Privacy policy

Last updated: November 2026

1. Data Protection at a Glance

The following provides an overview of how your personal data is collected and processed when you visit our website, buy from us and use our app. Personal data is any data with which you can be personally identified.

Data is collected when you provide it to us (e.g. in a contact form or during checkout) or automatically through our IT systems (technical data like browser type, IP address). If you use our Tuning App, the app also processes data about your account and your vehicle. Section 12 explains what this covers.

This policy applies to the website ngmapp.com, the customer account, our emails and the NGM App for iOS and Android (listed in the stores as "NGM Flasher"). This policy is linked in the App Store and on Google Play.

2. Controller, Contact and Your Rights

Responsible Body

NGM App GmbH
Marvin Krumpe, Darian Krumpe
Pettenkoferstraße 12
83052 Bruckmühl
Germany
Email: support@ngmapp.com

Managing directors: Marvin Krumpe, Darian Krumpe. Commercial register: Amtsgericht Traunstein, HRB 32066.

Data Protection Officer

We have not appointed a data protection officer because we are not required to do so (Section 38 BDSG). Please send any data protection request to support@ngmapp.com.

Your Rights

You have the right to free information about your stored data, its origin and recipients. You also have the right to request correction, deletion, restriction of processing and data portability (Art. 15 to 20 GDPR). Where processing is based on our legitimate interests, you have the right to object to that processing (Art. 21 GDPR). If we use your data for direct marketing, you can object at any time without giving reasons. To exercise any of these rights, email support@ngmapp.com. We answer within one month; in complex cases we tell you if we need longer.

Supervisory Authority

You may lodge a complaint with a data protection supervisory authority, for example the one at your place of residence. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
Postal address: Postfach 1349, 91504 Ansbach
Phone: +49 981 180093-0
Email: poststelle@lda.bayern.de
Web: www.lda.bayern.de (online complaint form)

Withdrawal of Consent

Many processing operations are only possible with your express consent. You can withdraw consent at any time with future effect via the cookie icon at the bottom left of every page or by contacting us. Withdrawing consent does not affect the processing that took place before you withdrew it.

Storage Duration

Unless a more specific storage period is stated in this policy, your personal data remains with us until the purpose for processing no longer applies. If you assert a justified request for deletion or withdraw your consent, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law); in such cases, deletion takes place once these reasons cease to apply. Section 13 lists the periods for each type of data.

SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL/TLS encryption. You can recognize an encrypted connection by the "https://" prefix and the lock icon in your browser's address bar.

3. Hosting and Shop System (Shopify)

We use the shop system Shopify, provided by Shopify International Limited (Ireland/Canada). Shopify processes your data (e.g. IP address, order details) to provide the shop functions and process your purchase. Data may be transferred to Shopify Inc. in Canada and the USA. This is done on the basis of Standard Contractual Clauses, the EU-US Data Privacy Framework and a Data Processing Agreement to ensure a level of data protection that complies with the GDPR. Legal basis: Art. 6(1)(b) GDPR (contract fulfillment).

Shopify International Limited, Dublin, Ireland, acts as our processor under Art. 28 GDPR. Shopify Inc., Ottawa, Canada, and Shopify's US entities act as sub-processors. The EU Commission recognizes Canada as a country with an adequate level of data protection; transfers to the USA are covered by Shopify's certification under the EU-US Data Privacy Framework and by the Standard Contractual Clauses named above.

Server Log Files

Shopify automatically collects and stores information in server log files (browser type, operating system, IP address). Legal basis: Art. 6(1)(f) GDPR (legitimate interest). The logs also contain the page requested, the time of the request and the referring page. We use them to keep the site running, to detect attacks and to find errors. We do not merge log data with other data about you. Shopify deletes the logs according to its own retention rules; we have no access to raw log files.

Customer Account

If you create a customer account in the shop, we store your name, email address, addresses and order history so that you can see your orders and check out faster. Legal basis: Art. 6(1)(b) GDPR. The account stays until you delete it or ask us to delete it; order data that we must keep by law remains stored (see section 13).

