Privacy Policy

Last update: 15 Oct 2026

1. Introduction

This Privacy Policy explains how CheckVIN.eu (“CheckVIN”, “we”, “us”) collects, processes, stores and protects personal data when Users (“you”) access or use our Services, including the purchase and delivery of vehicle information reports (“Reports”).

CheckVIN complies with the General Data Protection Regulation (GDPR) and all applicable EU and Romanian data protection laws.

By using the Website and clicking “Get history report”, you acknowledge that you have read and agree to this Privacy Policy.

2. Data We Collect

We collect and process the following categories of data:

2.1 Data Provided Directly by the User

Email address: for sending you the link to your Report, order and payment emails, a review request after delivery and, if you agreed to it, promotional content.

VIN (Vehicle Identification Number): used to generate the Report and kept with your order record.

Billing details: name and billing address collected through Stripe for invoicing and fraud prevention.

Messages you send us: the content of the contact form, with your email address and, if you add it, the VIN.

2.2 Data Collected Automatically

IP address and the approximate location derived from it (country and city): for security, fraud prevention, abuse detection and rate limiting, to show the Website in your language and prices in your currency and to count visits.

Device and browser information: collected for analytics and service optimization.

Visit information: the page you arrive on, the website that sent you and campaign parameters, recorded at most once an hour to count visits and see where they come from.

Analytics data: via Google Analytics and PostHog, only with your consent (anonymized or pseudonymized where applicable).

Interaction and behavioral data: collected only with your consent, via PostHog (product analytics and feature usage), the Meta Pixel and the OpenAI pixel (ad performance and conversion tracking).

2.3 Data Generated Internally

Generated Reports, stored securely for 30 days.

Event logs (report generation, email delivery, payment confirmation).

Order records (name, email address, VIN, amount, date and invoice details) for order administration, support, refunds and accounting.

3. Purpose and Legal Basis for Processing

CheckVIN processes personal data under the following GDPR legal bases:

3.1 To Perform a Contract (Art. 6(1)(b))

Required to provide the Service you purchase:

Processing VIN to generate the Report
Showing the Report in your browser and emailing you its link
Payment confirmation
Billing detail collection via Stripe
Managing support requests related to the order

3.2 Legitimate Interest (Art. 6(1)(f))

Used where processing is necessary for CheckVIN’s operational and security interests:

Keeping order records for support and refunds
Sending review requests after successful delivery
Fraud prevention, rate limiting and abuse detection via IP logging
Counting visits and where they come from (landing page, referring website, approximate location)
Internal notifications to our team about orders, delivery problems and support requests

Our legitimate interests do not override your fundamental rights and freedoms.

3.3 Consent (Art. 6(1)(a))

Required for:

Receiving promotional emails and newsletter content
Google Analytics, loaded through Google Tag Manager (analytics cookies)
Storing your email in our Brevo newsletter list
Meta Pixel (marketing and retargeting cookies)
PostHog (product analytics, user journeys and session replays)
OpenAI pixel (measuring conversions from our ads)
Optional cookies and tracking technologies

Consent is obtained through:

Cookie banner on first website visit
Disclaimer on newsletter fields:
“By providing your email address, you agree to receive promotional content. You can unsubscribe at any time.”

You can withdraw consent at any time via the unsubscribe link, the cookie settings or by contacting us.

4. How We Use Personal Data

4.1 Service Delivery

Generate Reports using the VIN

4.1.1 Store Report securely for 30 days

4.1.2 Send payment confirmations

4.1.3 Send Report link

4.1.4 Provide support

4.2 Communication

Report delivery emails (mandatory)

4.2.1 Payment confirmation (mandatory)

4.2.2 Review request (after 24 hours)

4.2.3 Newsletter / promotional content (only with consent)

4.3 Analytics & Optimization

4.3.1 Performance analytics

4.3.2 Usage tracking

4.3.3 Fraud detection

4.3.4 Security monitoring

4.4 Legal Obligations

Where required by law, we process billing and transaction data for invoicing, accounting and compliance.

