Website privacy

Who is responsible?

Konstantin Davos, trading as Mobile Service Card
Calvinstrasse 15
29223 Celle, Germany
support@mobileservicecard.com

This notice covers mobileservicecard.com and www.mobileservicecard.com, including the public demonstration, and app.mobileservicecard.com. Online activation, cloud synchronization and notification delivery are disabled in this demonstration. The paid app provides license activation and synchronization. Optional date-based email and push reminders are available in the paid app after you enable them. The public demonstration does not send reminders.

Website delivery and security

Cloudflare delivers our pages and processes technical information such as IP address, requested URL, request time, browser information and response status. This is needed to deliver the website and protect it against misuse. The contact endpoint also uses your IP address to limit repeated submissions. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in operating a reliable and secure website.

Our website code contains no advertising pixels, third-party analytics or externally loaded fonts. It does not subscribe you to marketing messages. Hosting and security processing still take place. External links connect you to their providers when you follow them.

Aggregate website statistics

We count four website events: arrival on the home page, deliberate opening of the test card, first interaction with the embedded test card, and a click through to Lemon Squeezy checkout. Automatic test-card preloading does not count as an opening or interaction. A checkout click is not proof of a completed purchase.

Our own counter sends only the event type, page language and fixed campaign categories (video or image ad, Facebook or Instagram). A separate Cloudflare D1 database stores daily totals in the Europe/Berlin time zone only; totals are removed after 90 days. It stores no IP addresses, visitor identifiers, complete URLs, device information, vehicle data, notes, license keys or email addresses. Cloudflare technically processes the connection IP address as for other hosting requests. These statistics are not sent to Meta or other advertising networks.

The counter uses no cookies, localStorage, fingerprinting or persistent recognition. Duplicate events are suppressed only in the open page document's memory; reloading can count again. The legal basis for technical processing is Article 6(1)(f) GDPR, our legitimate interest in evaluating and improving our website and advertising using minimal data. We do not create individual usage profiles.

We respect enabled Do Not Track or Global Privacy Control. You can also open the website without usage counting; this parameter disables counting for that open page and its embedded test card. Without a visitor identifier, we cannot attribute a previous event to a particular person. Blocking, our own tests, repeated loads and measurement errors may affect totals; they do not represent uniquely identified people.

The free test card

The test card keeps example records, your edits and settings only in the memory of the open demo. It does not persist these test records in local storage or send them to our license or synchronization services. Loading its files involves normal hosting requests.

Closing, leaving or reloading the demo discards all edits. The demo also resets after six hours, including when you return to a sleeping tab. Each new session restores Boneshaker, Trailer, Generator and a blank fourth vehicle. Old records from the previous persistent demo are removed when the new demo opens. The test card does not send messages, share or download files, access contacts, or open email, phone or messaging apps. These controls are previews for the purchased app. Import controls are previews only. In the demo, Choose File shows a demo notice; it does not open a file picker, upload a file or import vehicle data.

Please use example information rather than sensitive personal records in the public test card.

Purchases, activation and personal devices

Lemon Squeezy operates the checkout as merchant of record and processes payment and billing information under its own privacy policy. We receive order and license information, including purchase email, product, payment status and identifiers, to provide access and handle refunds. Our app does not receive your payment card details.

Activation processes your purchase email, license key, device identifier and label, verification challenges, access credentials and activity timestamps. Stored license keys and device identifiers are protected with keyed hashes. Resend sends the six-digit verification code. Codes expire after ten minutes; this does not automatically erase the challenge record. Processing necessary to provide the purchased service relies on Article 6(1)(b) GDPR; abuse prevention relies on Article 6(1)(f).

If you choose to pair browsers on the same PC, we store their device-slot association and a keyed hash of a one-use pairing code, its expiration and use status. The code expires after ten minutes. The association relies on your confirmation that the browsers run on the same PC; we do not use hardware fingerprinting to establish that association. Each browser retains separate access credentials and synchronization identifiers. Removing the paired device revokes its browser accesses and keeps vehicle records.

Connected app and synchronization

The app stores records and settings on your device and synchronizes authorized records through Cloudflare Workers and D1 databases. These records can include vehicle names, number plates, VINs, mileage, notes, maintenance history, parts and workshop details. Device storage and pending changes support offline work and synchronization. The service is not end-to-end encrypted. Processing necessary for the requested app relies on Article 6(1)(b) GDPR; necessary device storage is covered by Section 25(2)(2) TDDDG.

Clearing browser data or removing a device does not delete server records and can lose unsynchronized changes. Exported files remain wherever you save or share them. Standard exports exclude the private preferred-workshop block; review other fields before sharing. Only enter information you are entitled to use, and avoid unnecessary sensitive information. Business use involving employee or customer personal records requires the relevant responsibilities and any necessary data-processing agreement to be settled first.