4. Cookies and Consent (Pandectes)

To manage cookies and technical tools that require consent, we use the Pandectes GDPR Compliance banner. There you can give or refuse consent for the categories "Functional cookies", "Performance cookies" and "Targeting cookies"; the category "Strictly necessary cookies" cannot be switched off. A cookie is set to store your choice. The category each service needs is stated with that service in the following sections.

Cookies used on our website may be session cookies, which are automatically deleted when you close your browser, or persistent cookies, which remain on your device until they expire or you delete them manually.

Legal basis: storing information on your device or reading it, where this is not strictly necessary for the site, requires your consent under Section 25(1) TDDDG; the processing of the resulting personal data is based on Art. 6(1)(a) GDPR. Strictly necessary cookies (shopping cart, login, language and currency, your consent choice, fraud prevention in the checkout) run under Section 25(2) TDDDG and Art. 6(1)(f) GDPR.

Pandectes passes your choice to Shopify's Customer Privacy API. Apps and scripts that run through Shopify read this signal, so the analytics and advertising tools that need consent stay off until you opt in. We also honour the Global Privacy Control (GPC) signal of your browser: if it is switched on, we treat it as a refusal of the optional categories.

You can change or withdraw your choice at any time via the round cookie icon at the bottom left of every page (labelled "Change your consent"). There you can also see which cookies are in use. Your choice is stored for 365 days and then requested again. Pandectes keeps a record of your decision (consent ID, time, categories chosen) on its servers as proof under Art. 7(1) GDPR and counts how often the banner is displayed. Legal basis for the record: Art. 6(1)(c) GDPR (duty to demonstrate consent) and our legitimate interest in a working consent process (Art. 6(1)(f) GDPR).

5. Analytics and Tag Management

The analytics tools in this section only measure after you have allowed the "Performance cookies" category in the Pandectes banner. Legal basis: your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). You can withdraw it at any time via the cookie icon.

Google Tag and Google Tag Manager

We load Google Analytics and Google Ads through the Google tag of Google Ireland Limited, Dublin, Ireland. The Google tag is loaded when the page opens but runs in "consent mode": as long as you have not consented, all signals are set to "denied", it sets no cookies and only sends cookieless pings without a user identifier to Google, for example that a page was viewed. Your IP address is transmitted to Google in the process. Legal basis for these cookieless pings: our legitimate interest in aggregated reach measurement without recognizing you (Art. 6(1)(f) GDPR). Only after you consent to "Performance cookies" (Google Analytics) or "Targeting cookies" (Google Ads, see section 6) does the Google tag set cookies and process user identifiers.

After your consent, Shopify also loads a Google Tag Manager container through a custom pixel. Google Tag Manager only distributes the tags it contains (Google Analytics 4 and the Meta pixel from section 6) and sets no cookies of its own; it processes only the connection data (IP address) needed to fetch the script.

Google Analytics 4

We use Google Analytics for user analysis, provided by Google Ireland Limited. It only measures if you have allowed "Performance cookies" via the Pandectes banner. IP addresses are shortened (IP anonymization) before any further processing, so that a direct personal reference is excluded. Data may be transferred to Google LLC in the USA; such transfers are safeguarded by the EU-US Data Privacy Framework and EU Standard Contractual Clauses. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the cookie icon.

Google Analytics 4 records which pages you visit, how long you stay, which device, browser and region you come from, and which steps of the configurator and checkout you complete. We use this to improve the site and the configurator. Google keeps user and event data for no longer than 14 months; the reports we work with are aggregated and contain no personal data.

Microsoft Clarity

We use Microsoft Clarity, a service of Microsoft Ireland Operations Limited, Dublin, Ireland, to understand how visitors use the site. Clarity records how you move through a page (mouse movements, scrolling, clicks and taps) and builds session replays and heatmaps from this. It also collects device type, browser, screen size, approximate region and the pages visited. According to Microsoft, Clarity always masks text you enter into input fields and drop-down menus before it reaches Microsoft. The Clarity script only loads after you have allowed "Performance cookies", and we pass your consent on to Clarity as a consent signal. Data may be transferred to Microsoft Corporation in the USA; Microsoft is certified under the EU-US Data Privacy Framework, and EU Standard Contractual Clauses apply in addition. Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Retention according to Microsoft: session recordings 30 days (individual favourited recordings and a sample for up to 9 months), heatmaps for up to 9 months.

