Privacy Policy

01·Controller and information collected#

Vinfirm LLC, an Indiana limited liability company, is responsible for the personal data described here. It is the data controller, in the language most privacy laws use. Write to help@vinfirm.com about anything on this page. Postal mail goes to 5534 Saint Joe Road, Fort Wayne, IN 46835, USA.

What we hold: your email, the vehicles you add, the records you enter, and the document files you upload. We do not buy data about you or your car, we do not read a vehicle history report on your behalf, and we do not sell anything about you to anyone.

Public profile view counts hold no viewer identity. They are a daily tally per vehicle. No visitor list, IP address, location, device or cookie is stored to produce them.

02·Uploaded documents#

A document you upload is used for two things: to extract the structured record data that becomes a timeline entry, and to produce a redacted version for anything shown publicly.

The original, unredacted file is deleted from storage as soon as that processing finishes and the redacted version and structured data are saved. A nightly check sweeps the storage bucket for any original that outlived a failure somewhere and removes it. We hold the redacted copy and the structured data; we do not keep the original.

03·Automated processing and model training#

Reading a document is done by OpenAI's API. We send the pages of the document you uploaded, the image and the text layer where one exists, and receive back the structured fields and the coordinates of personal information to cover up. That is the entire use.

Vinfirm does not collect, use or sell personal data for the purpose of training large language models, whether our own or anyone else's. Under OpenAI's standard API terms, data sent through the API is not used to train their models either; they retain it for a short period, around 30 days at the time of writing, for abuse monitoring, and then delete it. OpenAI is the only provider that sees document contents for this purpose, and what it sees is the document pages and nothing else from your account.

No decision that affects you is made automatically. Extraction proposes fields and you confirm or correct them before anything is saved, and nothing in this product decides your eligibility for anything.

04·Redaction#

Automatic redaction finds names, addresses, phone numbers and card digits. It will miss things. We show you what was hidden and let you check it before anything publishes, and we never claim that a document holds nothing personal.

Redaction is best-effort and has a real failure rate. We do not represent that every piece of personal information has been removed from a document, and you should review what you are about to publish.

High-risk fields are withheld from public display entirely rather than covered over in place: a Social Security number, a driver's license number, or a full or partial card number.

05·Public disclosure of profile data#

A Vehicle Profile is private by default and stays that way. Until a Vinfirmed Sale is purchased for that vehicle, nothing about it is publicly readable: not the timeline, not the totals, not the documents. That gate is enforced on the server, and a request for a private profile returns nothing at all rather than returning the data and hiding it.

While a sale is live, the public page shows the vehicle summary, the full timeline, the record count, the redacted document images, the records PDF, the documented spend, and the seller's profile if they have published one. When a transfer completes, the page archives: it stays readable at the same address, carries a date, and drops the amounts and the documents.

When a profile stops being publicly visible, whether you take it down or a completed transfer archives it, its document links are retired. Every image path is rotated, so any URL that was previously shared, cached or indexed stops working. A nightly check completes any retirement that did not finish when it was triggered. That statement has a limit: the files sit in a public storage bucket, and rotating the path makes an old link dead and the new one unlisted rather than access-controlled.

Search engines are permitted to index a profile in either public state, and are instructed not to index the images on it. When a profile is taken down we mark it so that it drops out of search, and we will ask the search engines to expedite that on request, though we do not control how quickly they act or copies held by anyone else.

Separately from publishing, an owner may permit us to show one of their cars in Vinfirm's own marketing: on vinfirm.com's own pages and on Vinfirm's social accounts and newsletter. That permission is off unless it is given, it is given one car at a time, and it shows nothing that the car's public page is not already showing. Withdrawing it removes the car from vinfirm.com straight away and does not reach a post already published somewhere we do not control. We keep a record of when the permission was given and when it was withdrawn.

A no-login takedown and report link sits on every public profile page, active or archived. Raising a concern about a specific profile never requires an account.

06·Third-party information on uploaded documents#

This section is for people who do not have a Vinfirm account and did not upload anything. A repair invoice can carry a service advisor's name, a technician's signature, or a previous owner's details, and the person who uploaded it is not you.

You can ask us to remove it, without creating an account, from the report link on the profile page or by writing to us. Tell us the page and what to look at. We do not require you to prove who you are before we look, though we may ask where the request is about identifying yourself.

On receiving a request we take the document or the record down while we review it, remove information that should not be there, and, where a whole document is the problem, remove the document. Where a record is central to a live sale we may keep the record and remove only the document image behind it, so that a buyer is not left with a gap they cannot see the shape of.

We cannot undo copies other people have already made, or reach material outside our own systems. The full process, including timelines, is set out at Content Removal.

07·Sub-processors#

Each sub-processor is named below with what it touches. We do not add one silently; this table is updated when the list changes, not afterwards.

08·Retention#

Original uploaded files: deleted as soon as processing succeeds, as described in section 02. Redacted document images and structured records: kept for as long as the Vehicle Profile exists, because they are the profile.

