Privacy Policy

VINvalid — operated by You're it OÜ Effective date: 7 October 2026

1. Who we are

VINvalid (vinvalid.org, api.vinvalid.org) is a VIN decoding API operated by You're it OÜ, registry code 17146966, registered office at Sinirebase 8-4, Tallinn, Estonia ("VinValid", "we", "us"). For the personal data described in this policy we act as the data controller.

Contact for anything privacy-related: vinvalid.decoder@gmail.com

This policy explains what personal data we collect when you visit vinvalid.org, create an account, use the API or pay for a plan, why we collect it, who we share it with, and what rights you have under the EU General Data Protection Regulation (GDPR) and other applicable laws.

2. What we collect

Account data

• Email address — used to create and identify your account and to contact you about the service.
• Password — stored only as a salted hash. We cannot read it.
• API key(s) and their settings, created for your account, stored only as a salted hash, we cannot read it.

Payment data

Payments are handled by Stripe. When you subscribe or pay, your card or other payment details are entered directly with Stripe and we do not receive or store full card numbers. We store only what we need to run billing: your Stripe customer ID, the plan you are on, subscription status, invoice records and amounts, and billing details you provide (such as name, billing address and VAT number for invoicing).

API usage data

When you call the API we record:

• the VIN submitted and the decode result returned,
• the time of the request, the API key used, response status, and request counts (used for quotas, rate limits and billing),
• the IP address the request came from.

A VIN identifies a vehicle, not a person. We do not receive information about vehicle owners. However, because VIN requests are linked to your account, we treat this log data as personal data connected to you.

Technical and website data

When you visit the website, your device automatically sends us your IP address, browser type and version, operating system, pages requested, and date and time of access. This is recorded in server logs for security and troubleshooting.

Cookies

We use cookies and similar technologies that are strictly necessary to keep you logged in and keep the site secure. No marketing or other tracking cookies are used.

Communications

If you email us, we keep the message, your email address and our replies so that we can respond and keep a record of the exchange.

3. Why we use your data and on what legal basis

| Purpose | Data | Legal basis (GDPR Art. 6) | | --- | --- | --- | | Create and run your account, authenticate you, provide the VIN decoding API | Account data, API usage data | Performance of a contract (6(1)(b)) | | Take payments, issue invoices, manage subscriptions | Payment data, account data | Performance of a contract (6(1)(b)) | | Meet accounting, tax and other legal duties | Invoices, payment records | Legal obligation (6(1)(c)) | | Enforce quotas and rate limits, prevent abuse, fraud and unauthorised access, keep the service secure | API usage data, technical data, IP address | Legitimate interest (6(1)(f)) in securing and protecting the service | | Troubleshoot, maintain and improve the service | Usage and technical data | Legitimate interest (6(1)(f)) | | Service messages (billing notices, quota warnings, security alerts, changes to terms) | Email address | Contract / legitimate interest | | Respond to your enquiries | Communications | Legitimate interest (6(1)(f)) | | Establish, exercise or defend legal claims | Relevant data above | Legitimate interest (6(1)(f)) |

We do not sell your personal data. We do not use it for automated decision-making or profiling that has legal or similarly significant effects on you.

4. Who we share data with

We share personal data only with service providers that process it for us, or where the law requires.

• Stripe (Stripe Payments Europe, Ltd., Ireland, and affiliates) — payment processing. Stripe processes payment data under its own privacy policy (stripe.com/privacy) and, for some purposes such as fraud prevention and financial regulation, acts as an independent controller.
• Hosting / infrastructure provider — Estonia, where our servers and database are located.
• Email delivery provider — Google LCC, used to send account and service emails.
• Accountants, auditors and legal advisers — as needed to meet legal and financial obligations.
• Authorities, courts and law enforcement — where we are legally required to disclose data, or to protect our rights.
• Successors — if the business is sold or reorganised, data may be transferred to the new owner, who must honour this policy.

These providers may only use your data on our instructions and under data processing agreements, except where they act as independent controllers as noted above.

5. Transfers outside the EEA

Some of our providers (including Stripe) may process data outside the European Economic Area, including in the United States. Where this happens, we rely on an adequacy decision (for example, the EU–US Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses, together with appropriate safeguards.

6. How long we keep data

| Data | Retention | | --- | --- | | Account data (email, API keys) | While your account is active, then deleted within 30 days of account closure, except as below | | API request logs (VINs, timestamps, IP) | 60 days, then deleted | | Invoices and payment records | 7 years from the end of the financial year, as required by Estonian accounting law | | Server and security logs | Up to 90 days | | Support emails | Up to 3 years after the matter is closed |

7. Security

The whole site and API run over HTTPS. Passwords are stored hashed. Access to personal data is limited to people and providers who need it. Payment card data is handled by Stripe and never touches our servers. No system is perfectly secure; if a breach affects your personal data we will notify you and the Estonian Data Protection Inspectorate where the law requires.

Please keep your API key secret. Anyone who holds it can make requests on your account. If you think it has leaked, revoke it in your account and contact us.

8. Your rights

If the GDPR applies to you, you have the right to:

• access the personal data we hold about you and get a copy,
• rectify inaccurate or incomplete data,
• erase your data, where we no longer need it or have no legal basis to keep it,
• restrict processing in certain cases,
• data portability — receive data you gave us in a structured, machine-readable format,
• object to processing based on legitimate interest, and to direct marketing at any time,
• withdraw consent at any time where processing is based on consent, without affecting earlier processing.

To use any of these rights, email vinvalid.decoder@gmail.com from the address registered to your account so we can verify it is you. We respond within one month; for complex requests we may extend this by up to two further months and will tell you why.

Some data cannot be erased on request where we must keep it by law, such as invoices.

Complaints. You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, www.aki.ee, or with the supervisory authority in your own EU country.

9. Residents of California and other US states

We do not sell or share personal information as defined by the California Consumer Privacy Act (CCPA/CPRA) and similar US state laws, and we do not use it for cross-context behavioural advertising. We do not knowingly collect personal information from children under 16.

If you live in California, Virginia, Colorado, Connecticut, Utah or another US state with a privacy law, you may have the right to know, access, correct and delete your personal information, and not to be discriminated against for exercising these rights. Email vinvalid.decoder@gmail.com to make a request.

10. Children

VINvalid is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

11. Third-party links

Our website may link to other sites, including Stripe's. We are not responsible for their privacy practices, so please read their policies.

12. Changes to this policy

We may update this policy from time to time. The current version is always at vinvalid.org/privacy with its effective date at the top. If we make a material change, we will notify account holders by email before it takes effect.

13. Contact

You're it OÜ (VINvalid) Sinirebase 8-4, Tallinn, Estonia Registry code: 17146966 Email: vinvalid.decoder@gmail.com