Privacy

In short

• To read your car, the app sends our server the technical data of each connection, including the VIN. We use it for diagnosis and to improve the app. We do not sell it or use it for advertising.
• Your location never reaches us. The GPS used by the gauges and the recordings is used on your phone and stays on your phone.
• If you buy help with your car, we ask for the car’s details, an email address and a phone number, and we only use them to look after you.
• You can ask us to show, correct or delete your data, or object to us using it, whenever you like: write to info@finalobd.com.

Who is responsible

Manuel Lorenzo Brizuela (Normantia), tax ID 71145038N, Calle Baltalasaguas 12, Urbanización El Peregrino, 47151 Boecillo (Valladolid), Spain. Email: info@finalobd.com. More details in the legal notice.

What data we use and why

To make the app work with your car

When you connect a car, the app sends our server a random key for this installation, the app version and what identifies the car: make, model, year, engine and the identification of each control unit (its part number, its software and its calibration). With that, the server recognises your car and sends it what we know how to read from it. Without this data, the online features cannot be provided.

Legal basis: it is necessary to provide the service you downloaded or bought (contract).

Your purchases, your licence and the free trials

• Purchases. When you buy or restore a purchase, the app sends the Google Play or App Store receipt to our server, which checks it with the store. We keep what you bought, the date, the store’s answer and the installation key. Payment is handled by Google or Apple: we never receive your card details.
• Signed licence. Our server signs your licence (what you have and until when it is valid) and ties it to this installation and to a fingerprint of your phone, so that it cannot be copied to another device. The fingerprint is an encrypted code that cannot be reversed, made from an identifier of the phone: on Android, the one the system gives each app; on iPhone, one the app creates itself and keeps in the phone’s keychain. It is not the IMEI or the advertising identifier.
• The free PRO trial. With that same fingerprint we record how much of the trial you have used, so that it does not start again if you reinstall the app.
• Free PRO for everyone. When we open free PRO for everyone for a while, the app asks our server whether it is open and until when, using the server’s time. No other data is needed.

Legal basis: the contract, to give you what you bought or the trial you are entitled to, and our legitimate interest in preventing copying and abuse.

That the app is the original, and the security of the service

• Integrity. The app asks Google (Play Integrity) or Apple (App Attest) to confirm that it is the original app and not a tampered copy. Our server keeps the result with the installation key.
• Brakes against abuse. To protect the catalogue, the server counts the requests from each installation and each IP address. If they go beyond normal use, it slows them down, and it can block an IP address for a few hours or, if it happens again, for up to seven days. It also marks what it serves to each installation so that copies can be recognised. When it slows down or blocks something, we get an alert with the IP address, the time, the requests and the cars asked for. The IP address is used only for this.

Legal basis: our legitimate interest in protecting the service and its content.

The log of each connection

Every time you connect a car, the app writes a log of that connection and sends it to us while it lasts and when it ends (if there is no network, as soon as there is). It contains:

• the adapter, the protocol, the timings, the dropouts and the errors of the connection;
• the car’s full VIN, its control units with their identification, what they were asked and what they answered, with the readings at that moment (time, revs, speed, temperatures, load, mileage and battery) and the result of anything you do on the car;
• how the phone was doing (model, system, language, country, memory, battery, temperature and network) and app errors.

It does not contain your location, your name, your email or anything from your other apps.

What for: to diagnose your car, to know what works on each model and remove what does not, to accept a reading or a function once it has worked on cars like yours, and to fix app errors. We do not use it for advertising, to keep a history of your journeys or to judge how you drive.

Legal basis: the contract, as far as it is needed to read your car, and our legitimate interest in the app working with your model and improving with every connection. You can object: write to us with your installation key and we will stop keeping the logs of that installation. The app will keep working just the same; the only difference is that your connections will no longer help to fine-tune your model.

Test versions may also send live driving data (what the control unit answers every few seconds), and only if you accept it in the app itself.

Recording a session in the Cockpit, with GPS

In the Cockpit modes (track, telemetry, performance and off-road) the app uses the phone’s location for GPS speed, laps, compass, altitude and the route, always with your permission. That location is used on your phone and never reaches us.

If you tap Record, the app keeps on the phone what that screen shows and your position for as long as the session lasts. It is temporary: when you stop, the phone’s share sheet opens with the files (a CSV table, a PDF summary and, off-road, the route as GPX). If you neither send nor save them, they are deleted. Nothing reaches us. If you share them, you do so yourself and with whoever you choose; bear in mind that they contain your route, your times and the car’s data.

Legal basis: your location permission, which you can withdraw at any time in the phone’s settings. Without it, the rest of the app works just the same.

The sealed used car report

If you create a used car report, the app asks our server for a code and a seal for it, and the server keeps the report exactly as the app makes it: the car (make, model, engine and VIN), the faults, the mileage in each control unit, the emissions monitors, the measured data, the date, the app version and its PDF.

What for: so that anyone who has the code can check at finalobd.com/en/verify that the report is genuine and that nobody has changed it. To do that, the page shows the report to whoever has the code. The report contains no details about the car’s owner.

Legal basis: the contract, because it is what you ask for when you create it. We keep it for five years from when it is created, so that it can be checked during the sale and afterwards. If you want us to withdraw it sooner, write to us with its code.

Paid help with your car

From the app you can buy two kinds of help: a chat with an artificial intelligence that sees your car’s data, or a diagnosis with an expert by phone, on the day and at the time you choose.