6. Advertising and Marketing

The advertising tools in this section only become active after you have allowed the "Targeting cookies" category via the Pandectes banner. You can withdraw your consent at any time with future effect via the cookie icon. Legal basis for all tools in this section: your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG).

Google Ads, Remarketing and Merchant Center

We use Google Ads, a service of Google Ireland Limited, to promote our offers through advertisements on external websites and to measure how successful these advertising measures are. Google Ads stores a cookie on your device that allows us to measure conversions (e.g. whether a visit led to a purchase) and to display interest-based advertising (remarketing). Through the Google Merchant Center our products also appear in Google Shopping; for this, the Google tag reports product views, cart and purchase events to Google after your consent. Data may be transferred to Google LLC in the USA, safeguarded by the EU-US Data Privacy Framework and EU Standard Contractual Clauses. Legal basis: your consent (Art. 6(1)(a) GDPR). Conversion cookies expire after 90 days at the latest; the conversion statistics we receive from Google are aggregated.

Meta Pixel and Conversions API (Facebook and Instagram)

We use the Meta Pixel, a service of Meta Platforms Ireland Limited, for conversion tracking and remarketing in connection with our advertising on Facebook and Instagram. The pixel enables Meta to recognize visitors to our website as a target audience for the display of ads ("Custom Audiences") and to measure the effectiveness of our ads. With regard to the data collection through the pixel, we and Meta are jointly responsible (Art. 26 GDPR). Data may be transferred to Meta Platforms, Inc. in the USA, safeguarded by the EU-US Data Privacy Framework and EU Standard Contractual Clauses. Legal basis: your consent (Art. 6(1)(a) GDPR).

The pixel is integrated twice: through the Pandectes banner and through Shopify's Facebook & Instagram channel. The pixel's base script is loaded from Meta's servers when the page opens; your IP address is transmitted to Meta in the process, but the pixel only sends events after you consent to "Targeting cookies" (Art. 6(1)(f) GDPR for loading the file). After consent, the pixel sends Meta the pages you visit, the products you view, cart and checkout events and, where available, hashed contact data such as your email address. In addition, Shopify sends order events and hashed contact data to Meta server-side via Meta's Conversions API. The joint controllership agreement with Meta is published by Meta under the title "Controller Addendum"; for everything Meta does with the data afterwards, Meta is the sole controller. You can manage ad settings in your Facebook and Instagram account.

7. Embedded Content and Widgets

YouTube Videos

On the start page and on the "Find your vehicle" page we embed videos from YouTube, a service of Google Ireland Limited, Dublin, Ireland. We use the extended privacy mode (youtube-nocookie.com) with a click-to-play cover: when the page loads, only a preview image is fetched from Google's image server, which transmits your IP address to Google. The video player itself, and with it YouTube's cookies and tracking, only loads after you click the play button. By clicking you consent to this loading (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Data may be transferred to Google LLC in the USA under the EU-US Data Privacy Framework. Loading the preview image is based on our legitimate interest in showing the video content (Art. 6(1)(f) GDPR).

Judge.me (Customer Reviews)

We collect and display product reviews with Judge.me, a service of Judge.me Ltd., London, United Kingdom. The review widget on the start page and on product pages shows reviews together with the name you entered when writing the review, the rating, the text and the date. The widget files are delivered by Shopify through its own network. A connection to Judge.me's servers is only made once you have allowed "Performance cookies" (the widget then sends usage statistics to Judge.me, for example that it was displayed) or when you write a review yourself. After your purchase, Judge.me sends you an email on our behalf asking you to review the product. For this, we pass your name, email address, order number and the products bought to Judge.me, which processes them on our behalf under Art. 28 GDPR.

Legal basis for the review request: our legitimate interest in genuine customer feedback (Art. 6(1)(f) GDPR) together with Section 7(3) UWG, because you bought from us and can object at any time. Every review email contains an unsubscribe link; you can also object by writing to support@ngmapp.com. Legal basis for publishing your review: your consent given when you submit it (Art. 6(1)(a) GDPR); you can ask us to remove the review at any time. The United Kingdom has an adequacy decision of the EU Commission, so no additional safeguards are needed for the transfer. Judge.me keeps the review data for as long as the review is published or until you ask for deletion.

