on request;
  • receive the data you gave us in a portable, machine-readable format, or have it sent to another provider; and
  • withdraw consent at any time, where consent is what we relied on. Withdrawing it does not undo what we did beforehand.

One exception is worth naming. If your address is on our do-not-send list — because email to you permanently failed, or you reported one of our emails as spam — we keep that one entry even when we delete everything else. Removing it would mean we no longer knew to stop, and the next thing we sent would reach you again. It is used for nothing except not contacting you.

Email info@mobileflashsolutions.com to use any of these. We will respond within one month. If a request is unusually complex we may extend that by up to two further months and will tell you why. There is no charge unless a request is manifestly unfounded or excessive.

If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk, by phone on 0303 123 1113, or in writing to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would rather you came to us first, because most things are quicker to fix that way.

Deleting your account

Flash your car back to stock first if you want it on standard software. After deletion we no longer hold the identifiers that tell us which original file matches your car, so putting it back means setting the vehicle up again.

You can delete your account from Settings in MFS Connect, or by emailing info@mobileflashsolutions.com. Deletion removes your account, vehicle records and logs within 30 days, and from our encrypted backups within a further 90 days.

Purchase and flash records are kept for the periods set out above, because tax law and our own liability position require it. Those records are reduced to what is necessary and are not used for anything else.

Automated decisions

We do not make decisions about you by automated means that produce legal or similarly significant effects. Compatibility checks in the app — whether your ECU is supported, whether a licence covers your VIN — are technical rules, not assessments of you.

Children

MFS Connect is for licensed drivers and vehicle owners. It is not intended for anyone under 18 and we do not knowingly collect their data. If you believe a child has given us personal data, email us and we will delete it.

Cookies

This site sets two strictly necessary cookies and runs no analytics or advertising. The cookie policy names them and explains what they do.

Changes to this policy

If we change how we handle your data we will update this page and change the date at the top. For anything significant — a new purpose, a new category of recipient, a shorter route to deletion — we will email account holders before it takes effect.