• What we ask for. The make, model and engine of your car, your email address and your phone number and, for a call, the day and time you choose. The phone number is to call you at that time or let you know if something changes; the email, to send you the full report and remind you of the appointment. When you book, we get an alert with the booking by email and through a messaging service, so that a person can look after it.
• What is used during the help. What is read from your car (its control units, what they are asked and what they answer, the faults, the mileage, the VIN and the data with the engine running), what you write in the chat and what we answer, your installation key and the time of each thing. For the expert to read your car with you, you open the session yourself in the app with a code. The phone call is not recorded.
• The artificial intelligence chat. It is handled by an artificial intelligence system, and we tell you so before you start. To answer you, the conversation and what is read from your car are sent to the provider of the artificial intelligence model used by the assistant, which may process them outside the European Union with the safeguards the law requires (the European Commission’s standard contractual clauses or an adequacy decision). Before sending anything we ask you in the app, and you can say no. A person from our team can follow the conversation and take over if needed.
• What for. To look after you, diagnose your car and send you the report. Afterwards, to review how it went, deal with a complaint or a refund and improve the assistant and the readings for each model. We do not use it for advertising and we do not sell it.
• Legal basis. The contract, because it is the service you bought; your consent to sending the data to the artificial intelligence provider; and our legitimate interest in reviewing sessions so that the service is good and safe.
• How long. The appointment details (car, email, phone, day and time) are deleted twelve months after the appointment, unless there is an open complaint or the law requires us to keep something. The session record is kept on our server, which can only be accessed with administrator rights, and after twelve months it is anonymised automatically: we delete the conversation and remove your email address from the copy of the report. What was read from the car stays like the rest of the logs, without your email, your phone number or the conversation.

There is no need to give us in the chat any data that does not help to look at your car, such as your home address.

The email report and the lists

At the end of a help session we send the full report to the email address you gave us. When we ask for your email, we also ask, separately and with nothing ticked in advance, whether you would like to join any of our lists.

• What data. Your email address, the language, the make, model and engine of your car and the report itself. If you join a list, we also keep proof of your yes: the question we asked, your answer, the date and the time. For each email we send we record the date and the subject, with a fingerprint of your address that cannot be turned back into it.
• What for. To send you the report. And only if you say yes, for one list or both: the one for your model and engine, with what we see on cars like yours, their typical faults and Final OBD offers, always about your car, and the general Final OBD list, with news and tips, one email a month at most. List emails with anything commercial in them say so at the top, with the word Advertising.
• Legal basis. The contract for the report and your consent for each list, which you can withdraw whenever you like.
• How long. While you are on any list, we keep your email address and the proof of your yes. If you only received the report, we delete your address twelve months after your last help session. If you unsubscribe from every list, we delete it after thirty days. For each list you leave we keep only the proof of your yes, without your address, for three years from the day you left, so that we can show you gave us permission; then that is deleted too. The copy of the report kept in our sent mail is deleted after twelve months. The server does all this by itself, every night.
• Unsubscribing and deletion. Every email has a link to unsubscribe in one click, from one list or from all of them, and another one for us to delete your address.

Support

If you send us a report from the app, we receive your note, any screenshot you attach and the technical log needed to investigate it. If you write to us, your email address and what you tell us, so that we can answer. Legal basis: our legitimate interest in looking after you, or the contract if it is about something you bought. We keep it as long as needed to help you and, after that, for three years at most from the last time we were in touch.

The website

On finalobd.com we count visits with our own counter, without cookies (which page you open, which website you came from and a number for that day that cannot be reversed and changes the next day; we do not store your IP address), and we use Google Analytics, with its cookies only if you accept them. It is all explained in statistics and cookies. Our own counter’s data is deleted after 400 days.

What we never do

We do not collect your location, your contacts, your photos or your files (except a screenshot you deliberately attach to a support report), your IMEI or your advertising identifier. We do not sell data or pass it on for advertising. We do not take automated decisions about you that have legal effects or affect you significantly.

Who else is involved

App data is hosted on servers in the European Union. The following are involved, as processors working on our behalf and only for these purposes: hosting and email providers; Google and Apple, for purchases and integrity checks; the provider of the artificial intelligence model used by the chat, which may process data outside the European Union with the safeguards described above; and the messaging service we use to alert ourselves of each booking. On the website, Google Analytics, which may process data outside the European Union (explained in Google’s privacy policy). Nobody else. We would only give data to an authority if the law required us to.

How long we keep it

• Connection logs: while they are useful for each model’s compatibility, and for three years at most from the connection. After that they are deleted or stripped of the VIN and the installation key.
• Purchases and licence: while your licence lasts and then for the periods required by law.
• Security alerts with IP addresses: ninety days. Ordinary server logs: thirty days at most.
• Sealed used car reports: five years, or until you ask us to withdraw them.
• Paid help: as explained in Paid help with your car and The email report and the lists.
• Support: three years at most from the last contact. Website counter: 400 days.

Deleted data may remain for up to two months in encrypted backups until they are renewed.

Your rights

You can ask for access to your data, for us to correct or delete it, to restrict its use, to take it with you (portability), and you can object to us using it, especially the connection logs. If you gave us your consent for something, you can withdraw it whenever you like. Write to info@finalobd.com; to find the app data, include your installation key, shown in Settings, Privacy. We answer within one month at most.

If you think we have not done this properly, you can complain to the Spanish Data Protection Agency (AEPD) or to the data protection authority of your country.

Security

Everything travels encrypted between the app and our server. Only we can access the server, with administrator rights, and backups are encrypted.

Children

Final OBD is meant for adults. We do not knowingly collect data from minors; if you think we have, write to us and we will delete it.

Changes to this policy

If we change anything important, we will say so in the app and on this page, with the date of the last review at the top.