App data retention and requests

We retain synchronized records and license/device information while needed to provide access and the requested service. Verification expiry does not itself delete database rows. Retention may continue where required for statutory obligations or legal claims. Contact support@mobileservicecard.com to request access, correction, export or deletion; we verify account ownership before acting. Device removal preserves vehicle records. Reminder preferences, push subscriptions and minimal delivery records are kept while needed to provide the selected reminders and prevent repeated delivery. Email opt-out records keep an address hash and the date of the request so account settings cannot undo the recipient’s choice.

Optional email and push reminders

In Vehicle Management → Notifications, you can select your verified registration email and up to two additional addresses independently. Addresses supplied by an account holder are not separately verified by this form. Only add addresses you control or recipients who have asked to receive these reminders. Unchecked addresses remain saved until edited or removed. Optional reminders are based on consent under Article 6(1)(a) GDPR; an account holder’s selection is not treated as someone else’s consent.

The server uses the most recently synchronized vehicle data and the selected time zone to calculate date-based reminders. Messages can contain the vehicle name, license plate, manufacturer, model, mileage or operating hours, maintenance item, performed date, due date and status. Mileage and operating-hours warnings are displayed in the app; they do not independently trigger email or push. Delivery records identify reminder stages and attempts to prevent duplicates. Resend processes the selected recipient address, message and delivery metadata. Replies go to support@mobileservicecard.com.

Push must be enabled separately on each personal device after browser or operating-system permission. We store its endpoint, subscription keys and device association. Apple, Google, Mozilla or Microsoft transports the encrypted Web Push payload according to your browser. Message previews may appear on your lock screen. On iPhone and iPad, open the app from your Home Screen before enabling push. Browser permissions, network access, device settings and provider delivery can delay or prevent receipt.

To withdraw permission, turn off selected email recipients and save, or choose Disable push on this device. Each reminder email also includes a private stop-email link for that address and account; no sign-in is needed. Opening the link changes nothing until you confirm. The confirmation uses a first-party security cookie that expires after ten minutes and is not used for tracking. The opt-out is preserved against later account-setting changes. It does not stop activation or security emails, other selected recipients, push, or messages already accepted for delivery. If someone else entered your address, contact support for information, correction or deletion, or use the stop-email link.

Currency estimates

The purchase dialog can show an approximate equivalent of the USD base price. Our server retrieves public reference rates from Frankfurter and temporarily caches them. Your currency selection stays in the current page and is not sent to the rate provider. We do not forward your browser headers, contact details or payment information to Frankfurter. The displayed estimate is not a payment quote.

Contact and support

The form asks for your email address, subject and message. Your name is optional. We use these details to handle your inquiry and reply. Without an email address and a message we cannot respond through the form. You may also email us directly. Please do not include passwords, verification codes or full license keys.

Cloudflare processes the form request. Resend (Plus Five Five, Inc.) forwards the message to support@mobileservicecard.com, a mailbox hosted by IONOS. These providers process message content, addresses and technical delivery data as necessary for their services. The form creates no separate message database and sends no automatic reply. It does not add you to a mailing list.

For inquiries about a contract or steps requested before a contract, the legal basis is Article 6(1)(b) GDPR. For other inquiries it is Article 6(1)(f) GDPR, our legitimate interest in responding to people who contact us.

Providers and international processing

Our service providers are Cloudflare for hosting and technical protection, Resend for contact-form, activation-email and optional reminder delivery, and IONOS for the support mailbox. Cloudflare and Resend may process information outside the European Economic Area, including in the United States. Their published data-processing terms describe transfer safeguards, including standard contractual clauses. Details of those safeguards are available in the linked terms and may be requested through our support address.

• Cloudflare: privacy information and data-processing terms.
• Resend: privacy information and data-processing terms.
• IONOS: privacy information.

How long information is kept

Support correspondence is kept for as long as needed to resolve the inquiry and follow-up questions. Where correspondence must be retained to meet statutory obligations or establish, exercise or defend legal claims, that purpose determines the longer retention period. Technical access, security and delivery data are subject to the providers' operational retention arrangements. A message disappearing from the website form does not erase the delivered email or provider delivery records. You can contact us about retention or deletion of your inquiry.

Previous vehicle recovery

Before you clear or overwrite a populated vehicle card, the app keeps one previous version per card in this browser’s local storage. It includes vehicle records and private workshop contacts, but does not transfer licenses or device access. This recovery copy is not synchronized to other devices. It is replaced by a later clearing or overwrite, removed after restoration, or lost if you clear this browser’s app data. In the public test card it stays only in temporary memory and expires with the demo. Saving a transfer file is separate and does not include private workshop contacts.

Your rights

Subject to the applicable legal conditions, you can request access, correction, erasure, restriction of processing and data portability. Where processing relies on legitimate interests, you may object for reasons relating to your particular situation. Where consent applies, you may withdraw it for future processing.

Contact support@mobileservicecard.com to exercise your rights. You can complain to a supervisory authority, including Der Landesbeauftragte für den Datenschutz Niedersachsen. This website and contact form do not make automated decisions with legal or similarly significant effects.