Privacy Policy

Effective date: September 5, 2026
Last updated: September 9, 2026

1. Who we are and what this policy covers

Okanagan Ventures, carrying on business as ECU5.com (“Okanagan Ventures,” “we,” “us,” or “our”), operates ecu5.com and the products, tools, accounts, stores, support channels, and related services available through it (collectively, the “Site”).

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit the Site, create an account, make a purchase, use VIN Dec or My Garage, submit vehicle or tuning information, upload files, request support, or otherwise interact with us.

We do not sell or rent personal information. We handle it only for reasonable purposes described in this policy, with consent where required, or as otherwise permitted or required by law.

This policy is intended to reflect British Columbia’s Personal Information Protection Act (“BC PIPA”). Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and other laws may also apply to some interprovincial, international, or other activities. Our Privacy Officer oversees our privacy practices. Contact information appears at the end of this policy.

2. Information we collect

What we collect depends on how you use the Site. It may include:

• Contact and account information, such as your name, username, email address, telephone number, billing or shipping address, account preferences, and protected account credentials.
• Order and transaction information, such as products or services requested, cart and order contents, delivery details, order status, invoices, refunds, disputes, tax information, transaction history, and eligibility or status documentation you choose to provide when requesting First Nations sales-tax relief.
• Limited payment information, such as the payment provider, payment status, transaction identifier, payment-method type, card brand and last four digits, and fraud or dispute information. Payment providers collect full payment credentials directly; we do not intend to receive or store complete payment-card numbers or card security codes on our systems.
• Vehicle and VIN information, including a Vehicle Identification Number (VIN), an optional model year, decoded vehicle specifications, and vehicles that you expressly add to My Garage.
• Tuning, diagnostic, and licence information, such as vehicle configuration, engine or transmission information, ECU or TCU hardware and software identifiers, calibration identifiers, original or current Tune Files, modified files, file metadata, fault or diagnostic codes, data logs, service notes, support records, software licence keys or identifiers, activation and entitlement status, and information needed to confirm compatibility or fulfil a service.
• Communications and content, such as questions, support requests, emails, reviews, survey responses, attachments, and other information you choose to provide.
• Technical, security, and usage information, such as IP address, approximate location derived from an IP address, browser and device type, operating system, referring page, pages viewed, interactions, session and cookie identifiers, timestamps, and security, rate-limit, performance, or error information.
• Consent and preference records, including cookie choices, marketing consent, the source and time of consent, and unsubscribe or withdrawal requests.

We collect information directly from you, automatically through the Site, and from organizations that support payments, analytics, hosting, security, delivery, account services, tuning, or customer support.

If you submit information about another person, vehicle, account, or file that you do not own, you are responsible for having the authority or consent required to provide it to us.

3. How we use information

We may use personal information to:

• operate, maintain, secure, troubleshoot, and improve the Site;
• create and manage accounts, carts, orders, payments, refunds, deliveries, and warranties;
• decode VINs, validate a model year, display vehicle information, and operate My Garage;
• assess compatibility, identify a vehicle or controller, process Tune Files, provide tuning or diagnostic services, administer software licences, and coordinate work with a selected Provider or tuner;
• provide customer support and respond to questions or requests;
• send order confirmations, account notices, security alerts, service updates, and other non-promotional communications;
• remember preferences and provide requested features;
• understand Site performance and usage when you have made the applicable cookie choice;
• detect and prevent fraud, abuse, unauthorized access, and security incidents;
• enforce our agreements and protect our rights, users, systems, and the safety of others;
• maintain tax, accounting, audit, licence, warranty, dispute, and other business records;
• comply with legal obligations and lawful requests; and
• send promotional communications when we have the consent or other lawful authority required to do so.

We limit collection, use, and disclosure to what is reasonably appropriate for the identified purposes. If we want to use personal information for a materially different purpose, we will explain that purpose and obtain additional consent where required.

4. VIN Dec and My Garage

VIN Dec requests

When you request a VIN decode, the VIN and any optional model year you provide are sent to our server. For an online decode, our server then transmits that information to the United States National Highway Traffic Safety Administration’s Vehicle Product Information Catalog and Vehicle Listing service (“NHTSA vPIC”). NHTSA vPIC uses manufacturer-reported data to return information describing the vehicle. By requesting an online decode, you direct us to make this transmission to the United States.

