Privacy notice

VinScan is a non-commercial, self-hosted tool for checking vehicles by their VIN, run for internal testing and use. The operator of this installation is responsible for your data. Contact: the administrator of this VinScan installation.

• The VIN you check and the report built for it: vehicle data from public sources, with the name of each source and the time it was checked.
• A one-way hash of your IP address (HMAC-SHA256 with a secret key), used to count reports for visitors without an account and to stop abuse. Your IP address itself is not stored.
• If you create an account: your name, e-mail address, password (stored only as a secure hash), language and country preferences, your plan and a record of the reports you ran, so your quota can be counted.
• A session cookie and a security (CSRF) cookie that the site needs to work. Your light/dark preference is kept in your own browser.

• Vehicle owner data: no names, addresses, number-plate-to-owner links or anything similar.
• Camera images and photos: the scanner reads them on your device and never uploads them.
• Trackers, analytics, advertising or third-party cookies. Fonts and scripts are served by VinScan itself.

The Court of Justice of the EU has ruled that a VIN is personal data for anyone who can reasonably link it to a person (case C-319/22, Scania, 9 November 2023). We therefore treat the VINs you check and their reports as personal data under the GDPR.

We process them on the basis of legitimate interest (Article 6(1)(f) GDPR): giving you the vehicle check you asked for and keeping the service safe. For account data, the basis is providing the account you signed up for (Article 6(1)(b)).

To build a report, our server sends the VIN — or the make, model and year — to the public sources named in the report, such as NHTSA. Your IP address and account details are never sent to them.

When you follow a link to an official site (for example a national registry), that site receives your visit directly and its own privacy policy applies. We do not sell or share data with anyone else.

• Reports run without an account, together with their lookups and IP hashes: deleted automatically after 90 days.
• Reports in your account: kept until you delete them or your account is deleted.
• Account data: kept while your account exists.

You can ask for a copy of your data, its correction or deletion, and object to or restrict its processing. To have a report or your account deleted, send us the VIN or the report link — for an account, from the e-mail address it uses. Contact: the administrator of this VinScan installation. We reply within one month.

You can also lodge a complaint with a data protection authority; in Latvia this is the Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv).

If what we store or why changes, we update this notice and the date at the top of the page.