App Store Reviews

We show reviews from the Apple App Store as text on our start page. No data is transmitted to Apple or to a widget provider for this.

Fonts (Google Fonts)

Our website uses the Inter typeface, which is loaded from the Google Fonts servers (Google Ireland Limited, Dublin, Ireland) when the page opens. Your IP address is transmitted to Google in the process, regardless of your cookie choice. Legal basis: our legitimate interest in a consistent presentation of the website (Art. 6(1)(f) GDPR). Data may be transferred to Google LLC in the USA under the EU-US Data Privacy Framework.

8. Communication: Email, Contact Form, Chat and Forms

Email and Contact Form

If you contact us via email, we store your details to process the inquiry and for follow-up questions. Legal basis: Art. 6(1)(b) GDPR. The same applies to the contact form on our website, which asks for your name, email address and message and is delivered to us through Shopify. Our mailboxes are hosted by Google Workspace (Google Ireland Limited) as our processor. We keep inquiries until they are settled and then for the regular limitation period of three years so that we can answer follow-up questions; if they belong to an order, the periods in section 13 apply. If your inquiry concerns a contract, the legal basis is Art. 6(1)(b) GDPR; otherwise it is our legitimate interest in answering you (Art. 6(1)(f) GDPR).

Spam Protection (hCaptcha)

The contact form and the waiting list forms are protected by hCaptcha, a service of Intuition Machines, Inc., USA. hCaptcha uses browser data, your IP address and your behaviour in the form (e.g. mouse movements) to check whether the input comes from a human. The script only loads when you interact with the form. Legal basis: our legitimate interest in protection against spam and automated input (Art. 6(1)(f) GDPR, Section 25(2) TDDDG). The transfer to the USA is safeguarded by Standard Contractual Clauses and by the certification of Intuition Machines under the EU-US Data Privacy Framework.

Shopify Inbox (Live Chat)

You can write to us in the chat via the "Support" button at the bottom right. The chat is operated with Shopify Inbox, a service of Shopify International Limited, Dublin, Ireland, which processes the data on our behalf (see section 3). The chat script comes from Shopify and loads with the page; we only process messages and details once you open the chat and write. We then process the text of the chat, the time, the page you were on and, if you enter them, your name and email address. Some first replies are sent automatically from a list of prepared answers; a person answers everything else. Chat histories are stored in our Shopify account until the inquiry is settled and then for the regular limitation period of three years. Legal basis: Art. 6(1)(b) GDPR if the chat concerns a purchase or an existing order, otherwise Art. 6(1)(f) GDPR (answering your question).

Waiting List and Vehicle Request

For vehicles marked "coming soon" you can join a waiting list on the product page. The form runs through Shopify (Shopify International Limited, see section 3) and asks only for your email address. We store it as a customer record with the tag "warteliste" and email you once when the vehicle is supported. It is not a newsletter. The start page also has a request form in which you enter your email address and your vehicle (brand, model, engine, model year); these details reach us as a message to support. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to support@ngmapp.com. We delete the entry once we have informed you or when you withdraw.

Newsletter and Marketing Emails

We currently do not offer a newsletter. We send marketing emails only with your prior consent (Art. 6(1)(a) GDPR); you can unsubscribe at any time via the link in the email or by writing to support@ngmapp.com.

Transactional Emails

Order confirmations, shipping notifications, license activations, withdrawal confirmations and similar emails about your contract are sent through Shopify. Legal basis: Art. 6(1)(b) GDPR. You cannot unsubscribe from these emails as long as the contract runs.

9. Orders, Payment and Shipping

Order Data

When you order, we process your name, email address, billing and delivery address, phone number (if given), the products ordered, prices and the payment method. We use this to fulfil the contract, deliver the hardware, activate the license, handle withdrawals, warranty and support, and keep the accounts. Legal basis: Art. 6(1)(b) GDPR; for the accounting records Art. 6(1)(c) GDPR in connection with Section 147 AO and Section 257 HGB. We keep invoices and order records for 10 years and commercial correspondence for 6 years, counted from the end of the calendar year.

