Thanks for taking the time to research this and put it together! I've been working on something similar for some time now and have been getting feedback from several manufacturers directly including 70mai, Escort/Cobra/Cedar, and Botslab. For Cedar specifically,
I posted about it here and
here's their official response.
Here's the discussion with 70mai.
On 70mai: I reached out to their team directly. A few things they confirmed: US user data is stored on AWS servers in the US, and from a data minimization standpoint they say they only collect email/phone for login and crash logs/analytics that are not linked to your identity. They also stated they don't log GPS location, only IP address (used for localization like marketing language targeting).
The part I couldn't get a clear answer on is the most important one: if the Chinese government issued a lawful request for overseas user data, would 70mai be legally permitted to refuse, and would they be allowed to notify affected users? They told me directly that their legal team had ever encountered or worked through that scenario, so there was no definitive answer. Given that China's National Intelligence Law exists, "we've never been asked" is not the same as "we could say no." Worth factoring into your placement for them.
On Escort/Cedar: I also heard back from them with a fairly detailed response. A few clarifications worth noting:
The policy language about supplementing your data with Facebook, Instagram, and Google data: Cedar confirmed they do not do this. They acknowledged the language needs to be updated.
Location data is associated with your user ID during active app use, but location data you contribute for alerts is stored anonymized, not linked back to your account.
The blood type, allergies, and medications fields: policy language for possible useful features, those fields are not active in Drive Smarter.
The 10-year retention window: Cedar acknowledged this is broader than what they actually do in practice and said a full policy review is underway.
They are not currently subject to CCPA and there is no opt-out mechanism beyond full account deletion.
The gap between what the policy says and what they say they actually do is worth flagging. A policy is what's legally binding, not what a CS rep shares on forums. That said, the willingness to engage and acknowledge the discrepancies is notable. I'd keep them in Tier 4 rather than 5, but would revisit once the updated policy is actually published.
Blackvue I haven't checked in with directly.