Privacy Policy

1. Who We Are

VinSnap (the website at vinsnap.net, the VinSnap mobile app and related services, together the "Service") is operated by VinSnap AI, Inc., a Delaware corporation ("VinSnap", "we", "us"). VinSnap AI, Inc. is the controller of the personal data described in this policy.

Postal address: [FOUNDER TO CONFIRM: registered or business address of VinSnap AI, Inc.]

Privacy contact: support@vinsnap.net

[FOUNDER TO CONFIRM: whether VinSnap has an establishment in the EU (the founders work from Spain) or must appoint an EU representative under Article 27 GDPR; add the name and address here.]

If you use VinSnap's workshop features to keep records about your own customers, you decide what that customer data is used for, and we process it on your behalf.

2. Information We Collect

2.1 Information you give us

• Account: email address, password (held by our sign-in providers as a hash, never in plain text), and profile details you add.
• Vehicles: VINs, year, make, model, mileage, nicknames, and the vehicle data we look up for you (specifications, recalls, maintenance schedules).
• Service history: service dates, costs, providers, notes, reminders, and receipt images you upload.
• AI Mechanic: the messages you write and the photos you attach (see Section 4).
• Community: posts, comments, photos, likes, follows, your public profile, and reports you file.
• Workshop (business) accounts: business profile, customers, vehicles, jobs, photos, estimates and invoices.
• Payments: on the website, you enter card details with Stripe and they never reach our servers; we receive your plan, status and payment identifiers. In the iOS app, purchases are made with Apple, and we receive your subscription status through RevenueCat.
• Messages to us: support emails, demo bookings and feedback.

2.2 Information collected automatically

• Usage records: which features you use and how often (for example VIN decodes and parts searches), used to apply plan limits and to understand how the Service is used.
• Technical data: IP address, browser or device type, and request logs created when your device talks to our servers.
• Website analytics and error reports: see Section 10.

We do not collect precise location. The mobile app does not use the microphone.

3. How We Use It and Our Legal Bases

If you are in the EU, the EEA, the UK or Switzerland, we rely on the following legal bases under the GDPR:

Purpose	Legal basis
Providing the Service: account, VIN decoding, garage, service history, reminders, parts search, community, workshop tools	Performance of our contract with you (Art. 6(1)(b))
Payments, subscriptions and plan limits	Contract (Art. 6(1)(b))
Sending your messages, photos, receipts or estimate requests to OpenAI in the AI features	Your consent (Art. 6(1)(a)), which you can withdraw at any time
Automated screening of community posts and comments, handling reports, and preventing abuse, fraud and security incidents	Our legitimate interest in keeping the Service and its users safe (Art. 6(1)(f))
Service emails (account, recall alerts you set up, invoices) and product emails about features you use	Contract; our legitimate interest for product emails, each of which has an unsubscribe link
Website analytics and advertising measurement cookies	Your consent through the cookie banner (Art. 6(1)(a))
Improving the Service using usage records and error reports	Legitimate interest (Art. 6(1)(f))
Keeping invoices and tax records; responding to lawful requests	Legal obligation (Art. 6(1)(c))

We do not make decisions with legal or similarly significant effects about you based solely on automated processing. Automated community screening can block a post; if you think that was a mistake, contact us and a person will review it.

4. AI Features (OpenAI)

Some features use OpenAI (United States) as our AI provider. In the mobile app, the features in the table below ask for your permission first and send nothing to OpenAI until you tap Allow. You can withdraw permission at any time in Settings → AI data sharing, and the rest of the app keeps working.