5. Data Sharing and Third-Party Providers

We share data only with trusted service providers essential for delivering our Services:

5.1 Stripe: payment processing (card, Apple Pay, Google Pay, Link), billing details, fraud prevention

5.2 Brevo: email delivery, transactional emails, contact form messages, customer and newsletter lists

5.3 Licensed third-party vehicle data providers: Report generation; they receive the VIN only

5.4 Railway: hosting of the Website, the order system and our Redis database, in the EU (europe-west4 region, the Netherlands)

5.5 Cloudflare: DNS, content delivery and security for the Website (protection against attacks and abuse)

5.6 OpenAI: a large language model that words the Report Summary and translates report text; it receives vehicle data only, never your name, email address or payment details

5.7 Discord: internal notifications to our team about orders, delivery problems and support (may include your email address, the VIN and the approximate location of a visit)

5.8 Google (Google Tag Manager and Google Analytics): website analytics (with consent)

5.9 Meta Platforms Ireland Limited (Meta Pixel): ad tracking, conversion measurement and retargeting (with consent)

5.10 PostHog: product analytics, user behavior insights and service optimization, collected through our subdomain k.checkvin.eu (with consent)

5.11 OpenAI (OpenAI pixel): measuring conversions from our ads (with consent)

Providers that process personal data on our behalf do so under GDPR-compliant Data Processing Agreements (DPAs) or equivalent contractual terms.

6. Data Storage and Retention

6.1 Order Data

6.1.1 Checkout data (VIN, email address, name and billing address) is stored in our Redis database on Railway, in the EU, and deleted automatically within 3 days.

6.1.2 Order records (name, email address, VIN, amount, date and invoice details) are kept for as long as needed for support and refunds and for as long as accounting law requires.

6.2 Report Retention

6.2.1 Reports remain accessible for 30 days.

6.2.2 Permanently deleted after expiry.

6.3 Email in Brevo

Email address kept in our Brevo contact lists (customers and newsletter subscribers) until you unsubscribe or ask us to delete it.

6.4 Logs

Minimal system logs retained for security, rate limiting and fraud prevention.

7. User Rights Under GDPR

Users have the following rights:

7.1 Right to Access

You may request details of the personal data we hold about you.

7.2 Right to Erasure (Right to Be Forgotten)

You may request deletion of:

7.2.1 Your email

7.2.2 Billing info

7.2.3 VIN

7.2.4 All personal data

Note:
Because checkout data and Reports are deleted automatically, in many cases the data will already be erased. Order records and invoices that accounting law requires us to keep are deleted when that period ends.

7.3 Right to Object

You may object to:

7.3.1 Analytics tracking

7.3.2 Review request emails

7.3.3 Newsletter marketing

7.4 Right to Withdraw Consent

You may withdraw consent at any time (for newsletter or marketing cookies).

7.5 Right to Restriction of Processing

We can restrict data processing when required by law.

7.6 Right to Complaint

You may lodge a complaint with your national Data Protection Authority (ANSPDCP in Romania).

8. Data Security

CheckVIN implements strong security measures:

8.1 HTTPS encryption

8.2 Access-restricted storage in our Redis database, in the EU

8.3 Time-limited tokens for accessing Reports

8.4 Limited internal access (“CheckVIN Team only”)

8.5 Secure hosting on Railway, behind Cloudflare

8.6 Strict authentication and access controls

9. Cookies and Tracking

We use:

9.1 Google Analytics, through Google Tag Manager (with consent)

9.2 Necessary cookies and browser storage for language, currency, checkout and security (see the Cookie Policy)

9.3 Marketing cookies (optional / consent-based)

9.4 Meta Pixel and OpenAI pixel (marketing, retargeting and conversion measurement, consent-based)

9.5 PostHog (product analytics, consent-based)

Visitors may manage cookie choices via the cookie banner or browser settings.

10. International Data Transfers

Some providers (e.g., Stripe, Google, Meta, OpenAI, Cloudflare, Discord and Brevo) may process data outside the EU. All transfers comply with GDPR through:

10.1 Standard Contractual Clauses (SCCs)

10.2 Adequacy decisions

10.3 Data Processing Agreements

11. Children’s Privacy

CheckVIN does not knowingly collect or process data from individuals under 16. Use of the Website is restricted to adults.

12. Changes to This Policy

We may update this Policy to reflect legal, operational or service changes. Updates will be posted on this page with a new “Last Updated” date.

13. Contact Information

For privacy-related inquiries or data requests:
Email: info@checkvin.eu