Privacy Policy

1. Who is the data controller

The controller of personal data and the party responsible for its processing is:

The controller of personal data is the operator of the VinMaestro service — a sole proprietor (Ukraine). Full requisites are stated in payment documents and provided upon request.

• Contact email for data-protection matters: [email protected]

For any questions regarding the processing of your personal data, contact the email address above.

2. What data we process

Query data (search request). The core function of the Service is to generate a vehicle report by the VIN or licence plate number you enter.

Important: a VIN or plate number relates to the vehicle itself, yet it may be linked to an identifiable individual (for example, the car owner). We therefore treat such queries as data that may contain personal information and handle them with care. You are responsible for having a legitimate interest in checking the specific vehicle.

Payment data. Payment for the full report (UAH 299) is made through the WayForPay payment service. We do not receive or store your bank card details (number, CVV, expiry date). This data is processed directly by WayForPay as a separate controller/operator. From WayForPay we receive only the technical result of the transaction (success/declined, transaction ID, amount).

Account. Sign-in uses a one-time link sent to your email (no passwords). We store your email and the history of your reports to provide access to the “My reports” account area.

Technical data. Automatically, we may collect: IP address, device and browser type, language; technical logs (the fact of generating a report) for operating, securing and improving the Service; data required to protect against automated abuse (Cloudflare Turnstile / anti-bot).

3. Purposes and legal bases of processing

• Providing the Service (generating the report): VIN/plate query — basis: performance of the contract (public offer).

• Processing payment: transaction result from WayForPay — basis: performance of the contract; legal obligation (accounting).

• Support and handling of requests/refunds: contact details, request data — basis: performance of the contract; legitimate interest.

• Account: email, report history — basis: performance of the contract / consent.

• Analytics and improving the Service: technical data — basis: legitimate interest.

• Protection against abuse and fraud: IP, technical data — basis: legitimate interest.

• Compliance with legal requirements: accounting/payment data — basis: legal obligation.

4. Where the report data comes from (sources)

The report is generated by aggregating information from external sources. We are not the original source of this data and do not alter its content. Sources include, among others:

• vehicle registration history (Ministry of Internal Affairs, MIA);

• stolen-vehicle databases (National Police, NPU);

• listings and market prices (AUTO.RIA);

• US auction data (Copart/IAAI — via a data provider);

• mentions in court decisions (Unified State Register of Court Decisions, EDRSR);

• manufacturer recalls (NHTSA);

• our own VIN decoder.

For more on the nature of this data and the limits of our liability, see the Public Offer (Terms of Service).

5. To whom we disclose data (recipients and processors)

We do not sell your personal data. We engage trusted contractors (processors) who process data on our behalf:

• WayForPay — payment processing;

• Cloudflare — CDN, protection against attacks/bots (Turnstile), content delivery;

• Hetzner — server hosting (VPS);

• Cloudflare R2 — storage of images/photos in reports;

• Resend — delivery of service emails (one-time sign-in links);

• source-data providers — solely to obtain information for your query.

Some contractors may process data outside Ukraine/the EU. In such cases we take measures to ensure an adequate level of protection (contractual safeguards, etc.). We may also disclose data at the request of competent state authorities where required by law.

6. Retention periods

• Queries (VIN/plate) and generated reports: kept for as long as the Service operates — report caching is part of the service (a purchased full report remains available to you without a time limit). You may request deletion of data related to you.

• Payment/accounting transaction records: for the periods established by tax and accounting law (up to 3 years).

• Account data: until the user deletes the account plus a reasonable technical period.

We keep data no longer than is necessary for the stated purposes.

7. Your rights

In accordance with the law you have the right to: access your personal data and information about its processing; request correction of inaccurate data; request deletion of data (the “right to be forgotten”) in the cases provided by law; restrict or object to certain processing; withdraw consent (where processing is based on consent); data portability (where applicable).

Important regarding source data: we cannot correct the content of information originating from external registries and databases (MIA, NPU, EDRSR, etc.). If you believe such data is erroneous, a correction request must be addressed directly to the relevant source/authority. We can only correct what we process ourselves.

To exercise your rights, write to [email protected]. We respond within 30 days.

You also have the right to lodge a complaint with the supervisory authority — the Ukrainian Parliament Commissioner for Human Rights (Ombudsman), the body overseeing compliance with personal-data protection law.

8. Cookies and consent

The Service uses only technically necessary cookies: the sign-in session, access tokens for purchased reports, and Cloudflare service cookies (security, bot protection).

We do not use analytics or advertising cookies, so no separate consent banner is required. You can manage cookies through your browser settings; blocking necessary cookies may break sign-in and access to purchased reports.

9. Security measures

We apply organizational and technical protection measures, including: connection encryption (HTTPS), protection against bots and attacks (Cloudflare), restricted access to infrastructure, and not storing payment card data. No method of data transmission is absolutely secure, so we cannot guarantee absolute protection, but we continuously work to improve it.

10. Children

The Service is not intended for persons under 18 and is not directed at children. We do not knowingly collect children’s data. If you believe a child has provided us with data, contact [email protected].

11. Changes to this Policy

We may update this Policy. The current version is always available on the site with the date indicated. We will notify significant changes on the site and/or by email to registered users.

12. Contacts

For any privacy matters: [email protected] or Telegram @vinmaestro_bot.

See also the Public Offer (Terms of Service) and the Payment & Refund Policy.