Feature	What is sent to OpenAI	What VinSnap keeps
AI Mechanic (assistant)	Your message, any photo you attach, your recent conversation and, if you select a vehicle, its VIN, year, make, model, trim, nickname, mileage, recalls, maintenance schedule and your most recent logged service records	The text of your conversation, so the assistant can remember context. A photo is recorded only as "[sent a photo]"; the image is not saved with your conversation.
Receipt reading	Your receipt images (uploaded to our image host, Cloudinary, and passed to OpenAI by link)	The receipt images and the details read from them, saved to your service history
AI Estimate (workshop accounts)	The job description and the vehicle's year, make, model and VIN	A log of each request and the draft estimate returned

OpenAI is also used in these background functions, which are part of how the Service works rather than optional features:

• Community safety: the text and images of community posts and comments are checked with OpenAI's moderation service before they are published (see Section 6).
• VIN decoding and parts search: the VIN, the decoded vehicle specifications and your parts search terms may be sent to OpenAI to normalise vehicle data and match the right part categories. Your account details are not included.
• Website chat assistant: messages you type into the chat on vinsnap.net. [FOUNDER TO CONFIRM: remove this item if the website chatbot is not live.]

Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models, and OpenAI may keep it for up to 30 days to monitor for abuse. [FOUNDER TO CONFIRM: that the VinSnap OpenAI organisation has not opted in to sharing API data with OpenAI, and whether OpenAI's data processing addendum has been executed.]

AI output can be wrong. Do not rely on it for safety-critical repairs; ask a qualified mechanic. Please do not include other people's faces, number plates or documents in photos you send.

5. Service Providers (Processors)

We do not sell your personal information. We share it only with the providers that run parts of the Service for us, and only as needed for the purposes below:

Provider	What it does and what it receives
OpenAI (US)	AI Mechanic messages, photos and vehicle context; receipt images; AI Estimate descriptions and vehicle details; community post and comment text and images for automated moderation; VINs, decoded vehicle specifications and parts search terms for normalisation (see Section 4)
Supabase	Our main database (account, vehicle, service, community and workshop data), mobile app sign-in, and storage for community photos. [FOUNDER TO CONFIRM: database region; the project's connection host indicates AWS eu-central-1, Frankfurt.]
Netlify (US)	Website hosting and account sign-in for the website and the app (Netlify Identity: email address and password hash)
Hostinger	The virtual server that runs our backend automation (n8n), which processes app and website requests and the data in them
Cloudinary (US)	Storage of receipt images and workshop job photos and documents
Apple	In-app purchases in the iOS app. Apple handles the payment; we do not receive your card details.
RevenueCat (US)	Your app user ID and App Store purchase and subscription history, to confirm what you have bought
Stripe (US)	Website payments and subscriptions: email address, payment details (entered directly with Stripe) and billing history
VehicleDatabases (US) and Vincario	The VIN, to decode it and, for VehicleDatabases, to fetch recalls and maintenance schedules. US and Canadian VINs go to VehicleDatabases; other VINs go to Vincario.
NHTSA (US Department of Transportation)	The VIN, sent to NHTSA's public vPIC decoding service for some decodes
Apify, running a TecDoc parts catalogue integration	Vehicle identifiers and part numbers, for parts search and cross-reference. Your account details are not included.
Zoho (Zoho Mail)	Sending emails to you: your email address and the content of the email
Telegram	Internal alerts to our team: community reports (including the reported content and the profile it belongs to), system error alerts, and demo booking notifications
Google	Website analytics and advertising measurement (Google Analytics, Google Ads), only if you accept cookies; Google Calendar and Google Sheets for demo bookings and business outreach lists
Sentry	Error reports from the website app (technical details of the error, browser, and your account ID if you are signed in), sent to Sentry's EU region

[FOUNDER TO CONFIRM: that each provider's data processing terms have been accepted or signed.]

We may also disclose information when the law requires it, to protect the rights and safety of our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your data.

6. Community Content

Posts, comments, photos and your community profile are visible to other VinSnap users, and community photos are stored at links that anyone who has the link can open. Do not post anything you want to keep private.

Before a post or comment is published it is screened automatically, first by our own word filter and then by OpenAI's moderation service. Content that fails screening is rejected; if the screening service is unavailable, the content may be held back for review. When you report content or a profile, the report and the reported content are sent to our moderators through Telegram. Content reported by several different users can be hidden automatically until it is reviewed. See the Community Guidelines.

