Legal
Privacy notice
This notice explains what personal data this website and our mailing list collect, why, and what your rights are. It is written for readers in the European Economic Area, the United Kingdom, Switzerland, the United States and Canada. Where a law gives you more than is described here, the law wins.
Who is responsible
The controller is Olga Sedova, 15 Rue d’Eschweiler, L-6235 Beidweiler, Luxembourg. Email: hello@camberay.com. We have not appointed a data protection officer because the law does not require one at our size; the address above reaches the person responsible.
What we collect, and why
| Data | Purpose | Legal basis (EU/UK) | Kept for |
|---|---|---|---|
| Email address and the “what you'd use it for” choice you make on the notify form; for a reservation of a made kit, also the number of kits, the country and your note | Sending you the notices you asked for: when you can order, and first pick of the made kits | Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time | Until you unsubscribe, or 24 months after our last notice, whichever is first |
| Time of sign-up, IP address at sign-up, confirmation click | Proving that the consent was given (double opt-in) and stopping abuse of the form | Legal obligation to demonstrate consent (Art. 7(1)); legitimate interest in preventing abuse (Art. 6(1)(f)) | As long as the subscription, plus 3 years |
| Access logs of our server (the account pages, the app's service, the mailing-list forms): IP address, time, page requested, browser type | Keeping the site running and secure | Legitimate interest (Art. 6(1)(f)) | 14 days, then deleted or truncated |
| Your colour-theme choice | Remembering which theme you picked | Stored only in your own browser; never sent to us | Until you clear your browser storage |
| Email you send us | Answering you | Legitimate interest / pre-contractual steps (Art. 6(1)(b), (f)) | Until the matter is closed, then up to 12 months |
We do not use analytics cookies, advertising pixels, social-media embeds or remote fonts. Nothing on this site reports your visit to a third party. Cloudflare delivers the pages for us, as our processor: see Who else sees the data. See Cookies.
Who else sees the data
A visit to the pages of this website goes through Cloudflare, Inc. (USA), which delivers the pages for us. To deliver the pages and to protect them from attacks and abuse, Cloudflare processes your IP address and the data of each request (the page asked for, the time, the browser type). It does this as our processor, for the same purpose and on the same legal basis as the access logs above. The account pages, the mailing list and the app's data are on our server, which is in the EU (France).
Only processors acting on our instructions under a data-processing agreement see the data: Hostinger (the server with the accounts and the measurements, in France); Cloudflare, Inc. (delivers the website’s pages and answers for our domain names, USA); Brevo (Sendinblue SAS, France: sends our emails); Infomaniak Network SA (Switzerland: our mailbox); Lemon Squeezy (payments, merchant of record). Where a provider is outside the EEA/UK, transfers rest on the European Commission's Standard Contractual Clauses or an adequacy decision. We do not sell personal data and we do not share it for advertising.
Your rights
- Access, correction, deletion, restriction, portability, and objection to processing based on legitimate interest.
- Withdraw consent at any time — every message we send has a one-click unsubscribe link, and this page does the same. Withdrawing does not affect processing that already happened.
- Complain to a supervisory authority: the Commission nationale pour la protection des données (CNPD), Luxembourg, cnpd.public.lu, or the authority where you live or work. UK readers: the Information Commissioner's Office. Swiss readers: the FDPIC.
To exercise a right, email hello@camberay.com. We answer within one month. We may ask you to confirm you own the email address concerned; we will not ask for more than that.
United States residents (California and other state privacy laws)
In the past 12 months we collected the categories listed above: identifiers (email, IP address) and internet activity (server logs). We collected them from you directly and from your browser. We use them for the purposes listed above and disclose them only to the processors named above. We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not knowingly collect information from anyone under 16.
You have the right to know, delete, correct, and to non-discrimination for exercising those rights. To exercise them, email hello@camberay.com or use the contact page. We honour the Global Privacy Control browser signal as an opt-out where one applies. An authorised agent may act for you with your written permission.
Canada
We collect, use and disclose personal information only with consent or as permitted by PIPEDA and provincial law. Questions and complaints go to hello@camberay.com first; you may also contact the Office of the Privacy Commissioner of Canada.
The account, the app and the measurement service
When you measure a car, the app sends the measurement data to our server: the positions of the kit's targets found in each photo, the phone's camera calibration, and the car you name. Our server computes the angles from these data and keeps the result in your account. The photos stay on your phone. A photo leaves it only if you join the photo beta and agree to it (the photo row below).
When you make an account, link a phone and measure a car, we keep the following.
| Data | Purpose | Legal basis (EU/UK) | Kept for |
|---|---|---|---|
| Email address, name (if you give one), a hash of your password (never the password), the account identifier Google or Apple gives us if you sign in with them | Your account: signing in, the licence, the orders and downloads in it | Contract (Art. 6(1)(b) GDPR) | Until you close the account |
| Sign-in sessions: IP address and browser type at sign-in; the phones you link: model, system, app version, when last seen | Keeping the account secure; showing you which phones have access | Legitimate interest (Art. 6(1)(f)) | A session 30 days; a phone until you unlink it or close the account |
| Each measurement: the positions of the targets the app found in each photo, the floor map, the camera calibration, the result, the car's make, model and year and your notes, and the diagnostic files the app sends | Reading the car and making its report; finding and correcting faults of the reading | Contract (Art. 6(1)(b)); legitimate interest in a correct product (Art. 6(1)(f)) | Until you delete it or close the account |
| Photos of a measurement, only if we asked you to take part in the beta and you agreed in the app or in the account | Correcting faults of the reading that the target positions alone do not show | Consent (Art. 6(1)(a)), which you can withdraw in the account at any time | Until you withdraw the consent or ask us to delete them, and at most 24 months |
| Orders: number, email address, name, product, amount, currency, state (paid, refunded) | Delivering what you bought; our accounts | Contract (Art. 6(1)(b)); legal obligation to keep business records (Art. 6(1)(c)) | As long as tax and commercial law require (up to 10 years); not deleted with the account |
Photos can show the car's number plate, your garage and the people in it. Take them so that they show only what the measurement needs.
Payments. You pay on the payment provider's own page, and we never see your card. For the software and the printable files the seller of record is Lemon Squeezy, which handles the payment, the invoice and the tax under its own privacy notice. For a pre-order of a made kit the payment is handled by Stripe. Each tells us only the order data listed above.
Closing the account in the account page or in the app deletes the account, its phones, its measurements and its photos at once. The order records stay, as the law requires.
The website's pages set no cookie. The account pages set the cookies the account needs to work (the session and a form-protection value); the cookies page lists them.
Changes
The version date at the top changes when this notice changes. Material changes to how we use data already collected will be announced by email to subscribers first.