Privacy Policy — VinForFree.com

Effective Date: June 21, 2026 | Last Updated: July 2, 2026

This Privacy Policy explains how VinForFree LLC, a Michigan limited liability company (“VinForFree LLC,” “we,” “us,” “our”), collects, uses, stores, shares, and protects your personal information when you visit VinForFree.com (the “Site”) or use any of our services, including free VIN reports, VIN Pro Plus paid reports, and the License Plate Lookup feature.

By using the Site, you agree to the practices described in this Policy. If you do not agree, please discontinue use of the Site.

This Policy is incorporated into and forms part of our Terms of Use.

1. Information We Collect

1a. Information You Provide to Us

Email address — collected when you use the “Email Me” feature to receive a copy of your report, purchase a VIN Pro Plus report, or contact us directly
Vehicle Identification Number (VIN) — entered by you to generate a free or paid report
License plate number and state — entered when you use the License Plate Lookup feature
Payment information — we do NOT store your credit card number, CVV, expiration date, or banking details. All payment processing is handled exclusively by Stripe, Inc. (PCI-DSS Level 1 certified). We receive only a Stripe transaction ID, charge status, and the last four digits of your card for receipt purposes
Communications — any information you send us via email or contact forms

1b. Information Collected Automatically

IP address — logged for fraud prevention, security, abuse detection, DPPA compliance, and rate limiting
Browser type, device type, and operating system — collected to optimize Site performance and compatibility
Pages visited, time spent, and referring URL — collected via analytics tools to improve the Site
Cookies and similar tracking technologies — see Section 6 below

1c. License Plate Lookup Log

When you use the License Plate Lookup feature, we log the following information for DPPA compliance purposes:

Timestamp of the request
Your IP address
License plate number and state entered
VIN returned (if any)
Whether you confirmed the DPPA certification checkbox (true/false)
Whether the lookup succeeded or failed
Browser/device user agent string

This log is maintained to demonstrate compliance with the federal Driver’s Privacy Protection Act (DPPA) and may be provided to law enforcement upon lawful request. This log is not used for marketing purposes.

1d. Information We Do NOT Collect

We do not collect your name, home address, phone number, or date of birth unless you voluntarily provide them in a support message
We do not collect Social Security Numbers or government-issued ID numbers
We do not collect vehicle owner information from License Plate Lookup results — the API returns a VIN only, with no personally identifiable information about the vehicle’s registered owner
We do not build profiles on individual users for advertising or marketing purposes

2. How We Use Your Information

We use the information we collect for the following purposes:

Service delivery: To generate and deliver VIN reports, process payments, and operate the License Plate Lookup feature
Email delivery: To send you a copy of your report when you use the “Email Me” feature or purchase a VIN Pro Plus report
Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, abuse, and unauthorized access
DPPA compliance: To maintain records of License Plate Lookup requests as required for compliance with federal law
Legal compliance: To comply with applicable laws, regulations, court orders, and lawful requests from government authorities
Site improvement: To analyze how the Site is used and improve its features, performance, and user experience
Customer support: To respond to your questions, complaints, or requests
Communications: To send you transactional emails related to your use of the Site (e.g., report delivery, payment receipts). We do not send unsolicited marketing emails

We do not sell your personal information to third parties. We do not use your information for targeted advertising.

3. How We Share Your Information

We share your information only in the following limited circumstances:

Data providers: Your VIN or license plate is transmitted to our third-party data providers (including TorqueNode and others) solely to generate your requested report. These providers are contractually obligated to use your data only for this purpose
Payment processor: Payment information is processed directly by Stripe, Inc. We share only the minimum information necessary to complete your transaction
Email service provider: We use Brevo (formerly Sendinblue) to deliver report emails. Your email address is shared with Brevo solely for this purpose
Analytics: We use Google Analytics to understand Site usage. Google Analytics may collect anonymized usage data. See Section 6 for cookie details
Law enforcement: We may disclose your information — including the License Plate Lookup log — to law enforcement, government agencies, or courts when required by law, legal process, or when we believe disclosure is necessary to prevent harm or protect rights
Business transfer: In the event of a merger, acquisition, or sale of VinForFree LLC, your information may be transferred as part of the transaction. We will notify you of any such change via a notice on the Site
Protection of rights: We may disclose information when we believe it is necessary to enforce our Terms of Use, protect the safety of any person, or protect our legal rights

