Privacy Policy

This notice explains what data we collect, why we collect it, and the choices you have.

The data controller is MB "Skanyx", registered in Lithuania (Giruliu g. 10, LT-12112 Vilnius). Reach us at support@skanyx.com.

This Privacy Policy applies to:

• The Skanyx website (skanyx.com)
• The Skanyx mobile application
• Any related services or marketing

This policy does not apply to third-party websites, products, or services, even if they link to our services.

*Legal bases under GDPR Art. 6(1)(a) & (f)

We collect Vehicle Identification Numbers (VINs) to match your exact vehicle configuration for accurate diagnostics. VINs can be linked to a vehicle owner, so they may count as personal data. We use VINs only to deliver diagnostic services. We do not share them with third parties for marketing.

We do not knowingly collect data from anyone under 16. If we discover we have data from a minor, we will delete it immediately.

Cookies and similar technologies collect some data automatically for analytics and site functionality. See our Cookie Preferences center for the full list.

iOS App Privacy Nutrition Label. The Skanyx mobile app declares 7 data types in its App Store privacy nutrition label, mapped to the categories above: Email Address and User ID -> Account Data; Purchase History -> Payment & Billing Data; Crash Data and Performance Data -> Device Data (collected via Sentry under our legitimate interests, which you can object to at any time; the tracking-classified Performance Data additionally requires iOS App Tracking Transparency approval); Other Diagnostic Data -> Hardware & Device Data; Other User Content -> Vehicle Diagnostic Data and Account Data (AI Chat messages, PPI inspection notes, vehicle profiles, bug report attachments).

Crash Reports and Bug Reports

We collect automatic crash reports, including device logs, when the app fails, and bug reports you submit yourself (which may include your name, email, phone number, VIN, and screenshots). Automatic crash capture runs by default under our legitimate interests in keeping the app working, and you can object to it at any time in the app under Profile, Data and privacy, or on our cookie preferences page. This data is sent to Sentry and is stored in our own database.

Telemetry under legitimate interests

Three kinds of telemetry run by default on your Skanyx account: crash and error diagnostics, product analytics, and adapter and vehicle research. The lawful basis is our legitimate interests under Art 6(1)(f) GDPR, and the interests we pursue are keeping a safety relevant diagnostics app working, deciding what to build next, and supporting more cars and OBD2 adapters. You can object at any time under Art 21 GDPR: switch any of them off in the app under Profile, Data and privacy, or on the cookie preferences page. An objection is recorded against your account and honoured both in the app and on this website. Cookies and similar technologies in your browser are a separate matter and are never set without your consent. Processing that relies on consent keeps its own switches, including AI training on chat content, voice input and marketing emails.

Is providing data required?

Providing personal data is never a statutory requirement. Account data (email) is contractually required: without it we cannot create or secure your account. Payment data is required to complete a purchase. Everything else, including diagnostic data, chat messages and all consent-based telemetry, is optional; declining it only means the related feature stays unavailable.

Data we do not collect from you directly

Most data comes from you or your device. The exceptions: Apple sends us your Apple-provided identifier and, if you allow it, your email when you use Sign in with Apple; Stripe sends us payment status and the last four digits of your card (never the full number); RevenueCat sends us purchase and subscription status; and NHTSA returns public safety-recall records for vehicles you look up. Categories involved: identifiers, payment status and vehicle data.

• Vehicle Diagnostics: Provide diagnostic services, read and analyze fault codes, monitor vehicle health, generate repair recommendations, and maintain diagnostic history for trend analysis.
• Communication: Send product updates, service notifications, and marketing communications (with your consent). Every marketing email contains a one-click unsubscribe link.
• Service Delivery: Process payments, manage subscriptions, provide customer support, and maintain your account.
• Site Improvement: Analyze usage patterns to improve the website and app and ship new features.
• Security: Detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• Legal Compliance: Comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

We never sell your personal data or vehicle diagnostic data to third parties. We may use aggregate statistics, such as counts and trends that cannot single out any person or vehicle, to improve our algorithms; that aggregate data is anonymous. Where we instead work with hashed identifiers, such as VINs, Wi-Fi SSIDs, Bluetooth device names, or device fingerprints, that data is only pseudonymous, not anonymous: it remains personal data and stays protected by this policy, because it can still be linked back to you.

