Privacy policy — ecufile.net

Version: 2026-09-03

This page explains which personal data we collect when you use ecufile.net, what we use it for, who we share it with, how long we keep it and what rights you have over it. It is written to be understood; if anything is unclear, write to us.

1. Who is responsible

The data controller is ecufile.net (part of ecudiag.es), Calle Capileira 74, 18210 Peligros, Granada, Spain. For anything related to your data, write to info@ecufile.net.

2. Which data we process and where it comes from

Your account. Username, e-mail address and password. The password is stored irreversibly hashed: nobody at ecufile.net can see it. If you sign in with Google or Microsoft, we receive from that provider your name, your e-mail (already verified by them) and a technical identifier of your account; we do not receive your password and we do not access your mailbox, contacts or files.

Your orders. First and last name, e-mail, address, city, province, postal code and country; the products purchased, the amount, the date, the order reference and the date and version of the terms you accepted.

The files you upload. For the procedures and for DTC-off you send us the original file of your ECU. An ECU dump may contain the vehicle identification number (VIN) or other vehicle identifiers, so we treat it with the same safeguards as the rest of your data.

Payment. It is handled by PayPal or Redsys on their own pages. We only receive the payment confirmation, the transaction identifier and the amount. We never see or store your card number.

Technical data. IP address, browser, pages visited and date and time of each access. They are kept in the server logs, in the protection against fraudulent login attempts (temporary lock after several failed sign-in attempts) and in the error and analytics tools described below.

What you write to us. The e-mails you send us and the replies we give you.

3. What we use the data for and on which legal basis

• Managing your account and your orders: creating the account, processing the file you upload, delivering the result, letting you download it again and handling support. Legal basis: performance of the contract (art. 6.1.b GDPR).
• Sending you service e-mails: account confirmation, order confirmation and delivery, password reset and security notices (for example, when a Google or Microsoft account is linked to yours). Legal basis: performance of the contract. We do not send newsletters or advertising.
• Invoicing and tax and accounting obligations. Legal basis: legal obligation (art. 6.1.c).
• Website security and prevention of fraud and abuse: technical logs, blocking of login attempts, error detection. Legal basis: legitimate interest (art. 6.1.f) in keeping the service available and secure.
• Usage statistics through analytics cookies. Legal basis: your consent, which you can withdraw at any time (see section 9).

We do not use your data for profiling, nor do we take automated decisions that produce legal effects on you. The automatic processing of the file you upload is the service you have purchased, not an assessment of you as a person.

4. Who we share the data with

We do not sell or hand over your data to anyone for their own purposes. The following providers do process it, on our behalf or to complete the service:

• Hosting: Hetzner Online GmbH (Germany). The website, the database and the files are stored on their servers, in the European Union.
• E-mail: Microsoft 365, to send you the service e-mails.
• Payment: PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) and Redsys Servicios de Procesamiento, S.L. (Spain), depending on the method you choose. Each of them processes your payment data under its own privacy policy.
• Sign-in with Google or Microsoft: only if you choose that option. The provider knows that you have signed in to ecufile.net and gives us the data listed in section 2.
• Google reCAPTCHA: on the sign-up and sign-in forms, to stop bots. Google receives the IP address and browser data.
• Google Analytics: website usage statistics (see section 9).
• Sentry (Functional Software, Inc., United States): receives technical reports when the website produces an error, which may include the IP address, the browser and the page where it happened.
• Fault code analysis (DTC-off): the ECU file you upload for that service is analysed with the external tool dunt.app. Only the file is sent to it, never your account or order data.
• Public authorities, when a law requires us to do so.

5. Transfers outside the European Union

The servers are in the European Union. Google, Microsoft and PayPal provide their services to us through their European entities. When a provider is outside the EU (such as Sentry), the transfer relies on the safeguards provided by the GDPR: standard contractual clauses approved by the European Commission or certification under the EU-U.S. Data Privacy Framework.

6. How long we keep the data

• Account: for as long as you keep it. If you ask us to delete it, we remove it together with its data, except what we must keep by legal obligation.
• Orders and invoicing: the period required by commercial and tax law (in general, 6 years from the order).
• Uploaded and generated files: kept together with your order so that you can download them again and so that we can handle incidents. You can ask us to delete them at any time.
• Technical server logs: 14 days.
• Lock after failed sign-in attempts: a few minutes; it expires on its own.
• Error reports (Sentry): 90 days.

7. Your rights

At any time you can ask us to access your data, rectify it, erase it, restrict its processing, object to it or receive it in a portable format. You can also withdraw any consent you have given, without affecting the processing carried out before. To exercise them, write to info@ecufile.net from your account e-mail (or telling us how we can check that it is you) and say which right you want to exercise. We reply within one month.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security

The whole website runs over HTTPS. Passwords are stored with an irreversible hashing algorithm, access to the servers is restricted and regular backups are made. No system is infallible: if we detected a breach affecting your data, we would notify you as required by the GDPR.

9. Cookies

A cookie is a small file that the browser stores when you visit a website. We use these:

• Necessary (the website does not work without them): sessionid keeps you signed in and keeps your cart; csrftoken protects forms against request forgery; django_language remembers the language you chose.
• Analytics (Google Analytics: _ga and _ga_*): they tell us how many visits each page gets and where from, in aggregate. They are not needed to use the website.
• Third party: on the payment page PayPal may set its own cookies, and on the forms with reCAPTCHA Google does (_GRECAPTCHA), for security purposes.

You can delete or block cookies from your browser settings, and opt out of Google Analytics with the Google opt-out add-on. If you block the necessary ones, you will not be able to sign in or buy.

10. Minors

ecufile.net is aimed at professionals and technically skilled users. It is not intended for children under 14 and we do not knowingly collect data from minors.

11. Changes to this policy

If we change this policy, we will publish the new version here with its date. If the change matters to you (for example, a new use of your data), we will also let you know by e-mail.