Privacy Policy

1. Important Information and Who We Are

Purpose of This Privacy Notice

This privacy notice will inform you as to how VinSpectorAI looks after your data and tell you about your privacy rights. If you object to anything in this Privacy Policy, or otherwise do not understand or agree to be bound by the terms of this Privacy Policy, do not use VinSpectorAI's services. By using VinSpectorAI's services, you agree to be bound by the terms of this Privacy Policy.

Our services are not directed at, and are not intended for use by, anyone under the age of 16. See Section 12, Children's Privacy, below.

This Privacy Policy is incorporated into and is part of the VinSpectorAI Terms of Service. For the purposes of this Privacy Policy, "VinSpectorAI," "we," "us," or "our" means VinSpectorAI and its affiliates, related entities, subsidiaries, investors, owners, members, shareholders, officers, directors, employees, agents, representatives, and assigns.

Changes to the Privacy Notice

If our Privacy Policy changes, we will post the changes to our site with the date of revision above. Your continued use of our site after a revision constitutes your agreement with the revised Privacy Policy. Material changes (for example, a new category of data we collect, or a new sub-processor with access to personal data) will be highlighted at the top of this page for at least 30 days after the change takes effect.

2. The Data We Collect About You

Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you:

• Identity Data — first name, last name, and username.
• Contact Data — email address and, if provided, telephone number.
• Financial Data — processed and stored by Stripe on our behalf — VinSpectorAI never stores full payment card numbers.
• Transaction Data — details of credits purchased, subscription status, and reports generated.
• Vehicle/VIN Data — VINs and vehicle details you submit to generate a report, and the report results themselves.
• Technical Data — IP address, login data, browser type and version, time zone, operating system, and platform.
• Usage Data — information about how you use our websites and services (pages visited, features used).
• Marketing and Communications Data — your preferences in receiving marketing and your communication preferences, including recall-watch alerts you opt into.

3. How Is Your Data Collected?

Direct Interactions

You give us your data by filling in forms or by corresponding with us. This includes personal data you provide when you create an account, contact us, purchase a report or subscription, or opt into recall-watch alerts.

Automated Technologies or Interactions

As you interact with our websites, we automatically collect Technical Data about your equipment and browsing actions using cookies and server logs — see Section 6, Cookies and Tracking Technologies.

Third Parties or Publicly Available Sources

Vehicle history data in your reports is sourced from ClearVIN and, for recall data, the National Highway Traffic Safety Administration's (NHTSA) public API — neither source involves us sending them your personal identity data, only the VIN you looked up.

4. How We Use Your Data

We will only use your personal data when the law allows us to. Most commonly, we use your personal data in the following circumstances:

• To create and administer your account, and to deliver the vehicle history reports and AI-generated insights you request.
• To process payments and manage your subscription or credit balance.
• To send transactional emails (report delivery, receipts) and, if you opt in, recall-watch alerts for vehicles you're tracking.
• To comply with a legal or regulatory obligation, including tax and financial recordkeeping.
• To detect, investigate, and prevent fraud or abuse of our services.
• To improve our services, based on aggregated or anonymized usage patterns.

5. Purposes for Which We Will Use Your Personal Data

6. Cookies and Tracking Technologies

When you first visit VinSpectorAI, a cookie banner lets you accept or reject non-essential cookies. Only Strictly Necessary cookies are set before you make a choice.

You can change your cookie choice at any time from the cookie settings link in our site footer, or by clearing cookies in your browser. You can also set your browser to refuse all cookies, but some parts of this website may become inaccessible.

Third-Party Links

Our websites may include links to third-party websites, plug-ins and applications (for example, a dealer's website). We do not control these third-party websites and are not responsible for their privacy practices.

7. AI Processing & International Data Transfers

To generate the plain-English insights in your vehicle report, VinSpectorAI sends the VIN and vehicle report data you submit to DeepSeek, a third-party AI provider. Some of DeepSeek's infrastructure is located in China, a country for which the European Commission has not issued an adequacy decision, and for which standard contractual safeguards do not straightforwardly apply. Because of this, our lawful basis for this specific international transfer is your explicit consent (GDPR Article 49(1)(a)), which we collect as a separate, specifically-worded checkbox when you create an account — distinct from your general acceptance of our Terms of Service and Privacy Policy. You can withdraw this consent at any time by deleting your account (Section 11); future report requests would then be generated without DeepSeek, using our fallback (non-AI) analysis instead.