NHTSA and the U.S. Department of Transportation handle information under their own practices. For more information, review the NHTSA vPIC service and the U.S. Department of Transportation website privacy policy.

If the online service fails or is unavailable, or where VIN Dec is configured to supplement missing manufacturer-level information, VIN Dec may use an enabled local fallback database in the order configured by the Site administrator. Online values take priority when both online and local sources provide a value. A local fallback lookup takes place on our server. The VIN is not sent to the original open-source project or dataset author for that fallback lookup. The result may identify the configured source that supplied the data. See our VIN Data Sources and Third-Party Notices.

To improve reliability and reduce repeated external requests, a successful decode result may be cached on our server for up to 24 hours. We also use short-lived pseudonymous rate-limit counters derived from account or network/IP information to deter automated abuse; these counters generally expire after about two minutes. VINs and related request information may also appear temporarily in ordinary application, security, or server logs used to operate and protect the service. If JavaScript is unavailable and you use a saved-vehicle decode link, the VIN may also appear in the page URL, your browser history, and our server access logs.

VIN Dec information is based on available manufacturer, government, or fallback-source data and may be incomplete or inaccurate. It should not be treated as vehicle-history, ownership, title, recall-completion, safety, emissions-compliance, or guaranteed-fitment information. Please verify important information using the vehicle label, manufacturer records, and appropriate professional inspection.

Browser history and My Garage

If you opt in to the Preferences category in our consent manager, VIN Dec may store the last VIN and up to 12 recently successful VINs in browser local storage and same-site cookies so that your browser can suggest them later. If you do not opt in, or later withdraw that choice, VIN Dec does not retain this automatic recent-search history and removes its automatic history records from that browser. Browser local-storage records otherwise remain until you clear them or the Site clears them. The related cookies expire after up to 90 days unless you delete them sooner.

Decoded vehicles are not automatically added to My Garage. When you expressly select Add to My Garage:

• if you are a guest, up to 12 saved vehicles and selected decoded details are stored in browser local storage, and a smaller same-site cookie copy may store the VIN, model year, and decode mode for up to 90 days; or
• if you are signed in, the saved vehicle and selected decoded details are stored as user metadata associated with your Site account.

If guest Garage data is detected after you sign in, it is imported into your account only after you expressly confirm the import. Browser copies may remain until you clear them. You can use Remove Vehicle to remove a saved vehicle from the applicable Garage list.

A verified WordPress privacy export or erasure request may include or remove My Garage information stored in your account. It cannot access or erase information stored only in your browser, so you must use My Garage controls or your browser’s site-data controls to remove that information. Erasure is not absolute where we must retain information for legal, security, transaction, dispute, or recordkeeping purposes, and protected backup copies may remain until they expire under our normal backup cycle.

5. Tuning services, Providers, and software licences

When you purchase, request, or receive a tuning, diagnostic, compatibility, support, or software-licence service, we may collect and use the vehicle, controller, Tune File, diagnostic, account, order, support, and licence information needed to assess and fulfil the request.

We may disclose or make necessary information available to the Provider, tuner, technician, software vendor, or other service provider selected, assigned, or otherwise involved in fulfilling your request. Depending on the service, this may include vehicle configuration, VIN, ECU or TCU identifiers, original or current Tune Files, fault codes, diagnostic logs, support communications, and licence or entitlement information. We limit the information shared to what is reasonably required for the service, administration, security, support, or legal recordkeeping.

Some Providers act only on our instructions; others may handle information for their own lawful purposes under their own terms and privacy practices. Do not upload a file or submit information unless you are authorized to provide it and have removed unrelated personal information where reasonably possible.

Tune Files, vehicle calibrations, modified vehicle software, their updates, and related entitlements are also governed by our Tune File Licence and Software Update Limited Warranty. Those terms govern the licence and permitted use of that covered vehicle software; other software is governed by the terms disclosed for it before purchase. This Privacy Policy explains how associated personal information is handled.

6. Cookies, analytics, and marketing technologies

We use strictly necessary cookies and similar browser storage to operate and secure the Site, authenticate accounts, maintain sessions and shopping carts, process checkout, remember privacy choices, prevent abuse, and perform a VIN decode you request. Blocking necessary technologies may prevent core features from working.

