Privacy Policy

1. Who We Are

VinSnap (the website at vinsnap.net, the VinSnap mobile app and related services, together the "Service") is operated by VinSnap AI, Inc., a Delaware corporation ("VinSnap", "we", "us"). VinSnap AI, Inc. is the controller of the personal data described in this policy.

Postal address: 1111B S Governors Ave #87677, Dover, DE 19904, United States

Contact: hello@vinsnap.net (privacy questions too), or Settings → Contact Support in the app

Where we operate: VinSnap AI, Inc. is based in the United States and offers the Service worldwide. Wherever you live, you have the rights described in Section 11, and you can use them by contacting us at hello@vinsnap.net.

If you use VinSnap's workshop features to keep records about your own customers, you decide what that customer data is used for, and we process it on your behalf.

2. Information We Collect

2.1 Information you give us

• Account: email address, password (held by our sign-in providers as a hash, never in plain text), and profile details you add.
• Vehicles: VINs, year, make, model, mileage, nicknames, and the vehicle data we look up for you (specifications, recalls, maintenance schedules).
• Service history: service dates, costs, providers, notes, reminders, and receipt images you upload.
• AI features: the messages you write to the AI Mechanic, the photos you attach, and the photos you send to the warning-light and quote checks (see Section 4).
• Parts searches: the car and the part you search for, kept as your search history until you delete it or your account. For genuine part numbers we also count which car you looked up each day, to apply your plan's monthly allowance.
• Shared Vehicle Passport links: the sections you choose to share and how often your link is viewed (see Section 7).
• Community: posts, comments, photos, likes, follows, your public profile, and reports you file.
• Workshop (business) accounts: business profile, customers, vehicles, jobs, photos, estimates and invoices.
• Payments: on the website, you enter card details with Stripe and they never reach our servers; we receive your plan, status and payment identifiers. In the iOS app, purchases are made with Apple, and we receive your subscription status through RevenueCat.
• Messages to us: support emails, demo bookings and feedback.

2.2 Information collected automatically

• Usage records: which features you use and how often (for example VIN decodes and parts searches), used to apply plan limits and to understand how the Service is used.
• Technical data: IP address, browser or device type, and request logs created when your device talks to our servers.
• Mobile app: if you allow notifications, a push token for your device; and, each time the app starts, an update check that sends your device's operating system, the app version and a random installation ID to Expo (see Section 5).
• Website analytics and error reports: see Section 12.

We do not collect precise location. The mobile app does not use the microphone.

3. How We Use It and Our Legal Bases

If you are in the EU, the EEA, the UK or Switzerland, we rely on the following legal bases under the GDPR:

Purpose	Legal basis
Providing the Service: account, VIN decoding, garage, service history, reminders, parts search, community, workshop tools	Performance of our contract with you (Art. 6(1)(b))
Payments, subscriptions and plan limits	Contract (Art. 6(1)(b))
Sending your messages, photos, receipts or estimate requests to OpenAI in the AI features	Your consent (Art. 6(1)(a)), which you can withdraw at any time
Automated screening of community posts and comments, handling reports, and preventing abuse, fraud and security incidents	Our legitimate interest in keeping the Service and its users safe (Art. 6(1)(f))
Service emails (account, recall alerts you set up, invoices) and product emails about features you use	Contract; our legitimate interest for product emails, each of which has an unsubscribe link
Website analytics and advertising measurement cookies	Your consent through the cookie banner (Art. 6(1)(a))
Improving the Service using usage records and error reports	Legitimate interest (Art. 6(1)(f))
Keeping invoices and tax records; responding to lawful requests	Legal obligation (Art. 6(1)(c))

We do not make decisions with legal or similarly significant effects about you based solely on automated processing. Automated community screening can block a post; if you think that was a mistake, contact us and a person will review it.

4. AI Features (OpenAI)

Some features use OpenAI (United States) as our AI provider. In the mobile app, the features in the table below ask for your permission first and send nothing to OpenAI until you tap Allow. You can withdraw permission at any time in Settings → AI data sharing, and the rest of the app keeps working.

