Privacy Policy
This policy explains what personal data 5MTools collects when you use 5mtools.com, why, who receives it, how long we keep it and what rights you have. It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR and the ePrivacy rules on cookies.
1. Who is responsible
The controller responsible for your personal data is 5MTools, contact: info@5mtools.com. Send all privacy questions and requests to this address.
2. What we collect
| Data | Where it comes from |
|---|---|
| Account data: email address, password (stored only as a one-way hash), optional display name, account creation date | You, when you sign up or edit your profile |
| Sign-in with Google or Discord: your email address, name/username, profile picture link and an account identifier from that provider. If that email address matches your 5MTools account, the sign-in is added to the same account; you can also link or unlink Google and Discord on your account page | Google or Discord, only if you choose to sign in or link them |
| Consent record: the date and version of the Terms and Privacy Policy you accepted | You, when you sign up |
| Credits and purchases: credit balance, history of top-ups and credit use, Stripe payment reference, amount and date | You and Stripe |
| Vehicle files: the resources you open in a tool, while you work on them (held in server memory only, see section 4) | You |
| Referrals: which account referred you (if you used a referral link) and whether you have made a first purchase. If someone opens your link, they see your display name (never your email) in the invite | You, when you use a referral link |
Invite-bonus checks: when you claim invite credits, a one-way hash of your IP address and of a random ID for your browser (eag-device, see section 8), and whether your IP is on a public list of VPN and data-centre addresses. The list is kept on our own server, so your IP is not sent anywhere for this check | Your browser, automatically |
| Technical data: IP address, browser type, time and address of requests, error logs; sign-in session tokens | Your browser, automatically |
| Messages: anything you send to info@5mtools.com | You |
We do not receive or store your card details: payments are handled entirely by Stripe. We do not use analytics, advertising or tracking tools, and we do not sell personal data.
3. Why we use it, and our legal basis
- To provide your account and the tools, sign you in, process your files and add purchased credits – necessary to perform our contract with you (GDPR Art. 6(1)(b)).
- To process payments, issue receipts and handle refunds – contract (Art. 6(1)(b)), and keeping payment and accounting records to meet tax and accounting law (Art. 6(1)(c)).
- To keep 5MTools secure and working – preventing abuse, fraud and attacks (including giving the invite bonus only once per person, connection and device, and not through VPNs), fixing errors, and rate-limiting – our legitimate interest in a safe, working service (Art. 6(1)(f)).
- To record that you accepted our Terms and this policy – legitimate interest in being able to prove it, and legal obligation (Art. 6(1)(c) and (f)).
- To send you service emails (confirm your address, reset your password, tell you about important changes to the Terms or the service) – contract (Art. 6(1)(b)). We do not send marketing emails.
- To answer your messages and requests – contract or legitimate interest, depending on the request.
We do not use automated decision-making or profiling that has legal or similarly significant effects on you.
4. Your vehicle files
We do not store your vehicle files. When you open a vehicle in a tool, it is sent to our server and held in its memory only while you work on it, separate from every other user. It is removed when you open another vehicle, or after 60 minutes without activity. Your own copy stays on your computer. When you download, the finished file is kept in server memory for at most 10 minutes until your browser fetches it, then removed. We do not look through, share or publish your files, and we do not use them to train AI models. Livery designs you make in the editor stay in your browser until you save them into the vehicle.
5. Who receives data
We only share personal data with service providers that help us run 5MTools ("processors"), under contracts that require them to protect it and use it only on our instructions, or with independent providers you choose to use:
- Supabase (Supabase Inc.) – account database, sign-in and service emails. Your account data is stored in the EU (Frankfurt, Germany).
- Stripe (Stripe Payments Europe, Ltd., Ireland, and its affiliates) – payment processing. Stripe acts as an independent controller for payment data and fraud prevention; see Stripe's privacy policy.
- Google or Discord – only if you choose to sign in with them; they act under their own privacy policies.