We also use Google Gemini internally to help draft general website and blog content. Gemini is not used to process your personal data or vehicle report data, and is not part of this consent.

Our Sub-Processors

These are the third parties who process personal data on our behalf as part of operating VinSpectorAI:

Every sub-processor is bound by a data processing agreement limiting them to using your data only to provide their service to us, and requiring appropriate security measures.

8. Information Sharing and Disclosure

We do not sell your personal information. We share it with third parties only in the following circumstances:

1. With the sub-processors listed in Section 7, so they can provide the service on our behalf (payments, hosting, AI analysis, email delivery, analytics).
2. When we have your permission or pursuant to your request;
3. In response to subpoenas, court orders, or other valid legal process;
4. To establish or exercise our legal rights or defend against claims;
5. If we believe disclosure is necessary to protect the rights, property, or safety of VinSpectorAI, our users, or the public (for example, to prevent fraud).

9. Data Storage and Retention

We retain your account data for as long as your account is active. If you delete your account (Section 11), we permanently erase your profile, garage, referral, and activity data, your saved reports list, and any recall watches, and we delete your login credentials.

We retain the underlying vehicle history report documents and payment/transaction records even after account deletion, as required for tax, accounting, and fraud-prevention purposes (GDPR Art. 17(3)(b) — compliance with a legal obligation). These records are kept only as long as the applicable law requires and are not linked back to a deleted account's login.

10. Confidentiality and Security

We use TLS/SSL encryption when transmitting personal information, including financial and other sensitive data. Your data is stored on infrastructure operated by our sub-processors (Section 7), who maintain their own industry-standard security certifications. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Security Vulnerability Reports

If you believe you've found a security vulnerability in our services, please report it responsibly — see /.well-known/security.txt for how to reach us.

Data Breach Notification

If a breach of security systems compromises your personal data, we will notify affected users and, where legally required, relevant supervisory authorities, without undue delay and in line with applicable law (for example, within 72 hours of becoming aware, under GDPR Art. 33).

11. Your Privacy Rights

If You Are in the EU/UK (GDPR / UK GDPR)

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erasure of your data (“right to be forgotten”).
• Restrict or object to certain processing.
• Data portability — receive your data in a machine-readable format.
• Withdraw consent at any time, where processing is based on consent (this won't affect processing that already happened).
• Lodge a complaint with your local data protection supervisory authority.

If You Are a California Resident (CCPA/CPRA)

You have the right to:

• Know what personal information we collect, use, and disclose.
• Delete personal information we hold about you.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information — see Section 12, we do not sell personal information.
• Non-discrimination for exercising any of these rights.

How to Exercise Your Rights

Self-service: signed-in users can download a full copy of their data or permanently delete their account at any time from My Account. For any other request (access, correction, restriction, or a general question), submit it through our Privacy Request form or email contact@vinspectorai.com. We verify your identity before acting on a request and respond within 30 days (GDPR) or 45 days (CCPA).

12. Do Not Sell or Share My Personal Information

VinSpectorAI does not sell personal information for money. Our use of analytics cookies (Section 6) could be considered "sharing" for cross-context behavioral advertising under the CPRA. You can opt out at any time by rejecting Analytics cookies in the cookie banner, or by submitting our Do Not Sell/Share request form. We also automatically honor the Global Privacy Control (GPC) browser signal — if your browser sends it, we treat Analytics and Marketing cookies as rejected automatically, with no action needed from you.

13. Children's Privacy

VinSpectorAI's services are not directed at, and are not intended for use by, anyone under the age of 16. We do not knowingly collect personal data from anyone under 16. If you are a parent or guardian and believe your child has provided us with personal data, contact us at contact@vinspectorai.com and we will delete it promptly.