Legal
Privacy Policy
Last updated: 2026-10-04
Summary
We collect the minimum personal information we need to deliver a report you paid for. We do not sell personal information. We do not advertise. We share information with the service providers listed below to fulfil your order and, if you allow optional analytics, to measure public site usage.
What we collect
Email address (provided at checkout or sign-in), the VINs you query, payment metadata returned by our payment processor (transaction id, last-4 of card, no full card number ever touches our servers), and basic technical logs (request IP, user agent, timestamp). A VIN is a vehicle identifier, not personal information about you, but combining a VIN with your email may identify a vehicle of interest to you, we treat that combination as personal information.
Purposes
We use personal information only to: (a) fulfil the report order you placed, (b) send the receipt and the delivered report, (c) prevent fraud and abuse of the service, and (d) comply with U.S. tax and record-retention obligations. We do not currently send marketing campaigns. We use first-party, pseudonymous analytics to understand site usage and checkout completion. If you allow analytics, we also use Google Analytics to measure public page visits. We do not send VINs, email addresses, payment details, URL query strings or private order/report URLs to Google Analytics. We do not use these events to make automated decisions with legal effect.
Sub-processors
We rely on these third parties to deliver the service: our upstream report-data partner (used to fetch the report PDF for the VIN you submit); our payment processor, CMG Technologies and Consulting Ltd. (card payment processing); and Resend (transactional email delivery). Google provides optional Google Analytics measurement when you allow analytics. Each provider receives the information needed for its role; Google Analytics is not given customer report or payment details by this implementation.
Retention
Order records and report PDFs are retained for seven years to satisfy U.S. tax and accounting record-keeping requirements. You can request deletion of optional account data, and the magic-link tokens for an account email, at any time by emailing privacy@dealsoncarfax.com.
Your privacy rights
Depending on your state of residence, you may have the right to access the personal information we hold about you, to request its correction or deletion, and to opt out of its sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. California residents have these rights under the CCPA/CPRA; several other states provide comparable rights. Email privacy@dealsoncarfax.com and we will respond within the period required by your state's law (generally 45 days). We will not discriminate against you for exercising any privacy right.
Children
The service is not directed at people under 16, and we do not knowingly collect personal information from anyone under 16.
Breach notification
If we determine that a security breach has compromised your personal information, we will notify you and any regulators as required by applicable U.S. state breach-notification law.
Contact
privacy@dealsoncarfax.com