1. Controller
The data controller is Amin VVS AB, org. no. 559082-4552, Snödroppsgatan 86, Malmö, Sweden. Contact for anything in this policy: [email protected].
This policy covers the website partsignal.parts, the PartSignal search, and Material Inventory. Stripe, which handles payment, is a separate controller for the payment itself and has its own privacy notice.
2. What we collect
When you visit this website
This site is static. It sets no cookies and runs no analytics. Our host, Cloudflare, keeps short-lived security and traffic logs that include your IP address, browser type and the pages requested. Fonts are loaded from Google Fonts, which means Google receives your IP address when the page loads.
When you run a PartSignal search
- Photos you upload, and the text you add: part type, visible markings, brand, model, dimensions, where the part sits.
- Your email address, collected by Stripe at checkout and passed to us so we can send you the result and, for kept-open searches, later findings.
- The record itself: what the analysis found, catalogue and marketplace matches, confidence, timestamps and the state of the request.
- Payment status from Stripe: that a payment succeeded, its amount and a Stripe reference. We never receive or store card numbers.
- Technical data in server logs: IP address, request times and errors.
The search form does not ask for your name, phone number, address or any identity number, and we ask you not to put them in the description. Do not upload photos that show people.
When you request Material Inventory access
Your email address, company and role, what you asked for, your consent confirmation, and the payment status from Stripe. Parts you record afterwards are stored with their photos, markings, condition, quantity and location as professional records.
3. Why, and on what legal basis
- To run your search and deliver the result, including re-checks for kept-open searches. Basis: performance of our contract with you.
- To take payment and keep accounts. Basis: contract, and the legal obligation under the Swedish Bookkeeping Act to keep accounting records for seven years.
- To improve identification. Photos and the resulting records are used to check and improve how the same part types are recognised in later searches, and confirmed equivalences are added to our catalogue. Basis: our legitimate interest in a catalogue that gets better with use. Records used this way are kept as part data, not as data about you.
- To keep the service secure and working. Basis: legitimate interest.
- To answer you when you write to us. Basis: legitimate interest, or contract when the question concerns a purchase.
We do not sell personal data, we do not run advertising, and we do not use your data to profile you.
4. Automated analysis
Your photos and description are analysed by machine-learning models to identify the part. The models run on Cloudflare Workers AI, on Cloudflare's own infrastructure; the photos are not sent to a third-party AI company and, under Cloudflare's terms, are not used to train their models. The model output is checked against our catalogue before a result is shown.
The result is a candidate, not a decision about you. No automated decision with legal or similarly significant effect for you is made on the basis of this analysis.
5. Who processes the data for us
- Cloudflare (USA/EU): hosting, storage of photos and records, security logs and the AI models. Photos are stored in a private bucket with no public addresses.
- Stripe (USA/EU): payment. Stripe collects your card details and email directly.
- Resend (USA): sending the result and re-check emails.
- Plausible (EU): privacy-preserving, cookieless visit statistics in the search app. It does not identify you across sites.
- Google Fonts (USA): web fonts on this website.
Where a provider processes data outside the EU/EEA, the transfer rests on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We also check public marketplaces for the part you searched for; what we send them is the part description, never your personal data.
6. How long we keep it
- Search records and photos: while the request is open, which is 12 months from payment for a kept-open search and 12 months from the result for a single search. Within 12 months after that we delete the email address and any other personal data from the record. The part data in the record, meaning what the part turned out to be and what matched, is kept as catalogue knowledge.
- Email address: as above, and as long as needed to answer you on an open matter.
- Payment and invoice data: seven years, as required by Swedish accounting law.
- Server logs: days to a few weeks, as set by the hosting provider.
- Material Inventory records: while the access account is active and for 12 months after, unless the professional who recorded them asks for earlier deletion.
You can ask for earlier deletion of a search record at any time; we then delete the photos and personal data, and keep only what accounting law requires.
7. Your rights
You have the right to ask what personal data we hold about you, to have it corrected or deleted, to restrict or object to processing based on legitimate interest, and to receive the data you gave us in a machine-readable form. Write to [email protected] with the request ID or the email address you paid with, and we answer within a month.
If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se) or to the data protection authority in your own country.
9. Changes
We update this policy when the service changes in a way that matters for your data. The date at the top tells you when. If we ever start processing data for a new purpose, we tell you in the service before it begins.