We use vehicle diagnostic data only to provide diagnostic services, generate repair recommendations, track vehicle health over time, and improve our algorithms. It is encrypted at rest. Our support team accesses it only when you request help.

AI Providers and Retention

Our AI Chat Assistant and AI features are processed by Anthropic (Claude). When you use these features, your messages and the relevant vehicle context are sent to Anthropic to generate a response. Under our agreement with Anthropic, your data is processed on standard API terms: Anthropic may retain it for up to 30 days for trust-and-safety purposes and then deletes it, and Anthropic never uses it to train its models. Embeddings of chat content are generated by Voyage AI for retrieval and are stored in our own database while your account is active.

Voice Input

Voice input is an optional Pro feature in AI Chat. When you tap the microphone, we record what you say and send that recording to ElevenLabs (Scribe v2) in the United States to convert it into text, which you review before sending. To improve accuracy we also send your vehicle's fault codes and its make, model and engine code as context. We ask for your consent the first time you tap the microphone (GDPR Art 6(1)(a)), never at launch, and you can withdraw it at any time in Profile, Data and privacy with one tap; declining costs you nothing else, because text chat works fully without it. We never store the audio: the recording is deleted from your device as soon as the transcript comes back, including when transcription fails. ElevenLabs retains the transcript - and may retain the recording - under its own retention terms; its zero-retention mode is available only to enterprise customers and we do not use it. Our own deletion promise covers your device and our servers: we never store the recording anywhere. For this transfer to the United States we rely on the EU Standard Contractual Clauses (Module Two, controller to processor), concluded through the ElevenLabs Data Processing Addendum.

Automated decision-making

Skanyx’s AI features analyse vehicle data and answer questions, but no decision with legal or similarly significant effects on you is taken solely by automated means (GDPR Art 22 does not apply). Diagnostic outputs are informational; what to do with your vehicle always remains your decision.

You can change your preferences at any time via the "Cookie Preferences" link in our footer. Most browsers also allow you to manage cookies through their settings.

We share personal data only when necessary for:

• Service Providers: Third parties who help us operate our website and services (e.g., web hosting, analytics, email marketing)
• Legal Compliance: When required by law or to protect our legal rights
• Business Transfers: If we sell or transfer our business (with the same privacy protections)

Our data processors, and what each one receives and why, are:

• Anthropic (AI Chat Assistant and AI features) - receives your chat messages and the relevant vehicle context so it can generate AI responses and diagnostic insights
• Voyage AI, a MongoDB company (embeddings) - converts chat and knowledge-base text into numerical embeddings so the assistant can retrieve relevant information; the embeddings are stored in our database
• ElevenLabs (speech-to-text for voice input) - receives the audio recording of what you say, plus your vehicle's fault codes and its make, model and engine code to improve accuracy, and returns the text transcript; voice input is an optional Pro feature, we never store the recording and it is deleted from your device as soon as the transcript returns, while ElevenLabs retains the transcript - and may retain the recording - under its own retention terms; processed in the United States
• Google Analytics 4 (website analytics, via Firebase) - receives website usage events (pages viewed, clicks, conversions) with a random visitor ID; runs only after you grant the product-analytics consent
• Google Firebase Cloud Messaging (app push notifications) - receives push-notification tokens so the mobile app can deliver alerts you enabled
• Sentry (error monitoring and performance) - receives application error reports, performance traces, and diagnostic logs so we can detect and fix faults; on the website it also records masked session replays (text and media masked, so message and account content is not captured), gated by your telemetry consent
• PostHog (product analytics) - receives website usage events (pages viewed, clicks, and conversions) and, once you sign in, your account ID, email, and language, so we can understand and improve how the site is used; website analytics run only with your telemetry consent, while confirmed purchase and waitlist sign-up events are recorded as part of providing the service; hosted in the EU
• RevenueCat (subscription management) - receives purchase and subscription events to manage your entitlements across platforms
• Stripe (payment processing) - receives payment, billing, and transaction data to process purchases; we never store your full card details
• Brevo (email and waitlist) - receives your email address and contact details to send transactional and marketing emails and manage the launch waitlist
• NHTSA (vehicle recall lookups) - receives a vehicle's make, model, and year (or VIN) to return open safety-recall information; this is a U.S. government service
• Apple (Sign in with Apple) - processes your Apple-provided identifier and, if you allow it, your email address to authenticate you
• Supabase (database, authentication, and storage) - hosts your account, vehicle, diagnostic, and chat data and any files you upload
• Cloudflare (content delivery and bot protection) - processes technical request data, including your IP address, to deliver, accelerate, and protect the website and app
• Cloudflare R2 (backup storage) - holds backup copies of our database, which include your account and vehicle data, so we can restore the service after a failure
• Hetzner (EU hosting and backup storage) - hosts our servers and holds backup copies of our database in the EU

Some processors are located outside the EEA. We ensure every transfer has appropriate safeguards in place - see section 9 below.

We keep personal data only as long as needed for the purposes in this policy. Where a window below is a fixed length, deletion is automatic at the end of it; where retention lasts while your account is active, we delete the data when you delete your account or ask us to.

Beyond these automatic windows, you can request deletion of your data at any time by contacting us, and we delete your account data within 30 days of an account-deletion request.

Depending on your location, you may have the following rights:

GDPR Rights (EU/EEA)

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data
• Restriction: Limit how we process your data
• Portability: Get your data in a machine-readable format
• Objection: Object to processing based on our legitimate interests, including the three telemetry purposes, using the switches in the app and on the cookie preferences page
• Withdraw Consent: Withdraw consent at any time

California Rights (CCPA/CPRA)

• Right to Know: What personal information we collect and how we use it
• Right to Delete: Request deletion of personal information
• Right to Opt-Out of Sale: Opt-out of selling personal information (not applicable - we don't sell data)

To exercise any of these rights, email support@skanyx.com with the subject line 'Data Rights Request'. We will verify your identity and respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate (Valstybine duomenu apsaugos inspekcija, ada.lt) or the supervisory authority in your country of residence.

We use the following technical and organizational measures:

Technical Measures

• Encryption of data in transit and at rest
• Access controls and authentication
• Regular security monitoring and logging
• Penetration testing and vulnerability assessments

Organizational Measures

• Regular staff training on privacy and security
• Data protection policies and procedures
• Data processing agreements with third parties
• Incident response plans

We protect your data with the measures above, but no method of transmission or storage is 100% secure. Take your own precautions too.

Skanyx operates from the European Union. Some of our processors are located in, or transfer data to, the United States.

Processors that may process your data in the United States include Anthropic, Voyage AI, ElevenLabs, Google (Firebase), RevenueCat, Apple, and Stripe.

For these transfers we rely on appropriate safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The EU-US Data Privacy Framework, where the processor is certified
• Supplementary technical and organisational measures, such as encryption in transit and at rest

We may update this Privacy Policy. We'll notify you of significant changes by:

• Sending an email to your registered address
• Posting a prominent notice on our website
• Updating the "Last updated" date at the top

Your continued use of our services after such changes constitutes your acceptance of the updated policy.

If you have questions about this Privacy Policy or want to exercise your rights, you can contact us:

• Email: support@skanyx.com (for privacy inquiries and data rights requests)
• General Inquiries: team@skanyx.com
• Contact Form: Available on our website

We respond to inquiries within 30 days.