Privacy Policy
MTechs Boot Repair Toolkit · ValiumMedia Techs · Last updated: 22 October 2026
This policy explains what information we collect when you visit vmtechs.com, buy or activate a licence, download or use the VMTechs Boot Repair Toolkit, use one of its optional online features, or contact us. It applies to services we operate under the vmtechs.com domain.
In one sentence: we use information to provide, secure and support our licences and services; we do not sell or rent personal information, and share it only with the service providers described below or when the law requires it.
Who we are
The data controller is ValiumMedia Techs, 1019 Ashton Drive, Unit L86, Morgantown, WV 26508-6876, United States. Questions, requests or complaints: support@vmtechs.com.
What we collect, and why
| What | When | Why we need it |
|---|---|---|
| Name, email address and order details (order/transaction reference, plan, amount, currency, date and payment status) | When you buy through us or a reseller, retrieve a key, or contact support | To deliver and verify a licence, handle refunds, re-issue a lost key, provide support and meet accounting obligations |
| Licence and activation information: purchase email and activation code for online activation; the Request Code supplied by the app or a link; the derived machine identifier, licence/key status and expiry | During an online or offline activation, retrieval, conversion or other licensing request | To validate and bind a licence, prevent abuse, and provide or recover the correct key |
| Failed online-activation attempt details: a sanitized version of the email and code entered, the failure reason, app/boot metadata when supplied, and the request’s IP address and time | When an online activation attempt fails validation | To troubleshoot and protect the licensing service against abuse and repeated guessing |
| Website and product-event records: IP address, time, page/route, referrer where available, device class and country; event details such as a button click, update check or download handoff | Automatically when our pages or app endpoints are used | To operate and secure the site, attribute traffic, troubleshoot and produce statistics |
| Identifiers carried in some licence links: a Request Code or USB-stick serial may be recorded in the private event log when a link includes it; an online-activation event records the derived machine identifier | When a purchase, retrieval, conversion or technician link carries an identifier, or an app activation is logged | To associate the licensing event with the relevant device/licence and help support or investigate abuse; these values are not published on the website |
| Update-check and download-handoff metadata: running app version/build, boot mode (Windows, WinRE or WinPE), release/file requested, result, IP address and time | When you choose Help → “Check for Updates…”, and when the app requests an update download | To return current release information, let the app verify the downloaded file and count a server handoff; a handoff does not prove the file finished downloading |
| A diagnostic session report: report text, run identifier, app version and boot mode; the server’s report key is a six-character prefix derived from a validated Request Code | Only after you explicitly choose to share a report in the app | To help diagnose a problem you ask us to investigate |
| Email address for optional marketing | Only if you voluntarily enter it in the optional download-panel form | To send the requested repair guide and occasional product news; signup is not required to download or use the toolkit |
| A review, if you write one | When you rate or review the toolkit | To publish a review from a verified owner after we read it |
| Information you choose to include in support messages | When you email support or send feedback | To answer you and improve the product |
What we never receive from checkout: your card number or payment credentials. The payment provider (currently PayPal) or the reseller handles payment; we receive the order result and the details needed to provide the licence.
The toolkit and its optional online features
Repair and diagnostic work is performed locally on the PC. The toolkit does not continuously send repair activity or your personal files to us. Internet access is used only for optional functions that you choose:
- Online activation: if you choose online activation in the app, it sends the purchase email, activation code and that PC’s Request Code to validate and bind the licence. The server derives a machine identifier for the licence record. The activation event may also include the app version/build and boot mode. A failed attempt may be logged with the sanitized email and code entered, its result, and the IP address and time. After activation, the signed licence can be verified locally; the classic Request Code/key or USB activation paths remain available where offered.
- Check for Updates: the check runs only when you ask for it from Help → “Check for Updates…”. It sends the running app version, build and boot mode so the server can compare them with the current release. The server logs the request, result, latest release metadata, IP address and time. If you accept the offered download, the app requests a handoff from
latest.php; the server records the release/file and the app version/build/boot mode. That records a handoff, not a completed download. The app verifies the downloaded file against the server’s SHA-256 before advising you to reopen it; the update is not installed or launched automatically. - Session Report Sharing: sharing is off unless you explicitly choose Share reports. Declining sends no report. You can turn sharing on or off later in Help → “Session Report Sharing…”; turning it off stops future sharing but does not remove a report already uploaded. If you choose to share while offline, a report may be queued locally and retried when a connection is available. The upload uses HTTPS.
Before upload, the app redacts known email addresses, activation codes, Request Codes, BitLocker recovery keys, activation-key file names and Wi-Fi passwords from the shared copy. A report can still include diagnostic details such as Windows/app versions, boot mode, error codes, device or driver names, dates and file paths. It may show a partially masked technician USB licence ID and a USB/device identifier showing only its first and last four characters. The server validates the full Request Code to derive a six-character report key; the full Request Code is not stored as the report filename/index. This is separate from private website event records, which may store an identifier carried in a licensing link as described above.
