Privacy Policy
Last updated: 2026-08-13
This Privacy Policy explains what personal data CarVinVin processes when you use this website, why, and the rights you have. We keep data collection to a minimum: there are no user accounts, and no advertising or measurement cookies are set unless you accept them.
Who is responsible
Two companies are involved, each for a different part. "SHPATIK STUDIO" S.R.L. (Moldova) operates this website and is the controller for the free VIN check and the site itself. EVIAR TECHNOLOGIES (United States) is the seller of the paid report and is the controller for purchase and payment data. For any question about your data or this policy, contact us at privacy@carvinvin.com and we will route it to the right one.
What data we process
We process: (1) basic technical and usage data your browser sends automatically (such as your IP address, approximate country, device and browser type, and the pages you visit), collected through privacy-friendly analytics; and (2) any Vehicle Identification Number (VIN) you choose to enter to run a check. The free check needs no account and no email address. If you buy a report, we also process the email address you give at checkout, so that we can send you the report and your receipt — see “Email addresses” below. Because we run no database of our own, the VIN you bought and a small counter of how many AI questions you have used are stored on the Stripe checkout session for that purchase, alongside the email address you paid with. We never see or store your card number. When you open a paid report, we set a signed cookie on your device (its name begins with vc_rg_) which proves only that this browser may open the report for that VIN.
Email addresses
If you buy a report, we process the email address you enter at checkout so we can send you the link to your report, your receipt and, where it applies, notice of a refund. We do this because it is necessary to perform our contract with you (Art. 6(1)(b) GDPR), not on the basis of consent: without an address we cannot deliver what you paid for. The message is sent by our email provider Brevo (Sendinblue SAS, France), acting as our processor within the EU, and the address itself is held on the Stripe checkout session for your purchase. We use it for that purchase and for answering your questions about it. We never sell it, and we do not send you marketing.
Payments
When you buy a vehicle-history report, payment is handled by Stripe, our payment processor. Stripe collects the details it needs to process your payment — your email address, card details and billing address (used to calculate any VAT due) — directly from you; we never see or store your card number. This data may be processed outside the European Economic Area, including in the United States, under Stripe's own data-protection safeguards. See Stripe's privacy notice at stripe.com/privacy for details.
Analytics
We use Vercel Web Analytics to understand aggregate traffic. It is cookieless, sets no persistent identifier, and does not track you across other websites. It processes your IP address transiently to derive coarse, anonymous statistics; we do not use it to identify you. Separately, we may use Google Analytics and Google Ads measurement to see which pages and adverts lead to a purchase. Those set cookies and share data with Google LLC in the United States, so they load ONLY after you choose "Accept" in the cookie banner. If you choose "Reject", or if no banner appears, no Google tag is loaded at all. You can change your mind at any time by deleting the vc_consent cookie in your browser.
VIN lookups
When you enter a VIN, we send it to the public NHTSA vPIC service (operated by the United States government) to decode the vehicle, and we may query NHTSA records for safety recalls. If you buy a full history report, we also send that VIN to ClearVin (United States), the Approved NMVTIS Data Provider that supplies the report. ClearVin decides for itself how it handles the lookups it receives and carries its own legal duties for the records it holds, so it acts as an independent controller in its own right, not as our processor. We send it the VIN and nothing else — never your email address, your name or any payment detail. A VIN can, in some cases, relate to an identifiable person, so we treat it as personal data and never store it alongside your identity.
AI summary and chat
Your report includes an AI risk summary and, after purchase, a short AI chat about that vehicle. To produce them we send the vehicle history data and the questions you type to Anthropic PBC (United States), acting as our processor. Your questions are not used to train AI models. We do not keep the conversation on our servers: it is stored only in your browser, so it is not visible in another browser, on another device, or in a private window, and clearing your browser data deletes it. AI answers are guidance, not a guarantee.
Legal basis
We rely on our legitimate interest (Art. 6(1)(f) GDPR) in operating and securing the website and understanding aggregate usage, and on the necessity of processing your VIN to perform the lookup you asked for (Art. 6(1)(b)/(f)). Sending your VIN to a service outside the EU is necessary to deliver that requested lookup (Art. 49(1)(b)).
International transfers
Some of the providers and recipients involved are located outside the European Economic Area, including in the United States: our hosting and analytics provider (Vercel Inc.), the AI provider that generates your report summary and chat answers (Anthropic PBC), the vehicle-history provider your VIN is sent to when you buy a report (ClearVin), our payment provider (Stripe, Inc.), and the NHTSA vPIC service. ClearVin and Stripe act as independent controllers in their own right rather than as our processors, and publish their own privacy notices. These transfers happen only as needed to run the site, take your payment and deliver the result you asked for, and are covered by appropriate safeguards — the European Commission's Standard Contractual Clauses and, where applicable, the provider's certification under the EU–US Data Privacy Framework. You can request a copy of the safeguards by contacting us.
How long we keep data
We keep no personal profile of you and run no database of our own. Analytics data is retained only in aggregate. A VIN you enter on the free check is used to fetch your result and is not kept by us afterwards. A purchase is different: the record of it lives with Stripe. The checkout session — the VIN, the email address you paid with, the AI question counters and the payment itself — is retained by Stripe under its own rules, and we keep the payment records that tax and accounting law requires us to keep, which generally means several years. The link in your report email stops working after 7 days, and re-opening a report by email stops working 60 days after the purchase. Emails you send us are kept for as long as we need them to deal with your question and to show how we dealt with it.
Your rights
Under the GDPR you have the right to access, rectify, erase and restrict processing of your personal data, to object to processing, and to data portability. To exercise any right, email us at privacy@carvinvin.com. You also have the right to lodge a complaint with a data protection supervisory authority in your country.
Changes to this policy
We may update this policy as the service evolves — for example when the paid vehicle-history report launches. The date below shows when it was last changed.
Contact
Questions about your data or this policy? Email privacy@carvinvin.com.
This notice is provided in good faith for transparency. It is not legal advice.