Internally we tag orders with the payment method used (for example PayPal or Klarna) via Shopify Flow so that the bookkeeping can match payouts. This stays within our Shopify account. Legal basis: Art. 6(1)(f) GDPR.

Shopify Payments and Shop Pay

Depending on the payment method selected (e.g. PayPal, credit card via Shopify Payments), transaction data is passed to the respective provider. This is strictly for the purpose of payment processing (Art. 6(1)(b) GDPR). Card payments run through Shopify Payments. Your card details are entered in the checkout and go directly to Shopify; we never see the full card number. Shopify also checks payments for signs of fraud (Art. 6(1)(f) GDPR). If you choose Shop Pay, Shopify stores your address and payment details in your Shop Pay account for faster checkouts; for this account Shopify is the controller and its own privacy policy applies. Transfers to Shopify in Canada and the USA are covered as described in section 3.

PayPal

If you pay with PayPal, we pass your name, email address, delivery address and the order amount to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. PayPal is its own controller for the payment and may carry out its own credit and fraud checks; PayPal's privacy policy applies. Legal basis: Art. 6(1)(b) GDPR.

On the German product page of the license, a PayPal script shows information about instalment options ("Pay Later"). It loads when the page opens, regardless of your cookie choice, and transmits your IP address and browser data to PayPal. Legal basis: our legitimate interest in informing you about available payment methods (Art. 6(1)(f) GDPR).

Klarna

If you choose Klarna in the checkout, your name, address, email address, date of birth and the order details are passed to Klarna Bank AB (publ), Stockholm, Sweden. Klarna is its own controller for the payment, may carry out an identity and credit check and informs you about this under its own privacy policy. Legal basis: Art. 6(1)(b) GDPR.

On every page of our website, the "Klarna On-Site Messaging" script loads when the page opens, regardless of your cookie choice. On product pages it shows whether instalments are available for the price shown, and in doing so it sends your IP address, browser data and technical usage data (telemetry) to Klarna servers in the EU. Legal basis: our legitimate interest in informing you about available payment methods (Art. 6(1)(f) GDPR) and Section 25(2) TDDDG, insofar as access to your device is technically necessary for the display.

Shipping

We pass your name and address to the shipping carrier (e.g. DHL) and, where necessary for delivery, your email address or phone number. Legal basis: Art. 6(1)(b) GDPR.

10. Withdrawal Function (EU Widerrufsbutton)

You can withdraw from a contract via the "Withdraw from contract" link in the footer. The form is provided by the Shopify app "EU Widerrufsbutton" of Visionz GmbH, Hildesheim, Germany, which processes the data on our behalf under Art. 28 GDPR; the data processing is governed by the terms of the Shopify app. The form asks for your name, email address and order number; a second email address, a reason and, for a partial withdrawal, the items concerned are optional. The details are sent to Visionz through a Shopify interface; the form does not send your IP address or browser data. You receive a confirmation of receipt by email. Legal basis: Art. 6(1)(c) GDPR in connection with the legal duty to offer a withdrawal function (Section 356a BGB) and Art. 6(1)(b) GDPR for handling the withdrawal. We keep the declaration with the order records (see section 13).

11. Customer Account and License Activation (VIN Binding)

During the purchase or activation of our app, we process the vehicle identification number (VIN) of your car. This processing is mandatory to link the digital license to your specific vehicle and to fulfill our contractual obligations. Legal basis: Art. 6(1)(b) GDPR.

For a license, the Tuning App reads the VIN from the vehicle when it connects for the first time; you do not have to type it in. The license is tied on our server to the VIN and to the email address of your app account. We keep this link for as long as the license exists, because it is what proves your entitlement.

12. Data Processing in the Tuning App

The NGM App for iOS and Android (listed in the stores as "NGM Flasher") connects to your vehicle through the NGM OBD2 Bluetooth adapter and writes the calibration you have bought into the engine control unit (ECU) and, where supported, the transmission control unit (TCU). This section explains which data the app processes. It supplements the notes in the app stores; the data safety information on Google Play and the privacy labels in the App Store are based on this section.

