ECX BidLens - Privacy Policy
What BidLens is
BidLens is a Chrome extension that overlays bid analysis on the salvage-auction listings you browse on supported platforms (ECX, AutoOnline, WOM). It runs only on those platforms' product pages.
What we collect
- Sign in with ECX - you can activate BidLens by signing in with your ECX account. Authentication happens with our EU-hosted identity provider through your browser; the extension never sees your password. We receive your ECX account email address and name, and our account service issues the extension internal runtime credentials (licence and, if enabled, valuation access), stored in your browser's Chrome storage. Used to activate your licence and entitlements and to associate usage with your organisation.
- Licence token (legacy) - alternatively, a short identifier you receive at signup, stored in Chrome sync storage and validated against our licence server on each activation.
- Per-activation telemetry - auction ID viewed, platform (e.g.
ecx,autoonline,wom), whether you opened the BidLens panel on it, the vehicle make shown on the page, the BidLens version, your IP address, an IP-derived country code, your browser's user-agent string, and a timestamp, kept 90 days. Used to monitor service health and the activity associated with your licence. - Valuation requests (optional) - if your account includes the PrismScope valuation feature and you explicitly request a valuation on a listing, the vehicle attributes shown on that listing (e.g. make, model, first registration, mileage, power, repair-cost figures, asking value) and the auction ID are sent to our EU-hosted valuation service to compute the estimate, and the request is recorded for usage reporting and billing.
- Price checks (optional) - if your account includes the PrismScope valuation feature, then when you open the BidLens panel on a listing the same vehicle attributes and auction ID are sent to our service to look up what a valuation of that vehicle would cost you, so the button can show the price before you request one. No valuation is computed, nothing is charged, and the check is not added to your usage.
- Bid re-check - each time BidLens computes a maximum bid, it sends our licence service the numbers it priced with, so the service can recompute the bid from the same signed values and detect altered or faulty calculations: the vehicle attributes the calculation uses (market value, age, make, fuel type, engine size, weight, and the repair-cost figures and hours from the listing's damage calculation), the destination market, the values you typed into the calculator (resale value, your own repair cost, transport cost, margin), the resulting bid and the extension version. Kept for 30 days.
- Damage calculation - when a listing has a damage calculation attached (DAT or Audatex), the extension sends that file through our licence service to our EU-hosted valuation service, which reads the labour hours, paint and parts totals. The extracted totals are kept for 7 days, keyed by a fingerprint of the file, so the same calculation is not read twice.
- Security events - when a request fails a security check (for example an altered calculation, a licence used from a different installation, or too many requests), the event is logged with the IP address for 30 days to investigate abuse.
- At signup (legacy) - your name, email, optional organisation, language preference, and a one-time 6-digit verification code. Used to create and identify your licence and to send trial-related notifications.
What we do NOT collect
- Passwords (sign-in happens at our identity provider; the extension never handles them) or payment details.
- Bids you place or any other action you take on the auction platforms.
- Page contents from sites outside the supported auction platforms.
- IP addresses in routine use (a normal activation logs only the country code; see Security events above).
- Browsing history, or anything while the widget is not active on a supported auction page.
Where data lives
All services are EU-hosted: the licence service on Cloudflare's European edge (Workers/KV), our account service in Frankfurt (Render/Neon), and our identity provider in the EU/Switzerland (Zitadel).
Who we share data with
- Zitadel (EU/CH) - our identity provider; processes your login when you use "Sign in with ECX".
- SendGrid (Twilio Inc.) - receives your email address to deliver verification codes and account notifications.
- Infrastructure processors (Cloudflare, Render, Neon) host our services under EU data-processing terms.
- No other third parties. No advertising trackers. No data sold or licensed.
Your rights
- Email admin@ecx.ag to request a copy of your data or to delete your account.
- Sign out (or uninstall the extension / clear its storage) at any time to remove the locally stored credentials.
Changes
Material changes to this policy will be emailed to active licence holders.