Version 2026-10-12. Effective October 12, 2026. See also the Terms of Use and the Disclaimer.
This notice explains what the CV2X workbench at cv2x.itsroads.com collects about you, why, how long we keep it, and how to ask us to delete it. ITS Roads, LLC ("ITS Roads") operates the site from Falls Church, Virginia, USA.
1. What we collect
| Data | When | Why |
|---|---|---|
| Account fields | When you create an account: email address, password (stored only as a bcrypt hash), name and organization if you give them, the terms version you accepted, and the time and IP address of that acceptance. | To run your account, approve it, contact you about it and show your own RSUs, feeds and projects back to you. |
| IP address and user agent | On every request, including sign-up and sign-in. | Security (rate limits, abuse and intrusion detection, country checks), the free daily limit for anonymous visitors, and understanding which tools are used. |
| Country of your address | Derived from the IP address on every request, using a local copy of the DB-IP country database. No request leaves our server for this lookup. | Sign-up, sign-in and write operations may be limited to the United States and its territories to protect the service from abuse. |
| Visitor cookie id | A random identifier (cv2x_vid) set on your first visit, kept for one year. | To tell one visitor's page views apart from another's in the activity log. It carries no personal information by itself. |
| Activity log | For each page view and API call: time, path, method, response status, duration, the visitor cookie id, your account id if signed in, IP address, country, referrer and user agent. Static files, health checks and live-feed streams are not logged. | Security, debugging, measuring which tools are used, and showing the site manager what an account has done. |
| Named events | Decode, encode, builder export or push, RSU push, feed creation, recording start and stop, simulator export, sign-up and sign-in, with the message type and size but not the message content, plus account id and IP address. | Usage counts, the daily limit, and support. |
| Uploaded packets and messages | Packets you paste into the decoder are processed in memory and not stored (only the event line above is kept). Messages, builder projects, simulator setups and saved RSU records are stored under your account when you choose to save them. | So you can come back to your work. |
| Live feeds and recordings | Messages your equipment forwards to a feed port: decoded fields, position, timestamps and the raw bytes, for the rolling window and for any recording you start, up to the retention you set on the feed. | To show the feed and to keep the recordings you asked for. |
| RSU credentials | SNMP user names and keys you enter for your RSUs. | Stored encrypted and used only to push messages you request to those devices. |
| Feedback | What you type into the feedback form, with any name, email and organization you include, plus IP address and user agent. | To read and answer requests. Entries are also emailed to the site manager. |
2. Cookies and local storage
cv2x_session: a signed, HttpOnly cookie that keeps you signed in for 14 days. Set only when you sign in.cv2x_vid: the random visitor id described above, one year, SameSite=Lax, Secure on HTTPS.cv2x_admin: a short-lived cookie used only by the site manager's console.- Browser local storage holds your theme choice, whether you dismissed the research-use notice, whether you acknowledged the cookie bar, and drafts in some tools. Nothing in local storage is sent to us.
- Google Analytics 4 collects aggregate page statistics (pages viewed, approximate region, browser type) with advertising features and Google signals turned off. It is not used for advertising or cross-site tracking. Map tiles are loaded from OpenStreetMap servers and fonts from Google Fonts; those providers see your IP address when your browser requests those files, under their own privacy policies.
3. Why we process this data
We process the data above to provide the service you asked for, to keep it secure and free of abuse, to meet our legal obligations, and because we have a legitimate interest in understanding how a free research tool is used so we can improve it. We do not profile you, and we do not make automated decisions about you other than rate limits, country checks and the daily free limit.
4. How long we keep it
- Activity log and named events: 180 days, then purged automatically.
- Account fields: until you ask us to delete the account, or until we close it. Deleting an account removes its RSUs, pushes, feeds, recordings, projects, setups, saved messages and log rows. The site manager's audit trail keeps the email address and the action taken.
- Live feed samples: a rolling ten-minute window, and up to the retention you set on the feed (30 days at most) for recordings.
- Feedback entries: until handled and archived.
- Backups: copies of the database may hold deleted data for up to 90 days.
5. No sale of data, and who can see it
We do not sell, rent or trade personal data, and we do not share it with advertisers. Data is visible to ITS Roads staff who run the site, to our hosting and email providers as needed to operate the service, and to authorities when the law requires it. Feeds you mark as public and RSU pins you choose to show on the public map are visible to everyone. Anonymized, aggregated usage figures may be published.
6. Email
Product update emails are opt-in. When you create an account you can tick a box to receive occasional emails from ITS Roads about new tools and changes to this workbench (a few times a year). The box is unticked by default; we record when and from which address you ticked it. You can withdraw consent at any time on your account page or with the unsubscribe link in every such email, and we stop at once. We do not use the list for anything else and we do not share it.
We use your email address to approve or decline your account, to tell you about changes to your account or to these terms, to answer feedback and support requests, and to send security notices. We do not send marketing email from this site. Replies to feedback use the address you gave in the form.
7. Security
Passwords are stored as bcrypt hashes. RSU credentials are encrypted at rest with a server-side key. The site is served over HTTPS. The site manager's console requires an administrator account, a second password check and is limited by address and country. Each account's RSUs, feeds and projects are isolated from other accounts. No system is perfectly secure, so please use a unique password.
8. Your choices and how to request deletion
- You can use the decoder, creator, builder, simulator and wiki without an account.
- You can delete your RSUs, feeds, recordings, projects and setups from the pages where you created them.
- To delete your account, or to ask what we hold about you, email info@itsroads.com from the address on the account. We will act within 30 days and confirm by email.
- You can block or clear cookies in your browser. Without
cv2x_sessionyou cannot stay signed in; withoutcv2x_vidthe site still works and a new id is set on the next visit.
9. Children
The service is for transportation professionals, researchers and students aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, email us and we will delete it.
10. Where data is kept
The service runs on equipment in the United States. If you use it from outside the United States, your data is transferred to and processed in the United States.
11. Changes to this notice
We may update this notice by posting a new version here with a new version date. Material changes will also be announced on the site or by email to account holders.
12. Contact
ITS Roads, LLC
200 Little Falls Street, Suite 304
Falls Church, VA 22046
info@itsroads.com
IP Geolocation by DB-IP (db-ip.com), CC BY 4.0. dbip.csv.gz built 2026-10-12 v4=362122 v6=348712.