Feature	What is sent to OpenAI	What VinSnap keeps
AI Mechanic (assistant)	Your message, any photo you attach, your recent conversation and, if you select a vehicle, its VIN, year, make, model, trim, nickname, mileage, recalls, maintenance schedule and your most recent logged service records	The text of your conversation, so the assistant can remember context. A photo is recorded only as "[sent a photo]"; the image is not saved with your conversation.
Receipt reading	Your receipt images (uploaded to our image host, Cloudinary, and passed to OpenAI by link)	The receipt images and the details read from them, saved to your service history
Warning light (app)	The dashboard photo you take or pick and, if you choose a car, its year, make and model	Nothing from the photo. The photo is sent directly and is not stored by VinSnap.
Is this quote fair? (app)	The photo of the garage quote and, if you choose a car, its year, make and model	The check result, so you can see it again. The photo is not stored unless you later attach it to a community post.
AI Estimate (workshop accounts)	The job description and the vehicle's year, make, model and VIN	A log of each request and the draft estimate returned

OpenAI is also used in these background functions, which are part of how the Service works rather than optional features:

• Community safety: the text and images of community posts and comments are checked with OpenAI's moderation service before they are published (see Section 6).
• VIN decoding and parts search: the VIN, the decoded vehicle specifications and your parts search terms may be sent to OpenAI to normalise vehicle data and match the right part categories. Your account details are not included.
• Website chat assistant: messages you type into the chat on vinsnap.net.

Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models, and OpenAI may keep it for up to 30 days to monitor for abuse.

AI output can be wrong. Do not rely on it for safety-critical repairs; ask a qualified mechanic. Please do not include other people's faces, number plates or documents in photos you send.

5. Service Providers (Processors)

We do not sell your personal information. We share it only with the providers that run parts of the Service for us, and only as needed for the purposes below:

Provider	What it does and what it receives
OpenAI (US)	AI Mechanic messages, photos and vehicle context; receipt images; AI Estimate descriptions and vehicle details; community post and comment text and images for automated moderation; VINs, decoded vehicle specifications and parts search terms for normalisation (see Section 4)
Supabase	Our main database (account, vehicle, service, community and workshop data), mobile app sign-in, and storage for community photos, in a Supabase-hosted database in a secure cloud region.
Netlify (US)	Website hosting and account sign-in for the website and the app (Netlify Identity: email address and password hash)
Hostinger	The virtual server that runs our backend automation (n8n), which processes app and website requests and the data in them
Cloudinary (US)	Storage of receipt images and workshop job photos and documents
Apple	In-app purchases in the iOS app. Apple handles the payment; we do not receive your card details.
RevenueCat (US)	Your app user ID and App Store purchase and subscription history, to confirm what you have bought
Stripe (US)	Website payments and subscriptions: email address, payment details (entered directly with Stripe) and billing history
VehicleDatabases (US) and Vincario (Czech Republic)	The VIN, to decode it and, for VehicleDatabases, to fetch recalls and maintenance schedules. US and Canadian VINs go to VehicleDatabases; other VINs go to Vincario.
NHTSA (US Department of Transportation)	The VIN, sent to NHTSA's public vPIC decoding service for some decodes
eBay (US)	For parts search, our server sends eBay the car's year, make, model and engine and the part you are looking for, never your VIN or account details. When you open a listing you leave VinSnap for eBay through the eBay Partner Network, and eBay's own privacy notice applies; we may earn a commission.
RDW (Netherlands vehicle authority)	A Dutch licence plate you enter in the vehicle check, sent to RDW's public open-data service
Expo (650 Industries, US)	Delivers push notifications to the app (your push token and the notification text) and app updates (your device's operating system, the app version and a random installation ID, with no account details)
Apple and Google sign-in	If you choose Sign in with Apple or Google, they confirm your identity and share your email address (Apple may give us a private relay address) and, if you allow it, your name
Apify, running parts catalogue integrations	Part numbers and vehicle identifiers, for the parts cross-reference. Your account details are not included.
Tradesoft (Parts-Catalogs, United Arab Emirates)	For genuine (OE) part numbers: the VIN of the car you look up and the part you search for. Your account details are not included. Tradesoft does not keep a copy of the results for us; each lookup is fetched live.
Zoho (Zoho Mail)	Sending emails to you: your email address and the content of the email
Telegram	Internal alerts to our team: community reports (including the reported content and the profile it belongs to), system error alerts, and demo booking notifications
Google	Website analytics and advertising measurement (Google Analytics, Google Ads), only if you accept cookies; Google Calendar and Google Sheets for demo bookings and business outreach lists
Sentry	Error reports from the website app (technical details of the error, browser, and your account ID if you are signed in), sent to Sentry's EU region

We rely on each provider's standard data processing terms, which form part of their terms of service.