Preference storage may remember recent successful VINs for suggestions or retain vehicles that you expressly add to My Garage. These convenience features are distinct from the storage needed to process a single VIN request. Where applicable law requires consent to store or access preference information, we ask for that choice through the consent manager or another clear control. My Garage storage that you expressly request is used to provide that saved-vehicle feature.

Google Analytics and any other optional analytics or marketing tags are blocked unless and until you opt in through our consent manager. If you consent, these technologies may collect a pseudonymous browser or cookie identifier, session activity, approximate location, browser and device information, referring pages, pages visited, and interaction events. Their providers may process information outside British Columbia or Canada under their own privacy practices.

The consent banner allows you to accept or reject non-essential categories and review more detailed choices. You can later withdraw or change your choices through the persistent Cookie Preferences control displayed on the Site. Withdrawing consent stops future optional collection from that browser after the updated preference takes effect, but it does not undo processing that occurred before withdrawal. You may also block or delete cookies through your browser and use the Google Analytics Opt-out Browser Add-on. More information about Google’s practices is available in Google’s Privacy Policy.

The Cookie Preferences control provides the current list of cookies and similar technologies, including their providers, purposes, categories, and expected durations. That list may change as the Site and its providers change.

7. Payments

The payment methods and payment providers available for a transaction are the options displayed at checkout. Only the provider you select applies to that transaction.

The selected provider may collect payment credentials, contact and billing details, transaction information, IP address, device information, cookies, and fraud-prevention signals directly from you or your device. Providers use this information to process and authenticate payments, prevent fraud and loss, comply with financial laws, and handle refunds, chargebacks, or disputes. They may disclose transaction information to banks, card networks, payment-method providers, and other participants needed to complete or authenticate the payment.

We may receive limited transaction details, but we do not intend to receive or store complete payment-card numbers or card security codes. Payment information may be processed outside Canada, and the selected provider’s own privacy terms apply to its handling of information.

8. When we disclose information

We do not sell or rent personal information. We may disclose only the information reasonably necessary to:

• payment processors, banks, card networks, and fraud-prevention services;
• NHTSA vPIC for an online VIN decode;
• Providers, tuners, technicians, software vendors, and licence administrators involved in a requested service;
• website hosting, cloud storage, backup, security, analytics, consent-management, email, and customer-support providers;
• shipping, fulfilment, returns, accounting, audit, insurance, and professional advisers;
• a prospective or completed purchaser, investor, lender, or successor in a legitimate financing, merger, sale, reorganization, or similar business transaction, subject to appropriate safeguards; or
• courts, regulators, law-enforcement agencies, or other parties when disclosure is permitted or required by law, necessary to respond to lawful process, investigate fraud or misuse, enforce an agreement, or protect rights, systems, safety, or property.

We may also disclose information for another purpose at your direction or with your consent. We use contractual or other appropriate measures to require providers processing personal information on our behalf to protect it and use it only for authorized purposes, although some third parties also act under their own legal obligations and privacy terms.

9. Processing outside British Columbia and Canada

Some service providers store or process personal information elsewhere in Canada, the United States, or other countries. This includes transmitting an online VIN Dec request to NHTSA vPIC in the United States and may include information handled by payment, hosting, analytics, software, support, or tuning providers.

Information processed in another country is subject to that country’s laws and may be accessible to courts, law-enforcement agencies, or national-security authorities in accordance with local law. We remain responsible for personal information under our control and use contractual, technical, organizational, and other safeguards appropriate to the circumstances. Contact our Privacy Officer if you would like more information about relevant service providers or cross-border processing.

10. Consent and marketing communications

We obtain meaningful consent unless the law permits or requires us to handle information without consent. Consent may be express or implied depending on the sensitivity of the information, the stated purpose, your reasonable expectations, and applicable law. We do not require consent to unnecessary collection, use, or disclosure as a condition of providing a product or service.

You may withdraw consent for future handling by contacting our Privacy Officer or using an available Site control, subject to reasonable notice and legal, contractual, security, or technical restrictions. Withdrawal does not affect handling that occurred lawfully before it took effect. If you decline information needed to complete a transaction or provide a requested feature, we may be unable to fulfil that request.

We send commercial electronic messages only with express consent, qualifying implied consent, or another lawful authority under Canada’s Anti-Spam Legislation (“CASL”). Our commercial messages identify the sender, provide required contact information, and include a readily performed unsubscribe mechanism. We maintain appropriate consent and unsubscribe records, and we action unsubscribe requests at no cost and no later than 10 business days after receiving them. Unsubscribing from marketing does not stop necessary order, account, security, licence, support, or other service communications.

