VQLab
Legal

Privacy Policy

Effective 21 October 2026. How VQLab collects, uses and protects your personal information.

1. Who we are

VQLab is made by VQLab (sole trader), based in New Zealand. We are responsible for your personal information under the New Zealand Privacy Act 2020. Contact us about privacy at waimatew@gmail.com.

2. What we collect and why

WhereWhatWhy
Launch updates listYour email address.To tell you when VQLab launches and about major releases.
Vehicle requestsName, email, car make, model and year, and optionally your ECU software ID, country and notes.To decide which cars to support next and tell you when yours is added.
Your accountName, email, optional country, and when you signed up. Your password is handled by Google Firebase Authentication; we never see it.To log you in and show you your licences.
Pro licences (website and app)The email the licence was bought with; for each activated PC, the name you gave it, a one-way hashed PC identifier, and when it was activated and last checked in; for each car, the ECU software ID, its slot, a one-way hash of its VIN (where the ECU reports one), and the date, type and result (succeeded, failed or cancelled) of each flash.To enforce the PC and car limits, recognise a car you have already flashed, decide refunds, let you manage your licence, and keep it working offline.
PaymentsName, email, country and what you bought. Card details go straight to Stripe; we never receive them.To sell you a licence, send receipts, handle refunds and keep tax records.
Refund requestsYour reason and message, and the licence and order they relate to.To decide and process your refund.
ROM submissions (optional)Only if you choose to send one from the app: the ROM image, its ECU software ID, the app version, why it could not be read, and optionally your contact details and notes.To add support for your ECU. We never share or publish submitted ROMs.
Server logsIP address, time and the request made, kept by our hosting provider.To keep the service secure and fix problems.

What we don't collect. The VQLab app does not send us your maps, tunes, drive logs or location, and never sends your VIN in readable form (only a one-way hash, tied to your licence). ROM files stay on your PC unless you choose to submit one.

Claude features. VQLab's AI features connect to Claude through your own Claude account. Anything you share with Claude goes to Anthropic under Anthropic's terms and privacy policy, not to us.

3. Who we share it with

We never sell your personal information or use it for advertising. We only share it with services that run VQLab for us:

  • Google (Firebase and Google Cloud): website hosting, accounts, our database and server code.
  • Stripe: to take payment, send receipts and process refunds.
  • Resend: to send licence, receipt, refund and launch emails.
  • Cloudflare: our domain's DNS, and forwarding emails you send us to our inbox.

We may also disclose information if the law requires it, or to protect our legal rights.

4. Where it's stored

Our database and servers run in Google Cloud's Sydney, Australia region. Some services, such as Firebase Authentication and email delivery, may process data in other countries, including the United States. Where we use providers like this, we choose ones that protect personal information to standards comparable to New Zealand's.

5. How long we keep it

  • Launch updates list: until you unsubscribe, or a year after launch.
  • Vehicle requests: until your car is supported, or two years.
  • Accounts: until you ask us to delete your account.
  • Licence, purchase and refund records: for as long as the licence exists, then seven years to meet New Zealand tax record rules.
  • Submitted ROMs: until your ECU is supported, or two years.
  • Server logs: up to 30 days.

6. Keeping it safe

All traffic is encrypted (HTTPS). Our database can only be reached by our own server code. Licence keys are stored only as a one-way fingerprint, and PC identifiers are hashed before they leave your computer. Your licences are only shown on your account after you verify your email address.

7. Your rights

You can ask to see the personal information we hold about you, to correct it, or to delete it, by emailing waimatew@gmail.com. You can update your name and country yourself on your account. If you live in the EU or UK you also have rights under the GDPR, including to object, restrict processing and data portability.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the New Zealand Office of the Privacy Commissioner at privacy.org.nz.

8. Cookies and browser storage

We don't use advertising or analytics cookies. If you log in, Firebase stores your sign-in in your browser so you stay logged in. Our fonts are served from our own site, not from third parties.

9. Emails

We only send launch and product updates to people who asked for them, and every one includes a way to unsubscribe. Account, licence and receipt emails are sent when needed and can't be switched off while you have an account.

10. Children

VQLab isn't intended for anyone under 16, and we don't knowingly collect their information.

11. Changes

If we change this policy we'll update the date at the top, and tell account holders by email about significant changes.