Account Data

To use the app you create an account with your email address and a password. We also store the app version and the device type (for example iPhone model or Android device) so that we can reproduce errors. The email address cannot be changed after the license has been activated, because the license is bound to it. Legal basis: Art. 6(1)(b) GDPR.

Vehicle and Control Unit Data

When the app connects to your vehicle, it reads only what is needed to identify the vehicle and to write the calibration:

  • the vehicle identification number (VIN),
  • the identification of the control units (hardware and software part numbers, software version),
  • the current software state of the control unit,
  • the stage and functions you have selected (for example Stage 1, sound functions, start/stop setting),
  • the identifier of your NGM adapter.

These data are transmitted to our license server so that the server can check your license, provide the matching file for your engine variant and record that the file was written. Legal basis: Art. 6(1)(b) GDPR. The app does not read position data, trip history or personal information from the infotainment system. The app does not collect location data. Where the operating system requires a location permission for Bluetooth scanning, it is used only to connect to the adapter; no location is stored.

Stock Software for Flashing Back

Before the first flash, the app reads the identification and software state of your control unit and sends them to our license server. The stock software with which you can return your vehicle to factory state at any time comes from our database for your engine variant. Legal basis: Art. 6(1)(b) GDPR. We keep the details read from your control unit for as long as the license exists.

Flash Logs

For every writing process the app records the time, the control unit, the file used, whether the process completed or was interrupted, and the adapter used. We need these logs to restore a control unit after an interrupted flash, to handle warranty and support cases and to prove which software was written. Legal basis: Art. 6(1)(b) GDPR and our legitimate interest in safe operation (Art. 6(1)(f) GDPR). Retention: for as long as the license exists, and no longer than the account.

Error Reports

If the app crashes or reports an error, a report with the device type, operating system version, app version, error message and time is sent to our server or to a service we commission for error reports. Error reports contain no vehicle data beyond the control unit identification. Legal basis: our legitimate interest in a stable app (Art. 6(1)(f) GDPR). Retention: until the error is fixed, and no longer than the account.

Hosting of the App Backend

The license server and the app backend are operated by a hosting provider as our processor under Art. 28 GDPR. Where data is processed outside the EU, we safeguard this with Standard Contractual Clauses.

App Stores and Permissions

You download the app from Apple's App Store or Google Play. Apple and Google process your store account data, the download and, if you have allowed it in the operating system, crash and usage statistics under their own privacy policies; we receive only aggregated statistics from them. The app asks for the Bluetooth permission to connect to the adapter and, optionally, the permission for notifications. It does not ask for access to contacts, photos, camera or microphone.

Deleting Your Account

You can request the deletion of your account at any time by emailing support@ngmapp.com from the registered address. Deleting the account ends the license tied to it; a deleted license cannot be restored. We delete account and vehicle data after your request, except for data we must keep under tax or commercial law (order records, see section 13).

13. Retention Periods

Unless stated otherwise above, we keep your data for the following periods:

  • Orders, invoices, withdrawal declarations and payment records: 10 years for accounting records (Section 147 AO), 6 years for commercial correspondence (Section 257 HGB), counted from the end of the calendar year.
  • Customer account in the shop and app account with license data and VIN binding: for as long as the account exists; after deletion, for as long as legal obligations require.
  • Flash logs and error reports: for as long as the license exists or until the error is fixed, and no longer than the account.
  • Email, contact form and chat inquiries: until the inquiry is settled, then for the regular limitation period of three years.
  • Waiting list entries: until we have informed you or you withdraw.
  • Cookie consent: 365 days in the browser; the consent record additionally for as long as we must be able to prove consent.
  • Google Analytics 4: no longer than 14 months. Google Ads conversion cookies: no longer than 90 days. Microsoft Clarity: according to Microsoft's retention periods (see section 5). Meta Pixel: see Meta's privacy policy.
  • Reviews (Judge.me): as long as the review is published or until you ask for deletion.
  • Server log files: according to Shopify's retention rules.

14. Changes to this Policy

We update this policy when we add or remove services or when the law changes. The current version is always available on ngmapp.com under "Privacy statement" and in the app. The date at the top tells you when it was last changed.