Export files: held for 7 days behind a link that expires, then deleted. Transfer invitations: 14 days, then they lapse. Account data after you ask us to delete it: 30 days, then removed. See section 09.

Public profile view counts: kept as daily totals per vehicle, indefinitely, because they contain nothing about any viewer. Emails we send you are recorded as having been sent; the delivery record lives with our email provider under its own retention.

Backups are held by our database provider on their schedule and are overwritten in the normal course. A deletion that has completed in the live database can persist in a backup for a short period afterwards, which is a limit of how backups work rather than a decision we make about your data.

09·Deletion and its limits#

Deleting your account offers you a full export first, then schedules removal 30 days out. Signing back in before then cancels it. Your vehicles, records, documents and profile photos go.

Deleting a vehicle record is a separate action from deleting an account, and you can do either. Removing one vehicle leaves the rest of your garage alone.

A record you have already transferred is treated differently. A Vehicle Profile you handed to a buyer is theirs. It is their car's history, they received it on that basis, and your account closing does not empty it. If you want your name removed from something inside it, ask us and we will review the specific item. We will not delete a buyer's vehicle history at the request of the person who previously owned the car.

A completed handover also leaves a small durable record on the other party's side: which vehicle, and when. It exists so that their own history does not develop a gap when you leave, and it is the minimum that makes a rating trustworthy. It carries no contact details for you.

A third party's request to remove their information from a document is handled under section 06 and does not depend on the vehicle's owner agreeing.

We will retain something despite a deletion request only where we have to: to complete a transaction you asked for, to keep the financial records tax law requires, to resolve a dispute, or to comply with the law. Where that happens we keep the narrowest thing for the shortest time.

10·Reviews and seller profiles#

A seller profile is off by default. Nothing about your account is published anywhere until you choose a handle and turn it on, and turning it off hides the page again without deleting anything.

A review never carries the buyer's identity. It is attributed to the car, as in "the buyer of the 2018 Audi RS3", not to a name, handle or email, and the reviewer's account is never linked from it. A seller profile publishes only vehicles whose own sale page is already public and transfers that have completed; a private or archived car in the same garage appears nowhere.

Review text is automatically checked for URLs, email addresses and phone-number-shaped digit runs, which are stripped before it publishes. A note containing one of the categories this product hard-blocks, such as a Social Security number, a driver's license number or a full card number, is withheld from publishing entirely: the rating still counts, the text does not appear.

If a buyer later deletes their account, the review's link to them is severed and its text removed, while the rating and the fact of the handover remain.

11·Cookies, analytics and tracking signals#

A signed-out visitor is served no cookies on any public page. Page views are counted with Vercel Web Analytics, which is cookieless: a repeat visit is recognised by a hash of the request plus a salt that rotates daily, and nothing is stored on your device or joined to your account. There is no advertising, no session recording, and no cross-site tracking.

Signing in sets one session cookie, without which there is no way to stay signed in. Opening a checkout page loads Stripe, which sets two of its own for fraud prevention. That is the complete list, and the Cookie Policy names each one, what sets it and how long it lasts.

Because all three are strictly necessary, they are disclosed rather than gated behind a consent dialog. If a non-essential cookie or any third-party tracking script is ever added, it will sit behind a real choice made before it is set, and this page will say so first.

Some browsers send a Global Privacy Control signal, which tells a site not to sell or share personal data for advertising. We honour it. Honouring it changes nothing about how Vinfirm works, because we do not sell or share personal data and run no advertising.

12·Security#

Vinfirm is a small company running on managed infrastructure. This section describes the specific measures that follow from that.

Traffic is encrypted in transit and data is encrypted at rest by our database and storage provider. Access to a record is checked on the server against the account making the request, and enforced in the database itself rather than only in the application. Original unredacted documents live in a private bucket and are deleted after processing. Payment card numbers never reach us; Stripe handles them.

No system is immune, and a single-member company has fewer people watching than a large one does. If personal data is exposed in a way that requires it, we will notify affected people and the regulators the law requires, within the deadlines the law sets, and tell you what we know.

13·Eligibility and territorial scope#

Vinfirm is offered to people in the United States, and you must be at least 18 to hold an account. We do not aim the service at anyone under 18, do not knowingly collect personal data from children, and will delete an account and its data if we learn it belongs to one.

We are not set up to meet the obligations that come with serving users in the European Economic Area, the United Kingdom or Switzerland, and we do not offer the service there.

Wherever you live, you can ask us what we hold about you, ask us to correct it, ask us to delete it, or ask for a copy you can take elsewhere. We answer those requests whether or not a law where you live requires us to, and we do not charge for them or treat you differently for asking.

14·Changes to this policy#

This is version 1.0, effective 2026-09-09. The version and date at the top of this page are always the current ones, and we keep the previous versions.

If a change materially affects how we handle personal data, we will email the address on your account before it takes effect rather than leaving it to be discovered.

This page is intended to describe the system as built. If a statement here disagrees with what the product does, tell us at help@vinfirm.com and we will correct it.