MERCY SYSTEMS PRIVACY POLICY AMCDT (Automotive Model-Code Diagnostic Tool) and mercysystems.com/amcdt Version 1.0 - Effective October 22, 2026 Mercy Systems ("Mercy Systems", "we", "us", "our") 398 Log Road, Spring City, Tennessee 37381, United States Contact: danny@mercysystems.com This policy explains what personal information we collect when you visit our AMCDT web pages, start a free trial, buy a license, manage a subscription or use the AMCDT software, why we collect it, who we share it with, how long we keep it and what choices you have. 1. THE SHORT VERSION - AMCDT runs on your own computer. Your trace files, specs and reports are processed locally and are never sent to us. - We collect your email address to send trial and license keys, and the details you give at checkout to sell and support your license. - Payments are handled by Stripe. We never see or store your full card number. - The AMCDT software contacts our license service to check that your license key is valid. It sends the key and an anonymous computer ID - not your files or results. - We do not sell your personal information, and we do not use it for advertising. - Our web pages set no cookies of their own and use no analytics or advertising trackers. 2. INFORMATION WE COLLECT 2.1 Free trial. When you request a trial we collect your email address, the version of the License Agreement you accepted and the time you accepted it. We use the email address to send you the trial key, to make sure each person or company gets only one trial, to answer your questions and to tell you when your trial is about to end or has ended. 2.2 Purchases. When you buy a license, Stripe collects your payment details on its own secure checkout page. We receive from Stripe your name, email address, billing address, company and tax ID (if you give them), the plan you bought, the amount, the payment status and Stripe's reference numbers for you, your payment and your subscription. We also record the version of the License Agreement you accepted and when. We use this to deliver and manage your license key, to send receipts and important notices about your license or subscription, to handle renewals, refunds and disputes, to keep business and tax records and to provide support. 2.3 Payment card data. Card numbers and other payment credentials are entered on Stripe's pages and processed by Stripe. Mercy Systems never sees or stores your full card number or security code. Stripe may share with us limited details such as the card brand, the last four digits and the expiry date so that you can recognise the card. Stripe's own privacy policy applies to the information Stripe collects: https://stripe.com/privacy 2.4 Managing your subscription. When you use the "Manage subscription" page, you enter your checkout email address and your license key so that we can confirm the subscription is yours. We then open a Stripe customer portal session where you can update payment details, download invoices or cancel. We do not store what you enter on that page beyond normal server logs (section 2.6). 2.5 License validation (the AMCDT software). To activate and check your license key, AMCDT connects to our license service (api.keygen.sh, operated for us by our licensing provider, Keygen). Each check sends: your license key; an anonymous computer ID (a one-way hash derived from your computer's machine ID, from which the machine ID cannot be recovered); the operating-system type; and the technical data that every internet connection carries, such as your IP address and the time. The license service stores the key's status, the computer ID it is activated on and the time of the last check. AMCDT checks the key when you start an analysis (at most every few hours). It never sends your trace files, specs, reports, file names or results. Your license key and the last check result are also stored on your computer, in your user account's settings folder. 2.6 Server logs. Like most websites, our web server and the license service automatically record technical information for each request: IP address, date and time, the page or address requested, the response, the browser or software type (user agent) and the referring page. We use these logs to keep the service running and secure, to prevent abuse (for example, too many trial requests from one address) and to fix problems. 2.7 Emails to us. If you email us, we receive your email address and whatever you choose to send. If you send us files to get help, we use them only to help you and treat them as your confidential information. 3. COOKIES AND SIMILAR TECHNOLOGIES Our AMCDT web pages do not set cookies, do not use analytics, and do not use advertising or social-media trackers. Information needed during checkout is passed in the page address (for example, the checkout reference on the thank-you page) rather than in cookies. When you go to Stripe's checkout or customer portal, Stripe may use cookies that are strictly necessary for payment, security and fraud prevention; these are controlled by Stripe. The AMCDT software's local app runs only on your computer and uses no cookies. 4. HOW WE SHARE INFORMATION We do not sell, rent or trade your personal information, and we do not share it for advertising. We share it only: - with Stripe, to process payments, subscriptions, invoices, refunds and the customer portal; - with our licensing provider (Keygen), which runs the license service that issues license keys and answers the AMCDT software's license checks; - with our hosting provider, which runs the server for our website; - with our email delivery provider, which sends trial and license emails on our behalf; - with professional advisers (such as accountants and lawyers) where needed; - when required by law, to respond to valid legal requests, or to protect our rights, our customers or the public; and - with a buyer or successor if our business is sold or reorganised, under this policy. Our service providers may only use your information to provide their services to us. 5. HOW LONG WE KEEP INFORMATION - Purchase, billing and tax records: for as long as the law requires us to keep business and tax records (currently up to 7 years after the purchase). - License records (key, status, activated computer ID): for as long as the license is active, then for up to 12 months to handle renewals, transfers, refunds and support. - Trial records (email address, trial key, dates): up to 24 months after the trial ends, so that the one-trial-per-person rule works, unless you ask us to delete them sooner (see section 6). - Server logs: normally deleted after 30 days, unless needed longer to investigate abuse or a security incident. - Support emails: as long as needed to help you, and normally no more than 3 years. 6. YOUR CHOICES AND RIGHTS You can ask us to tell you what personal information we hold about you, to correct it, to give you a copy, or to delete it. Email danny@mercysystems.com from the address you used with us. We will answer within 30 days. We may need to confirm your identity first, and we may keep information we must keep by law (for example, tax records) or need to handle an open refund, dispute or abuse case. Deleting a trial or license record also deactivates the related license key. You can stop using AMCDT at any time. To remove the license key from your computer, run "amcdt license --remove" or delete the folder ~/.config/amcdt/license. Removing the software does not delete your reports or this folder; you can delete them yourself. Depending on where you live, you may have additional rights under local privacy laws, including the right to complain to a data protection authority. We will honour such rights as required by law. 7. SECURITY We use reasonable technical and organisational measures to protect your information, including encrypted connections (HTTPS) for our website and the license service, restricted access to our servers, and keeping card data with Stripe rather than on our systems. No method of transmission or storage is completely secure. 8. CHILDREN AMCDT is a professional engineering tool sold to businesses. It is not directed to children, and we do not knowingly collect information from anyone under 16. 9. INTERNATIONAL USERS We are based in the United States and our servers and service providers may be in the United States or other countries. If you use AMCDT from outside the United States, your information will be processed in the United States. 10. CHANGES TO THIS POLICY We may update this policy. We will post the new version on this page with a new version number and date and, for important changes, tell customers by email. 11. CONTACT Mercy Systems 398 Log Road, Spring City, Tennessee 37381, United States Email: danny@mercysystems.com