7. Data Retention

• Account data (profile, vehicles, service history, reminders, community content, AI Mechanic conversations) is kept until you delete it or delete your account.
• Backups of our systems may still contain deleted data until they are overwritten, within 30 days. [FOUNDER TO CONFIRM: that this matches the Supabase plan's backup retention and the Hostinger server snapshot retention, and that no manually downloaded backups are kept longer.]
• Invoices, payment and tax records, including invoices created in workshop accounts, are kept for as long as the law requires. [FOUNDER TO CONFIRM: the retention period that applies.]
• Backend request logs (n8n execution history) can contain the content of requests, including AI Mechanic photos. [FOUNDER TO CONFIRM: the n8n execution-data pruning setting, and state that period here.]
• OpenAI may keep API data for up to 30 days (see Section 4). Other providers keep data according to their own terms.

8. Deleting Your Account

You can delete your account at any time:

• In the app: Settings → Delete Account.
• By email: write to support@vinsnap.net from the address on your account.

Deleting your account removes your account and the data linked to it from our database, including your vehicles, service history, reminders, community posts and comments, and AI Mechanic conversations, subject to the backup and legal retention described in Section 7.

[FOUNDER TO CONFIRM before publishing: that account deletion also removes AI Mechanic conversations, community photos in storage, and receipt and job images stored with Cloudinary. As of September 14, 2026, the deletion workflow in our repository does not remove the Cloudinary images.]

Subscriptions: an App Store subscription is billed by Apple and is managed and cancelled in your Apple Account settings; deleting your VinSnap account does not cancel it. A subscription bought on vinsnap.net is cancelled when you delete your account.

9. Your Rights

Depending on where you live, and in all cases if you are in the EU, EEA, UK or Switzerland, you have the right to:

• Access the personal data we hold about you and get a copy.
• Correct inaccurate data; most of it you can edit in the app.
• Delete your data (see Section 8).
• Data portability: receive your data in a portable format. The app's Export Data option exports your vehicles, service history and reminders.
• Restrict processing, or object to processing based on our legitimate interests.
• Withdraw consent at any time, for example in Settings → AI data sharing or through the cookie banner. This does not affect processing that happened before.
• Complain to a data protection authority, in particular in the country where you live or work. In Spain this is the Agencia Española de Protección de Datos (aepd.es).

California and other US states: you can ask what personal information we collect, use and disclose, and ask us to correct or delete it. We do not sell personal information. We will not treat you differently for exercising your rights.

To exercise any right, email support@vinsnap.net. We may need to confirm your identity. We respond within one month, or within the period your local law requires.

10. Cookies, Analytics and the Mobile App

Website: we use essential browser storage for sign-in and preferences. Google Analytics and Google Ads measurement run in consent mode and only store analytics or advertising cookies if you accept them in the cookie banner. The website app also sends error reports to Sentry.

Mobile app: the app contains no advertising and no third-party analytics SDK, and it does not track you across other companies' apps or websites.

11. Security

Data is encrypted in transit (HTTPS). Access to our systems is limited to the people who need it to run the Service, and requests for account data require you to be signed in. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the authorities where the law requires it.

12. Age Requirement

VinSnap is not intended for anyone under 18, and you must be at least 18 to create an account. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. International Data Transfers

VinSnap AI, Inc. is a US company, and several of our providers (Section 5) are in the United States, so your data may be processed outside your country, including outside the EU/EEA. Where data from the EU/EEA, UK or Switzerland goes to a country without an adequacy decision, we rely on the EU–US Data Privacy Framework where the recipient is certified under it, or on the Standard Contractual Clauses in the provider's data processing terms. [FOUNDER TO CONFIRM: the transfer mechanism for each US provider (OpenAI, Netlify, Stripe, RevenueCat, Cloudinary, Google, Apify, VehicleDatabases) before publishing.]

14. Changes to This Policy

We may update this policy. We will change the "Last Updated" date and, for material changes, tell you by email or in the Service. If a change affects what the AI features send to OpenAI, the app will ask for your permission again.

15. Contact Us

VinSnap AI, Inc.
[FOUNDER TO CONFIRM: postal address]
Email: support@vinsnap.net