We may also disclose information when the law requires it, to protect the rights and safety of our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your data.

6. Community Content

Posts, comments, photos and your community profile are visible to other VinSnap users, and community photos are stored at links that anyone who has the link can open. Do not post anything you want to keep private.

Before a post or comment is published it is screened automatically, first by our own word filter and then by OpenAI's moderation service. Content that fails screening is rejected; if the screening service is unavailable, the content may be held back for review. When you report content or a profile, the report and the reported content are sent to our moderators through Telegram. Content reported by several different users can be hidden automatically until it is reviewed. See the Community Guidelines.

7. Shared Vehicle Passport Links

Your Vehicle Passport is private until you create a share link. Anyone who has the link can open it, so share it only with people you choose, for example a buyer, an insurer or your mechanic. Shared pages are marked so search engines do not index them.

You decide, section by section, what the link shows: the full VIN or only its last 6 characters, vehicle specifications, service history, costs, receipt images, mileage history, recalls and badges. Your display name is off by default. You can preview what a visitor sees, change your choices, replace the link or turn it off at any time; a link that is turned off stops working immediately. We count how many times your link is viewed and show you that number; we do not record who viewed it.

A Vehicle Passport is your own record of your car. It is not a government document, a title, a registration or an official vehicle history report.

8. Workshop Data (VinSnap Business)

VinSnap Business is used by repair workshops to keep records about their own customers. For that data, the workshop is the controller: it decides what to record and why, and it is responsible for informing its customers and having a legal basis to use their data. VinSnap AI, Inc. acts as the workshop's processor (service provider): we store and process this data only to provide the Service to the workshop and on its instructions, and we do not use it for our own purposes or sell it.

What a workshop account stores:

• Customer contact details (such as name, email address and phone number)
• Customers' vehicles (such as VIN, licence plate, make, model and mileage)
• Jobs, estimates and job photos
• Invoices
• Staff names and their clock-in and clock-out times

Retention: workshop data is kept while the workshop account is open. Invoices are kept for as long as tax and accounting laws require (see Section 9), even if other records are deleted.

Deletion and other requests: a workshop can delete customer records in its account, or ask us to close the account and remove its data (see Section 10). If you are a customer of a workshop and want to see, correct or delete the data it holds about you, please contact the workshop. If you contact us instead, we will pass your request to the workshop and help it respond.

If a workshop sends a service record to a car owner who uses VinSnap and the owner accepts it, a copy of that record becomes part of the owner's own Vehicle Passport, and from then on the owner controls it as described in the rest of this policy.

9. Data Retention

• Account data (profile, vehicles, service history, reminders, community content, AI Mechanic conversations) is kept until you delete it or delete your account.
• Backups of our systems may retain deleted data for a limited period (typically up to 30 days) until they are overwritten.
• Invoices, payment and tax records, including invoices created in workshop accounts, are kept for as long as required by applicable tax and accounting laws (generally up to 7 years).
• Backend request logs (n8n execution history) can contain the content of requests, including AI Mechanic photos. They are deleted automatically after a limited period (about 14 days by default). The photo quote-check and warning-light features are set up so that their requests, including your photos, are not saved in these logs.
• OpenAI may keep API data for up to 30 days (see Section 4). Other providers keep data according to their own terms.

10. Deleting Your Account

You can delete your account at any time:

• In the app: Settings → Delete Account.
• By email: write to hello@vinsnap.net from the address on your account.

Deleting your account removes the data linked to it from our database, including your vehicles and their decoded data, service history, receipt scans, reminders, saved parts and search history, recall alerts, community profile, posts, comments, likes and follows, AI Mechanic conversations, quote checks, badges, club memberships, Car Passport links and push notification tokens. The email address on your account record is replaced with an anonymous placeholder.