11. Retention

We retain personal information only as long as reasonably necessary for the purposes described in this policy and for legal or business needs such as tax, accounting, licence administration, warranties, refunds, chargebacks, fraud prevention, security, support, and disputes. Retention periods vary by the type of information and why it is needed.

Specific VIN Dec periods are described in Section 4: successful server-side decode results may be cached for up to 24 hours; pseudonymous rate-limit counters generally expire after about two minutes; VIN-related same-site cookies may remain for up to 90 days; and browser local-storage data remains until you or the Site clears it. My Garage account data ordinarily remains until you remove it, close the account, or make a valid erasure request, subject to applicable exceptions.

Order, payment, tax, licence, Tune File, support, security, and dispute records may be kept for the period reasonably needed to provide the service, administer the relationship, establish or defend legal claims, meet contractual obligations, and comply with law. If personal information is used to make a decision that directly affects you, we retain it for at least one year where BC PIPA requires that period so you have a reasonable opportunity to request access.

First Nations sales-tax-relief documentation is limited to information reasonably needed to verify eligibility, apply the correct tax treatment, document delivery where required, and meet audit or legal obligations. Access is restricted to personnel and service providers who need it for those purposes, and copies are destroyed or securely deleted when no longer required.

When information is no longer required, we securely erase, destroy, or anonymize it. Protected backup copies may remain until they are overwritten or expire under the applicable backup cycle.

12. Security and accuracy

We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity and amount of personal information and the foreseeable risks. Measures may include access controls, least-privilege administration, encryption in transit, secure development and update practices, logging, backups, rate limiting, provider oversight, and staff or contractor confidentiality requirements.

No Internet transmission, website, or storage system can be guaranteed completely secure. You are responsible for protecting your account credentials and for notifying us promptly if you suspect unauthorized account activity. If a privacy or security incident occurs, we will investigate, take reasonable containment and remediation steps, and provide notices where required by law or appropriate in the circumstances.

We take reasonable steps to keep personal information accurate and complete for the purposes for which it is used. Vehicle, diagnostic, and decoded data can be incomplete, outdated, or incorrect, so you should verify it before relying on it for an important decision.

13. Access, correction, and erasure requests

Subject to limited legal exceptions, you may make a written request to:

• access personal information under our control;
• learn how it has been used and to whom it has been disclosed;
• correct information that is inaccurate or incomplete; or
• withdraw consent or request deletion where applicable.

Send your request to our Privacy Officer with enough detail to identify you and the requested information. We may take reasonable steps to verify your identity before acting on the request and will use the verification information only for that purpose.

For requests governed by BC PIPA, we normally respond within 30 days. The law permits specified extensions, limited refusals, and a minimal access fee in some circumstances. We will provide any required notice, explanation, or fee estimate. If we correct information, we will also send the correction to organizations that received the original information during the preceding year where the law requires us to do so. If we do not make a requested correction, we will annotate the information with the requested correction where required.

Deletion is not an absolute right. We may retain information required for legal, tax, transaction, licence, fraud-prevention, security, backup, dispute, or recordkeeping purposes. We cannot erase information controlled independently by another organization, and we cannot reach data stored only in your browser.

14. Third-party sites and services

The Site may link to third-party websites, platforms, software, or services. We do not control their independent privacy practices, and this Privacy Policy does not apply to personal information they collect for their own purposes. Review their privacy terms before providing information directly to them.

15. Changes to this policy

We may update this Privacy Policy when our practices, providers, technology, or legal obligations change. We will post the revised policy on the Site and change the “Last updated” date. We will provide additional notice or seek renewed consent for a material change where required by law.

16. Questions and complaints

Contact our Privacy Officer with a question, access or correction request, consent withdrawal, or privacy complaint. We will investigate complaints fairly and respond as required by law.

Privacy Officer
Okanagan Ventures, carrying on business as ECU5.com
645 St Annes Rd
Armstrong, British Columbia V0E 1B5
Canada
Email: ca@ecu5.com
Telephone: +1 236-361-5150

If we cannot resolve your concern, you may contact the Office of the Information and Privacy Commissioner for British Columbia. If PIPEDA applies to the matter, you may also contact the Office of the Privacy Commissioner of Canada.