Reports are stored in restricted private server storage outside the public web root. Only an administrator can view, download or delete them. The current code has no automatic report-expiry period: a report remains until an administrator deletes it or we act on a deletion request. The report endpoint also uses a hashed IP address for short-term rate limiting.
Our website and product-event records
We use our own server-side event logs for page, licensing, update and download events. The logs may include the full IP address and country, page/referrer, device class and—where relevant—the app metadata or licence identifier described above. They are kept in private, access-restricted server storage and are not public downloads. Country is looked up locally from a database on our server.
Some pages also load Cloudflare Web Analytics for aggregate page-performance measurements. Its browser beacon measures page-load performance; Cloudflare’s RUM-beacon documentation states that the beacon does not use cookies or browser storage. Cloudflare also processes the network request as part of delivering that service. See Cloudflare’s Privacy Policy.
Reviews
Only verified owners can write a review: you prove your purchase with the email you bought with, or with your activation key, before the form opens. We read every review before it appears. A published review shows the rating, your text and the name you choose to type—or “Verified owner” if you leave it empty. It does not show your email, key, order reference or IP address. Ask us to remove your review at any time.
Who we share it with
We do not sell or rent your personal information. We share information only with providers needed to operate the service: the payment processor (currently PayPal), the store or reseller that sold your licence, our hosting/CDN provider, and Cloudflare for web security, analytics and human-verification checks where enabled. Product pages may embed videos from YouTube; when an embedded player loads or is used, YouTube/Google may receive connection and browser information under its own terms and privacy policy. Those providers process information under their own policies and/or contractual safeguards; we also disclose information when the law requires it. Some providers may process data outside the United States.
Marketing email
Marketing is optional. If you enter your address in the download-panel signup, we may send the requested repair guide and occasional product news—no more than one or two emails. Each marketing message has a one-click unsubscribe that works immediately. We may still email you about your own purchase, licence or support request because that is part of the service you asked us to provide.
Cookies and local storage
- Essential: activation, checkout and administration pages may use a session cookie to remember the current step and protect forms against cross-site request forgery.
- Your visit-count choice: a small cookie (24 hours) remembers whether you asked us not to count your visits.
- Where you came from: a small cookie (30 days) remembers which link or campaign brought you here so our statistics can attribute the visit.
- Administration only: if you are signed in, cookies may remember the date range selected in the Admin area.
- Browser memory: a page may use session storage to remember that a key was already shown; this stays in your browser and is not sent to our server.
- Other services: PayPal’s checkout, Cloudflare Turnstile on pages where human verification is enabled, and embedded YouTube players may load their own scripts or technologies. Cloudflare Web Analytics’ performance beacon does not use cookies or browser storage, according to Cloudflare.
- We do not intentionally add advertising-network cookies or social-media pixels. Embedded third-party players, payment tools and security checks may load their own technologies as described above; our own server-side statistics and Cloudflare’s performance measurements are described above.
How long we keep it
- Licence and order records: while your licence is active and afterwards as long as needed for support, refunds, accounting, tax or legal obligations.
- General detailed event logs: the main private event log rotates when it reaches about 2.5 MB and keeps one previous log. Aggregate counters are stored separately and may remain longer.
- Download-handoff details: stored in month-based private files. The current code does not apply a fixed automatic time-based expiry to these files; they may remain until manually cleared. Aggregate daily handoff counts are stored separately.
- Session reports: retained until an administrator deletes the report; there is no automatic expiry in the current code.
- Support email: kept while it may be needed to resolve your issue or document the terms of your purchase.
- Marketing email: kept until you unsubscribe or ask us to delete it, subject to any legal/security reason to retain a record of your request.
You can ask us to access, correct or delete your information. We delete it unless we must keep a specific record for legal, tax or fraud-prevention reasons; if so, we will explain that to you.
Keeping it safe
Our site is served over HTTPS. The Admin area is password-protected and restricted. Event logs are access-restricted; session reports are stored outside the public web root; licensing identifiers are used for activation/support; and licence keys are cryptographically signed. No storage system can be guaranteed completely secure, but we use safeguards intended to limit access to authorised personnel.
Your rights
You may ask us to provide a copy of information we hold about you, correct it, delete it, restrict or object to its processing, withdraw consent to future report sharing, or unsubscribe from marketing. Email support@vmtechs.com and we will respond within 30 days. We may need to verify your identity first, for example by matching the email address on your order. If you are in the EEA or UK, you may also complain to your local data-protection authority.
Children
Our software and store are intended for adults and are not directed at children under 16. We do not knowingly collect information from children. If you believe a child has given us their details, email us and we will delete them.
Changes to this policy
If we change how we handle your information, we will update this page and its date. Material changes will also be announced on the product page.
Contact
Product page: vmtechs.com/boot-repair-toolkit