Privacy Policy

• Account data — email address and authentication data, managed through our hosting provider Supabase.
• Billing data — your plan and the contact details needed to issue monthly invoices. Payment is by invoice; we never store card numbers.
• API usage logs — for each API request: a masked VIN (never the full VIN), the endpoint, HTTP status, latency and timestamp. A full VIN can identify an individual vehicle and its keeper, which is why we do not persist it: logs store a masked form, and our decode cache is keyed by the VIN's pattern (positions 1–8 and 10) with the serial number removed.
• Support communication — emails you send us.

• Providing the service, metering quotas and billing — Art. 6(1)(b) GDPR (performance of a contract).
• Abuse prevention, rate limiting and security logging — Art. 6(1)(f) GDPR (legitimate interest in protecting the service).
• Retaining billing records — Art. 6(1)(c) GDPR (legal obligations, e.g. tax law).

We do not use your data for advertising and we do not sell it.

We use the following processors under Art. 28 GDPR data processing agreements:

• Supabase — database, authentication (region: AWS eu-central-1, Frankfurt)
• Vercel — application hosting and logs
• Upstash — rate-limit counters (no personal data beyond an internal user ID)

Where these providers process data outside the EEA, transfers are safeguarded by adequacy decisions or EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

• API usage logs: [12 MONTHS], then deleted.
• Account data: until you delete your account.
• Billing records: as long as commercial-law and tax retention rules require.

We set only cookies that are strictly necessary to keep you signed in (Supabase session cookies). We use no advertising or cross-site tracking cookies, so no consent banner is required.

You have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict processing of (Art. 18), and receive a portable copy of (Art. 20) your personal data, and to object to processing based on legitimate interest (Art. 21). Contact info@vinapi.app to exercise these rights; we respond within one month (Art. 12(3)). You also have the right to lodge a complaint with a supervisory authority (Art. 77), e.g. the authority of your habitual residence.

We will announce material changes to this policy by email or in the dashboard before they take effect.