- Our server hosting provider – runs the virtual server that hosts the website and the tools.
- Content delivery for website files: our pages load fonts from Google Fonts (Google Ireland Ltd.) and program libraries from jsDelivr. When your browser loads these files, those providers receive your IP address and browser information.
- Authorities – only where the law obliges us to, for example on a court order.
6. International transfers
Some of these providers, or their sub-processors, are based in or can access data from countries outside the EU/EEA, such as the United States. Where this happens, the transfer is protected by an adequacy decision (including the EU–US Data Privacy Framework for certified companies) or by the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for more information.
7. How long we keep it
- Account data and consent record: as long as your account exists. When you ask us to delete your account, we delete it within 30 days.
- Credit and payment records: as long as tax and accounting law requires (generally up to 10 years), even after your account is deleted. These are kept separately and used only for that purpose.
- Vehicle files: not stored; in server memory at most 60 minutes after your last activity, prepared downloads at most 10 minutes (see section 4).
- Referral link used: as long as your account exists.
- Invite-bonus hashes (IP address and browser ID): 90 days, then deleted.
- Server access logs (IP address, request, time): 14 days, then deleted automatically.
- Emails you send us: as long as needed to handle your request, and then up to 2 years in case of follow-up questions.
8. Cookies and local storage
5MTools uses only strictly necessary cookies and browser storage – the ones needed to sign you in and run the tools you ask for. We do not use analytics, advertising or tracking cookies, so we do not ask for cookie consent; we only show a short notice. You can delete this data in your browser at any time, but you will then be signed out.
| Name | Type | Purpose | Duration |
|---|---|---|---|
sb-…-auth-token | Local storage (or session storage) | Keeps you signed in (Supabase sign-in session). | Until you sign out; with "Keep me signed in" off, until you close the tab |
sb-…-code-verifier | Local storage | Security code for sign-in and password-reset links, so they only work in the browser that asked for them. | Until the sign-in finishes |
eag-remember | Local storage | Remembers your "Keep me signed in" choice. | Until you clear it |
eag_at | Cookie (5mtools.com, only sent to /api) | Proves to our tool server that you are signed in, so only you can reach your vehicle. | Your sign-in session (refreshed about every hour) |
ref | Local storage | Remembers a referral link you opened until you sign in, so the welcome bonus can be applied. | Until you sign in |
cookie-notice | Local storage | Remembers that you closed the cookie notice. | Until you clear it |
eag-device | Local storage | A random ID for this browser, used only so the invite bonus is given once per device. Sent to our server only as part of a bonus claim, where it is stored as a one-way hash. | Until you clear it |
Stripe may set its own cookies on its checkout page, for payment and fraud prevention; these are covered by Stripe's privacy policy.
9. Security
We protect your data with encrypted connections (HTTPS) everywhere, passwords stored only as one-way hashes, database access rules that let each user see only their own data, separation of each user's vehicle sessions, security testing of these protections, and collecting only the data we need. No system is perfectly secure. If a breach affecting your data happens, we will inform you and the authorities as the law requires.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate data (you can change your display name and password, and link or unlink Google and Discord, yourself on your account page);
- have your data deleted ("right to be forgotten");
- restrict how we use your data;
- receive your data in a portable format (data portability);
- object to processing based on our legitimate interests;
- withdraw consent at any time, where we rely on consent;
- complain to a data protection supervisory authority, in particular in the EU country where you live or work. We would appreciate the chance to sort out your concern first.
To use these rights, email info@5mtools.com from the address linked to your account. We answer within one month. We may ask you to confirm your identity before acting on a request.
11. Children
5MTools is not meant for children under 16, and we do not knowingly collect their data. If you believe a child under 16 has created an account, contact us and we will delete it.
12. Changes to this policy
We will update this policy when our services or the law change. The version date at the top shows the latest change. For important changes we will tell you by email or in the app before they take effect.
13. Contact
5MTools · info@5mtools.com · 5mtools.com