Privacy policy.

1. Public website contact form

The contact form on the public website is processed in your browser and opens a formatted WhatsApp message. The public website itself does not save that form content to the tuning portal database.

2. Tuning portal account and job data

When you use the secure tuning portal, HEAVYTUNING stores the information required to operate your account and complete the requested service. This may include your name, email, company, country, contact details, login and security events, vehicle or equipment identification, VIN/PIN/chassis/serial data, engine and ECU details, fault codes, messages, original and tuned files, token-wallet entries, payment references and download history.

3. ECU-file protection

Permanent portal storage uses random server-side filenames and authenticated XChaCha20-Poly1305 encryption for uploaded ECU files. The portal records integrity fingerprints and decrypts a file only through an authorized download route. A temporary upload copy can exist in the hosting provider's PHP upload area while the request is being received and encrypted. Customers are responsible for protecting any copies downloaded to their own devices.

4. VIN lookup

When a signed-in portal customer deliberately selects Decode VIN, the 17-character road-vehicle VIN is sent to the official NHTSA vPIC service to obtain available identification fields. Manual entry remains available. Machinery PIN, chassis and serial values are not sent to that VIN service.

5. Payments and third-party services

When enabled, Stripe and PayPal process checkout credentials under their own terms. HEAVYTUNING stores transaction references, amounts, currency, status and token-package information, but the portal is not designed to store full card numbers or card security codes. WhatsApp, Telegram, email, hosting and other configured providers process the data needed for their role under their own policies.

6. Technical and security data

The hosting provider and portal may process standard logs such as IP address, browser information, requested route, timestamps, login attempts, administrator actions, payment callbacks and download events for security, reliability, fraud prevention and auditing.

7. Retention

Account, business, technical, payment and security records may be retained for service delivery, re-downloads, warranty, support, accounting, dispute handling, security and legal obligations. Production launch should include a written retention schedule and a tested deletion process appropriate to the jurisdictions served.

8. Your choices

You may request correction, account closure or deletion of information held directly by HEAVYTUNING, subject to legal, accounting, security, fraud-prevention and active-service requirements, through the channels on the contact page.

9. Changes

This policy may be updated when the website, portal, providers, services or applicable requirements change.