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4. Data Retention

Email addresses (Email Me / Pro Plus): Retained for up to 2 years to support customer service, then deleted or anonymized
VIN Pro Plus purchase records: Retained for 7 years to comply with business record-keeping requirements and for dispute resolution
License Plate Lookup log: Retained for 3 years for DPPA compliance purposes, then deleted
IP address logs: Retained for up to 90 days for security and fraud prevention, then deleted or anonymized
Analytics data: Retained per Google Analytics default retention settings (up to 26 months)
Support communications: Retained for up to 2 years, then deleted

You may request early deletion of your personal data subject to our legal obligations (see Section 7).

5. Data Security

We implement industry-standard security measures to protect your information:

SSL/TLS encryption on all data transmissions
Payment processing via Stripe (PCI-DSS Level 1 certified — we never handle raw card data)
Access-controlled databases with restricted admin access
Unique expiring tokens for paid report access (72-hour expiry)
Regular security monitoring and log review
Separation of sensitive data (payment records, DPPA logs) from general site data

No method of internet transmission is 100% secure. While we use industry-standard protections, we cannot guarantee absolute security against all threats. In the event of a data breach that affects your personal information, we will notify affected users as required by applicable law, including within 72 hours where required by GDPR, and as required by applicable US state breach notification laws.

6. Cookies and Tracking Technologies

6a. Types of Cookies We Use

Strictly Necessary Cookies: Required for the Site to function. These include session cookies for security and WordPress authentication cookies. These cannot be disabled.
Analytics Cookies: We use Google Analytics (Google LLC) to understand how visitors use the Site. Google Analytics may set cookies such as _ga, _gid, and _gat. This data is anonymized and aggregated. You can opt out of Google Analytics at tools.google.com/dlpage/gaoptout
LiteSpeed Cache: Our web hosting uses LiteSpeed Cache for performance. LiteSpeed may set cookies related to caching.

6b. Cookie Management

You can control cookies through your browser settings. Most browsers allow you to refuse cookies or delete existing cookies. Disabling certain cookies may affect the functionality of the Site. For EU/EEA users, we note that by continuing to use this Site after reviewing this Policy, you consent to the use of analytics cookies as described above.

6c. Do Not Track

Some browsers send “Do Not Track” signals. We do not currently alter our data collection practices in response to Do Not Track signals, but we support your right to use browser privacy tools.

7. Your Privacy Rights

7a. All Users

Regardless of your location, you may contact us at info@vinforfree.com to:

Request access to the personal information we hold about you
Request correction of inaccurate personal information
Request deletion of your personal information (subject to our legal retention obligations)
Opt out of any future marketing communications (note: we do not send unsolicited marketing emails)

We will respond to requests within 30 days where feasible.

7b. European Union / EEA Users (GDPR)

If you are in the EU or EEA, under the General Data Protection Regulation (GDPR, Regulation 2016/679) you have the following rights:

Right of access (Article 15): Request a copy of your personal data
Right to rectification (Article 16): Request correction of inaccurate data
Right to erasure / “right to be forgotten” (Article 17): Request deletion of your data where no legitimate legal basis for retention exists
Right to restriction of processing (Article 18): Request that we limit processing of your data
Right to data portability (Article 20): Request your data in a machine-readable format
Right to object (Article 21): Object to processing based on legitimate interests
Right to withdraw consent at any time where processing is based on consent
Right to lodge a complaint with your national data protection supervisory authority

Our lawful bases for processing under GDPR are: (a) performance of a contract (report delivery, payment processing); (b) legitimate interests (fraud prevention, security, DPPA compliance); and (c) consent (analytics cookies). We do not process special categories of data.

