Last updated: October 1, 2026
This Privacy Policy describes how CX Auto Group Ltd and Crucially Digital Limited ("We", "Us", "Our", or "Company") collect, use, store, and share your information when you use our mobile application, Airshroud Connect, our web and kiosk display application, CX Reveal, and associated hardware products (collectively, the "Service").
We are committed to respecting your privacy and protecting your personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU GDPR.

CX Auto Group Ltd
20-22 Wenlock Road, London, N1 7GU, United Kingdom
Role: Legal Controller responsible for overall service provisioning, hardware distribution, customer support, and commercial data management.

Crucially Digital Limited
20-22 Wenlock Road, London, N1 7GU, United Kingdom
Role: Sister company responsible for technical design, firmware, printed circuit board (PCB) engineering, software development, cloud operations, and maintenance of the Airshroud Connect and CX Reveal applications.

For any questions regarding this Privacy Policy or to exercise your privacy rights, please contact our Data Protection Lead:

• Email: privacy@cxautogroup.com
  
• Postal Address: Data Protection Lead, CX Auto Group Ltd,   Logistics Dept, Unit 1C, Brookfield Business Park, Gravel Pit Lane, Cheltenham. GL52 3NQ UK
  

This Privacy Policy applies strictly to:

1. Airshroud Connect Application (iOS / Mobile): The application used to discover, pair with, configure, and control Airshroud physical reveal devices via local Bluetooth Low Energy (BLE) or local Wi-Fi provisioning, as well as managing optional cloud features.
   
2. CX Reveal Application (Web / Kiosk): The platform deployed on local kiosk hardware, tablets, or web browsers for managing digital car reveals, vehicle information display, and collecting customer inputs. This is hosted on OVH Cloud servers
   
3. Airshroud Physical Hardware: Connected PCB controllers, sensors, and physical activation systems.
   

• Local / Offline Operation: Airshroud Connect can function strictly over local Bluetooth Low Energy (BLE) to trigger reveals and configure hardware without sending your personal data to our cloud servers.
  
• Connected / Cloud Features: Account creation, organization/site user management, remote telemetry, fleet diagnostics, and kiosk customer data synchronization require network communication with our cloud infrastructure.
  

We do not use blanket consent for data processing. Every category of data is collected for a specific purpose under a defined lawful basis under UK and EU GDPR:

• Specific Data Collected: Name, work email address, hashed password, role/permissions.
• Purpose: To set up and manage user login, authenticate access to Airshroud devices, and manage user roles.
• Lawful Basis: Performance of a Contract (Art. 6(1)(b) UK GDPR)

• Specific Data Collected: Company name, dealership site/location name, designated device group, site administrator assignments.
• Purpose: To enforce security boundaries, ensure users only see/control authorized site hardware, and manage regional configurations.
• Lawful Basis: Legitimate Interests (Art. 6(1)(f) UK GDPR - secure organizational asset control)

• Specific Data Collected: Bluetooth MAC address, device serial number, mobile device unique ID (UUID), IP address, Wi-Fi SSID (during setup).
• Purpose: To pair the app with hardware, provision Wi-Fi, deliver over-the-air (OTA) firmware updates, and maintain secure network handshakes.
• Lawful Basis: Performance of a Contract (Art. 6(1)(b) UK GDPR)

• Specific Data Collected: Signal strength (RSSI), battery voltage, connection uptime, operational state (e.g., drape status, cycle count).
• Purpose: To display real-time operational status, signal alerts, and hardware state to the user during a reveal.
• Lawful Basis: Legitimate Interests (Art. 6(1)(f) UK GDPR - real-time operational functionality)

• Specific Data Collected: Timestamped operational logs, user activation actions, firmware version history, error logs.
• Purpose: To maintain audit trails for safety compliance, analyze hardware failures, provide technical support, and prevent unauthorized triggers.
• Lawful Basis: Legitimate Interests (Art. 6(1)(f) UK GDPR - auditability and product safety) / Legal Obligation (Art. 6(1)(c) UK GDPR)

