Privacy Policy
1Who we are
MotoEditor, a société par actions simplifiée (SAS) incorporated in France, is the data controller for personal data collected through motoeditor.com, its subdomains, and APIs.
2Scope
This policy covers the data we process when you create an account, subscribe, upload firmware (BIN) files, use the editor, contact support, or browse the website.
3What data we collect
| Category | Examples | Source | Required? |
|---|---|---|---|
| Account & identity | Name, username, email address, password (stored only as a salted hash) | You | Yes (contract) |
| Billing | PayPal payer email, PayPal subscription / transaction IDs, amount and plan. We never see or store your card details — PayPal handles those. | You / PayPal | Yes (legal & contract) |
| Device & usage | IP address, browser user-agent, and an activity log of key actions (sign-ins, project/edit/export events) | Automatic | Yes (legitimate interest) |
| Uploaded content | ECU firmware (BIN) files and comparison files you upload, plus your project names and map notes | You | Optional |
| Support | Ticket subjects, messages, and any files you attach | You | Optional |
We do not knowingly collect data on children under 16, and we do not perform advertising-style profiling or browser fingerprinting.
4Why we process your data & legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating your account and providing access to the editor and definitions | Contract — Art. 6(1)(b) |
| Processing payments and meeting French accounting obligations | Legal obligation — Art. 6(1)(c) |
| Fraud prevention, security, and activity/audit logs | Legitimate interests — Art. 6(1)(f) |
| Optional AI auto-tune suggestions (only when you use the feature) | Contract / your request — Art. 6(1)(b) |
| Export-control and motorsport-regulation compliance | Legal obligation — Art. 6(1)(c) |
5Cookies
We use a single strictly-necessary session cookie (moto_sid) to keep you signed in and to protect forms against cross-site request forgery. We do not use analytics, advertising, or third-party tracking cookies, so no cookie-consent banner is required. Clearing the cookie signs you out.
6Automated processing
When you open a definition, we automatically decode its calibration maps so you can edit them. If you choose to use AI auto-tune, the values of the selected map (and your instruction) are sent to our AI provider to generate a suggestion. This is not automated decision-making with legal or similarly significant effects under GDPR Art. 22: no change is applied to your firmware until you review and accept it.
7Who receives your data
| Recipient | Purpose | Safeguards |
|---|---|---|
| Hostinger | Web & database hosting and file storage | EU-based provider (Lithuania); GDPR data-processing agreement; EU data-centre region |
| PayPal | Payment processing | PCI-DSS; EU Standard Contractual Clauses where applicable |
| Mailjet | Transactional email (password resets, receipts, support replies) | EU data centre (France); GDPR data-processing agreement |
| OpenAI | Generating AI auto-tune suggestions — only when you use that feature | US-based; Standard Contractual Clauses; sent data is limited to map values and your instruction |
| Cloudflare | Bot & abuse protection on the sign-in, registration and password-reset forms (Turnstile) | US-based with an EU edge network; Standard Contractual Clauses; processes your IP address and browser signals only to tell humans from bots — no advertising cookies, no cross-site tracking |
| Professional advisers | Accounting, legal | Confidentiality obligations |
| Public authorities | Tax, anti-fraud, valid court orders | Legal obligation |
MotoEditor never sells or rents your personal data.
To protect accounts from automated attacks, our sign-in, registration and password-reset pages use Cloudflare Turnstile, a privacy-preserving bot check. When you submit one of these forms, Turnstile receives your IP address and non-identifying signals about your browser and interaction so it can confirm you are a real person rather than a bot. Turnstile does not use tracking cookies, does not build advertising profiles, and Cloudflare does not use this data to track you across other websites. The check runs only on those authentication forms.
8International transfers
Where a recipient is outside the European Economic Area (for example, our AI provider), transfers rely on an adequacy decision or on Standard Contractual Clauses together with appropriate supplementary measures.
9Retention periods
| Data set | Retention rule |
|---|---|
| Account data | For the life of the account, then up to 5 years (French Civil Code prescription) |
| Financial records | 10 years (Art. L123-22 French Commercial Code) |
| Support tickets | Deleted with your account; otherwise retained while relevant to your support history |
| Uploaded firmware & projects | Until you delete them, or account closure — deleted with the account |
| Activity / security logs | Up to 365 days, then automatically pruned (aligned with CNIL guidance) |
10Security
Data is transmitted over encrypted connections (TLS). Passwords are stored only as salted, one-way hashes — never in plain text. Access to systems is granted on a least-privilege basis, and uploaded firmware is stored outside the public web root and served only through access-controlled endpoints.
11Your rights
Under the GDPR you may: (1) access your personal data; (2) correct inaccurate data; (3) erase your data (“right to be forgotten”); (4) restrict processing; (5) object to processing based on legitimate interests or to direct marketing; (6) port your data to another provider; and (7) withdraw consent at any time (without retroactive effect).
You can update your details or delete your account (which cancels your subscription and removes your login and saved work) directly from your dashboard. For any other request, email [email protected]; we respond within one month. You also have the right to lodge a complaint with the French data-protection authority (CNIL).
12Data breach notification
If we become aware of a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the CNIL within 72 hours and affected users without undue delay.
13Links to third-party sites
MotoEditor is not responsible for the privacy practices of external websites or tools you may use alongside the Service (including the flashing hardware and software you use to write firmware to your ECU).
14Changes to this policy
We may update this policy to reflect regulatory changes or new processing activities. Material changes take effect thirty (30) days after we post them or notify you by email or in-app notice. Continued use of the Service after that date constitutes acceptance.
15Contact
MotoEditor — Data Protection
Email: [email protected]