Data transfers to the United States are made under the recognition that the US may not provide equivalent protection to the EU. By using this Site, EU users consent to this transfer.

7c. UK Users (UK GDPR)

UK users have equivalent rights under the UK GDPR and the Data Protection Act 2018. To exercise your rights or to complain, contact us at info@vinforfree.com. You may also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

7d. California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you the following rights:

Right to Know: Request disclosure of the personal information we have collected about you in the past 12 months, including categories, sources, purposes, and third parties with whom we have shared it
Right to Delete: Request deletion of your personal information, subject to certain exceptions
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out of Sale or Sharing: We do NOT sell or share personal information for cross-context behavioral advertising
Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond the purposes permitted by the CPRA
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise your California rights, contact info@vinforfree.com with “California Privacy Request” in the subject line. We will respond within 45 days. We do not require you to create an account to submit a request.

Categories of personal information collected in the last 12 months: Identifiers (email, IP address); commercial information (payment records); internet activity (pages visited, browser type); and geolocation data (state-level, from license plate lookup).

Categories of third parties with whom we share personal information: Data providers (VIN/report data only), payment processor (Stripe), email provider (Brevo), analytics provider (Google Analytics), and law enforcement (upon lawful request).

7e. Canadian Users (PIPEDA / Quebec Law 25)

If you are a Canadian resident, under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec’s Law 25, you have rights to access, correct, and withdraw consent for collection of your personal information. Contact info@vinforfree.com to exercise these rights. We collect only the personal information described in this Policy and retain it only as long as necessary for the stated purposes.

7f. Australian Users (Privacy Act 1988)

If you are an Australian resident, under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), you have the right to access and correct your personal information held by us. Contact info@vinforfree.com to make a request. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

7g. Brazilian Users (LGPD)

If you are a Brazilian resident, under Brazil’s Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018), you have rights to access, correct, delete, and port your personal data, and to revoke consent. Contact info@vinforfree.com to exercise your LGPD rights. You may also complain to the Autoridade Nacional de Proteção de Dados (ANPD).

7h. Other International Users

If you are located in any other jurisdiction with applicable privacy laws — including but not limited to South Korea (PIPA), Japan (APPI), Singapore (PDPA), India (DPDP Act), Thailand (PDPA), or South Africa (POPIA) — we will use reasonable efforts to honor your privacy rights under applicable law. Contact info@vinforfree.com with your jurisdiction and request details.

8. Children’s Privacy

VinForFree.com is not directed to children under the age of 13 (or 16 in the EU/EEA under GDPR). We do not knowingly collect personal information from children under these ages. If we become aware that we have inadvertently collected personal information from a child under the applicable age, we will delete it promptly. If you believe we have collected information from a child, please contact us at info@vinforfree.com.

9. Third-Party Links

The Site may contain links to third-party websites, including affiliate partners (such as GoodCar, Carfax, insurance providers, and auto loan providers). We are not responsible for the privacy practices of any third-party website. We encourage you to review the privacy policies of any third-party site you visit. Clicking an affiliate link may result in the third party setting cookies on your device; we have no control over this.

10. Affiliate Disclosures

VinForFree.com participates in affiliate programs. When you click an affiliate link and make a purchase or sign up with a third-party service, we may receive a commission. This does not affect the price you pay. Affiliate relationships do not influence our editorial content or the data we report. We are required to disclose these relationships under the FTC’s Endorsement Guides (16 C.F.R. Part 255) and equivalent regulations in other jurisdictions.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will update the “Last Updated” date at the top of this page. For material changes that affect how we use your personal information, we will make reasonable efforts to notify users. Your continued use of the Site after any change constitutes your acceptance of the updated Policy. We encourage you to review this Policy periodically.

12. Contact Us

For any questions, requests, or complaints regarding this Privacy Policy or our data practices, please contact:

VinForFree LLC
16998 Middlebelt Road, Suite 200
Livonia, MI 48154
United States
Email: info@vinforfree.com
Support: supportvinforfree@gmail.com

We aim to respond to all privacy-related requests within 30 days.

Last Updated: July 2, 2026