• Specific Data Collected: Customer name, welcome messages, custom text entered into display kiosks.
• Purpose: To display personalized vehicle reveal welcome screens on kiosk hardware.
• Lawful Basis: Consent (Art. 6(1)(a) UK GDPR - obtained at kiosk entry) or Legitimate Interests (Art. 6(1)(f) UK GDPR - customer experience)

Airshroud Connect requires access to specific mobile device capabilities to function properly. We do not use these permissions for tracking or advertising.

• Bluetooth (BLE) Permissions: Required on iOS/Mobile to scan, connect to, and exchange control commands with Airshroud hardware. Local BLE control does not transit our servers.
  
• Local Storage & Apple Keychain:
  
  • Keychain: Auth tokens and encrypted user session data are stored securely in the iOS Keychain.
    
  • Local Storage / CoreData: Preferred hardware identifiers, cached device profiles, and offline diagnostic logs are stored locally on your device.
    

We do not sell your data or share it with third parties for marketing or tracking purposes. Data is only shared in the following operational scenarios:

1. Organization and Site Administrators: If your account is affiliated with a commercial dealership or enterprise entity, your account name, active status, and hardware usage logs may be visible to designated site administrators.
   
2. Infrastructure & Hosting Providers: We utilize secure cloud hosting facilities with OVH in UK/EU regions) to host our APIs, user databases, and OTA update servers.
   
3. Transactional Email Providers: Email delivery services on the OVH hosted portal are used strictly to deliver account verification codes, system alerts, and password resets.
   
4. Sister Companies: Data is shared between CX Auto Group Ltd and Crucially Digital Limited solely to facilitate software maintenance, technical support, and hardware diagnostics.
   

Your Personal Data is primarily stored and processed within the United Kingdom and the European Economic Area (EEA).

If cloud service providers (e.g., email delivery or server infrastructure) require transfer or access outside the UK/EEA, we ensure adequate protection is provided by utilizing UK International Data Transfer Agreements (IDTAs), standard contractual clauses (SCCs) approved by the European Commission, or direct adequacy decisions.

We do not retain data indefinitely. We adhere to clear deletion criteria:

• Account Details & Site Assignments: Retained for as long as your account is active. Accounts inactive for more than 24 months are flagged for deletion or archived. Upon request, accounts are deleted within 30 days.
  
• Device Operational & Security Logs: Telemetry and hardware logs are retained for 12 months for diagnostic analysis and auditing, after which they are aggregated/anonymized or purged.
  
• Kiosk Customer Content (CX Reveal): Customer organisations manage customer names and personalised messages. Authorised users can update or clear active kiosk content and should remove personalisation when it is no longer needed. For help deleting stored or previously published copies, contact us using the privacy contact details above.
  
• System Backups: Server database backups are rotated on a rolling 30-day cycle. Deleted data may persist in encrypted backups for up to 30 days before full overwrite.
  

Under UK/EU GDPR, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
  
• Rectification: Request correction of inaccurate or incomplete data.
  
• Erasure ("Right to be Forgotten"): Request deletion of your personal data where no legal overriding basis exists to retain it.
  
• Restriction & Objection: Object to or restrict processing based on legitimate interests.
  
• Data Portability: Request transfer of your data in a structured, commonly used format.
  

To exercise any of these rights, please use the contact for on the website noting full request and we will respond within one calendar month.

If you believe we have not processed your data in accordance with the law, you have the right to lodge a complaint with the UK data protection authority: 

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
Helpline: +44 (0)303 123 1113
Website: https://ico.org.uk

We may update this Privacy Policy from time to time to reflect hardware enhancements, software features, or regulatory updates. Any changes will be posted on this page with an updated "Last updated" date. For material changes, registered users will be notified via email or an in-app notice prior to the change becoming effective.