Privacy policy.

1. Public website contact form

The contact form on the public website is processed in your browser and opens a formatted WhatsApp message. The public website itself does not save that form content to the tuning portal database.

2. Tuning portal account and job data

When you use the secure tuning portal, HEAVYTUNING stores the information required to operate your account and complete the requested service. This may include your name, email, company, country, contact details, login and security events, vehicle or equipment identification, VIN/PIN/chassis/serial data, engine and ECU details, fault codes, messages, original and tuned files, token-wallet entries, payment references and download history.

3. ECU-file protection

Permanent portal storage uses random server-side filenames and authenticated XChaCha20-Poly1305 encryption for uploaded ECU files. The portal records integrity fingerprints and decrypts a file only through an authorized download route. A temporary upload copy can exist in the hosting provider's PHP upload area while the request is being received and encrypted. Customers are responsible for protecting any copies downloaded to their own devices.

4. VIN lookup

When a signed-in portal customer deliberately selects Decode VIN, the 17-character road-vehicle VIN is sent to the official NHTSA vPIC service to obtain available identification fields. Manual entry remains available. Machinery PIN, chassis and serial values are not sent to that VIN service.

5. Payments and third-party services

When enabled, Stripe and PayPal process checkout credentials under their own terms. HEAVYTUNING stores payment and order references plus verified provider callback records used to confirm and secure a payment. Those records can include provider-supplied payer, customer or billing metadata, but the portal is not designed to store full card numbers or card security codes. Outbound messages, including time-limited account-security links, can be held in the private email queue until delivery and housekeeping. WhatsApp, Telegram, email, hosting and other configured providers process the data needed for their role under their own policies. The public website loads Google Fonts, so Google can receive standard network metadata such as the requesting IP address and browser information.

6. Technical and security data

The hosting provider and portal may process standard logs such as IP address, browser information, requested route, timestamps, login attempts, administrator actions, payment callbacks and download events for security, reliability, fraud prevention and auditing.

7. Retention

Account, business, technical, payment and security records are retained only as long as reasonably needed for service delivery, authorized re-downloads, support, accounting, dispute handling, security and legal obligations. Retention can vary by record type and applicable law. Eligible deletion requests can be made through the contact page.

8. Your choices

You may request correction, account closure or deletion of information held directly by HEAVYTUNING, subject to legal, accounting, security, fraud-prevention and active-service requirements, through the channels on the contact page.

9. Changes

This policy may be updated when the website, portal, providers, services or applicable requirements change.