Privacy policy

Who is responsible

The data controller for vingear.com is:

VINs you look up

When you decode a VIN, we save the VIN with the vehicle data NHTSA returns (specs and recalls), so the page loads fast next time. A VIN describes a vehicle, not a person. We do not link the VINs you look up to you, and we never collect or show owner names, addresses or plate numbers.

History report orders

When you buy a vehicle history report, we keep your email address, the VIN, the order number, the amount, the payment status, Stripe's payment reference and the report data, so we can deliver the report, send you the link, handle refunds and keep the accounting records the law requires. We keep orders for 6 years after the purchase (tax rules), then delete them. Legal basis: the contract with you and our legal duties. Stripe handles the card payment; we never see your card details. We send our data provider only the VIN, never your email or anything else about you.

Server and security logs

Like every website, our server records technical data for each visit: IP address, date and time, page, browser (user agent) and referring page. We use it to keep the site running and safe from abuse. Normal server logs are deleted after about 14 days. Requests our bot protection blocks are kept in a separate log, with the IP address, user agent and page, for 14 days. Legal basis: our legitimate interest in running a secure website.

Contact form and email

If you write to us, we keep your name, email address and message so we can answer, plus a one-way code made from your IP address (not the IP itself) to stop spam. We delete messages when they are no longer needed, and at the latest after 2 years. Legal basis: answering your request.

Cookies

• Essential cookies (always on): a session cookie and a security token that protect forms, and vg_consent, which remembers your cookie choice for 6 months.
• Statistics cookies (only if you click "Accept all cookies"): if we use an analytics tool such as Google Analytics, it sets cookies to count visits and see which pages are used. Without your consent these tools do not run.

You can change your choice any time with Cookie settings (also at the bottom of every page).

Who processes data for us

• Hetzner Online hosts the website on servers in the EU.
• Brevo sends our emails (for example, replies to contact messages).
• Cloudflare Turnstile may check the contact form for bots; Cloudflare sees your IP address and browser data for that check.
• Google (analytics), only if you accept statistics cookies.
• Stripe processes card payments for history reports (Stripe's own privacy policy applies to the payment details you give it).
• CarsXE supplies the vehicle history records; it receives the VIN only.

Vehicle data comes from NHTSA. We send NHTSA only the VIN (or make, model and year), never anything about you. Some of these providers may process data outside the EU under standard contractual clauses or other approved safeguards.

We do not sell or share your personal information for money or for targeted advertising.

Your rights

Under the GDPR and UK GDPR you can ask for a copy of your data, its correction or deletion, limit or object to its use, and data portability. Residents of California and other U.S. states with privacy laws can ask what we hold about them and ask us to delete it; we will not treat you differently for asking. Email hello@vingear.com or use the contact form. You can also complain to your data protection authority.

Children

VinGear is not aimed at children under 16, and we do not knowingly collect their data.

Changes

When we change this policy, we update the date at the top of this page.