We also delete the community photos you uploaded to our storage, your receipt images stored with Cloudinary, and your app and website sign-in. If you used workshop (business) features, invoices and other workshop records are not deleted automatically, because we must keep invoices as described in Section 9; contact us to close a workshop account and have the rest of its data removed, including job photos. All of this is subject to the backup retention described in Section 9.

Subscriptions: an App Store subscription is billed by Apple and is managed and cancelled in your Apple Account settings; deleting your VinSnap account does not cancel it. A subscription bought on vinsnap.net is cancelled when you delete your account.

11. Your Rights

Wherever you live, you can ask us to:

• Access the personal data we hold about you and get a copy.
• Correct inaccurate data; most of it you can edit in the app.
• Delete your data (see Section 10).
• Data portability: receive your data in a portable format. The app's Export Data option exports your vehicles, service history and reminders.
• Restrict processing, or object to processing based on our legitimate interests.
• Withdraw consent at any time, for example in Settings → AI data sharing or through the cookie banner. This does not affect processing that happened before.
• Complain to the data protection authority in the country where you live or work. We would rather hear from you first, so we can put it right.

These rights are written for the EU, EEA, UK and Swiss data protection laws (GDPR), and we give them to everyone, including under Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act and similar laws.

California and other US states: you can ask what personal information we collect, use and disclose, and ask us to correct or delete it. We do not sell personal information. We will not treat you differently for exercising your rights.

To use any of these rights, email hello@vinsnap.net or use Settings → Contact Support in the app. You don't need a special form or wording. We may need to confirm that the account is yours. We respond within one month, or sooner if your local law requires it.

12. Cookies, Analytics and the Mobile App

Website: we use essential browser storage for sign-in and preferences. Google Analytics and Google Ads measurement run in consent mode and only store analytics or advertising cookies if you accept them in the cookie banner. The website app also sends error reports to Sentry.

Mobile app: the app contains no advertising and no third-party analytics SDK, and it does not track you across other companies' apps or websites. It uses Expo for push notifications and app updates (see Section 5). Without an account (guest mode), the cars you add are kept only on your device until you sign up. The home-screen widget reads what is due next for your car from storage on your device and shows no VIN or personal data.

Links to other stores: some screens link to partners, for example eBay listings or offers to sell your car. These open in your browser, and the partner's own privacy notice and cookies apply there. We may earn a commission. At most the car's year, make, model and mileage are included in such a link, never your name, email or VIN.

13. Security

Data is encrypted in transit (HTTPS). Access to our systems is limited to the people who need it to run the Service, and requests for account data require you to be signed in. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the authorities where the law requires it.

14. Age Requirement

VinSnap is for people aged 13 and over. If you are under 18, you need the permission of a parent or legal guardian to use VinSnap, and they should review this policy with you.

VinSnap is not directed at children under 13, and we do not knowingly collect personal data from children under 13, in line with the US Children's Online Privacy Protection Act (COPPA). If we learn that we have collected personal data from a child under 13, we will delete it. If you believe a child under 13 has given us personal data, contact us at hello@vinsnap.net and we will delete it.

15. International Data Transfers

VinSnap AI, Inc. is a US company that offers the Service worldwide, and most of our providers (Section 5) are in the United States; our genuine-parts catalogue provider is in the United Arab Emirates. Some providers, and members of our team, may process data in other countries. If you use the Service from outside the United States, your data will be transferred to and processed in the United States and those other countries, whose data protection laws may differ from yours. Where data from the EU/EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the EU–US Data Privacy Framework where the recipient is certified under it, or on the Standard Contractual Clauses included in the provider's standard data processing terms.

16. Changes to This Policy

We may update this policy. We will change the "Last Updated" date and, for material changes, tell you by email or in the Service. If a change affects what the AI features send to OpenAI, the app will ask for your permission again.

17. Contact Us

The easiest way to reach us, from anywhere:

• Email: hello@vinsnap.net (any language)
• In the app: Settings → Contact Support
• On the web: vinsnap.net/contact

By post: VinSnap AI, Inc., 1111B S Governors Ave #87677, Dover, DE 19904, United States