Esta página aparece em inglês, que é a versão legal. As traduções estão a caminho; escreva para nós em qualquer um dos seis idiomas do app e responderemos nesse idioma.
Privacy policy
Last updated October 20, 2026
What we collect
- Your account: email, name and password (stored hashed), or your Google sign-in.
- The VINs you scan or type, the reports you open and the cars you save.
- Camera: the scanner reads VINs on your phone and never keeps a picture. When a VIN plate is in view but the phone can't read it (glare, a worn or cut-off plate), the app may send one snapshot of the scan window to be read by our server; it is used for that read only and not stored.
- Dealership staff only: where a car was parked on the lot (the phone's location at the moment a car is parked, walked past or found), which teammate recorded it and when. On a lot walk the app also sends the path walked, which is used to map the lot's rows. The app never tracks staff in the background. Walk paths are deleted after 7 days, and after 90 days the lot's history no longer says who recorded anything.
- Camera finder (where a dealership turns it on): this application runs on Google Play Services for AR (ARCore), which is provided by Google and governed by the Google Privacy Policy. To power a camera-finder session, Google will process sensor data (e.g., camera and location) to work out where the phone is; VINMaven doesn't receive or keep the camera images. Learn more.
- Your home ZIP, to show local lenders, insurers, taxes and prices. You can type it, or let the app look it up once from your phone's approximate location if you allow it. We keep the ZIP only, never your location.
- When you scan a car and the app has your location, it sends your phone's location with the scan. We use it only to tell whether you're at the car's dealership: if you are, your history notes the visit (so the app can ask how it went), and we note that the car is on that dealership's lot. The dealership never sees your location, the time or who you are: only that shoppers saw the car on its lot (which lot, if it has more than one), by the week, once five or more different shoppers have, on two or more days. We delete the scan's location after 36 days.
- Loan or insurance requests, and reviews you choose to write.
- A random ID the app creates when it's installed (never your phone's advertising ID) and the network you connect from (your IP address). With the reports you open and the cars you save, we keep them in coded form; a report you open also keeps your IP address as it is. We delete all of these after 30 days. We use them to prevent fraud and keep counts honest: one phone or network can't count as several shoppers, and your own looks aren't counted back to you. The ID stays when you sign out and is replaced with a new one when you delete your account. When you create an account or sign in, the app also sends your phone's device ID; we keep only a coded form of it, to keep each phone to one account, to tell you about a sign-in from a new phone, and for fair-use limits.
- We show how many VINMaven shoppers opened or saved a car, only in ranges of 5 or more, never who. Dealership staff, VINMaven staff and test accounts aren't counted.
- How the app and site are used and how they perform: pages and screens opened, a few taps (like “sent an offer”), purchases, error reports and speed measurements. In the app these are tied to your account ID, never your name or email. On the website they're counted without cookies and aren't tied to you. The app never records your screen, and a screen showing your license, insurance card or paperwork is never in an error report. On the website, only the partner portal is ever recorded, only when an error happens there, with all text, inputs and pictures hidden. You can turn usage counting off, and on the website the portal's recordings too (see “Your choices”).
How we use it
To show your reports and alerts, keep your saved cars in sync, and improve the app. We never sell your data.
We don't use personal data for targeted advertising, we don't sell it, and we don't use it to train AI models. We don't make decisions about you that have legal or similar effects by automated profiling.
Cookies and similar technologies
We don't use advertising cookies, social-media pixels or cross-site tracking, and no third party collects information about your activity on our site to follow you across other sites. We use:
| Name | What it's for | How long |
|---|---|---|
vm_portal_token, vm_portal_org (portal, browser storage) | A sign-in token kept in your browser's storage, and the business you last opened | Until you sign out; the sign-in itself ends after 7 days |
vm_portal_nav, vm_queue_muted, vm_lot_undo (portal, browser storage) | Portal settings: a folded menu, muted sound, and the last change you can undo | Until you clear them; the undo lasts until you close the tab |
vm_privacy (browser storage) | Your choice on Your privacy choices | Until you clear it |
We count visits without cookies (our analytics provider, PostHog, uses a daily-changing anonymous count), and our hosting provider (Vercel) keeps short-lived request logs, including IP addresses, to run and protect the site. Payment pages are on Stripe's site, where Stripe uses its own cookies to prevent fraud. The partner portal's lot map is provided by Google Maps, which receives your IP address when the map loads. Car photos load from the dealer's own photo servers, which see your IP address but not which page you came from.
Signals like Global Privacy Control and Do Not Track
If your browser sends Global Privacy Control or Do Not Track, we turn off usage counting and screen recordings for that browser automatically. We don't sell personal data or use it for targeted advertising, with or without a signal.
Who we share it with
- Lenders and insurers you select, only after you agree, with the consent text you saw. Partners may pay us for these requests; we record which partner received each one so we can show you their answers and settle with them. We never sell your data to anyone you didn't pick.
- Reviews are public with your first name and last initial.
- Google, when you use the camera finder: the camera and location data Google Play Services for AR processes to place the phone (above).
- Service providers that run VINMaven for us, under contract, only to provide the service:
- hosting and databases: Render, Vercel, Supabase, Upstash;
- error and performance monitoring: Sentry;
- product analytics: PostHog;
- email: Resend;
- payments: Stripe;
- phone notifications: Expo, through Google and Apple's push services;
- a voice call that reads a verification code to a dealership: Twilio;
- maps, drive times and sign-in: Google (a drive time is asked from a dealership's address to the middle of an owner's ZIP code, never their street); on iPhone, the app's maps come from Apple;
- AI: OpenAI, which writes car summaries, reads VIN-plate snapshots and screens public text, and doesn't keep it for training;
- When you ask stores for offers on your car, the photos you send are also read by our AI providers, Google (Gemini on Vertex AI) or, when it's unavailable, Microsoft Azure OpenAI: to note the car's condition for the stores (flags such as worn tires or a warning light, never a price) and, when your phone can't read the dashboard photo, its odometer for you to check. Neither uses it to train its models;
- When you write to VINMaven support in the app, the text of your message is also sent to our AI provider, Microsoft Azure OpenAI, only to find help answers that may already answer it; we keep your message in your support conversation and nowhere else.
- car and market data: MarketCheck and NHTSA, which receive a VIN and a ZIP code, never your name.
- Authorities when the law requires it.
Sensitive information
- Your precise location is used only when you tap something that needs it (“I'm here”, Find it, scanning a car, or, for dealership staff, parking or finding a car). It is shared only with the dealership you're visiting, and a scan's location never is: the dealership sees only that shoppers saw the car (above).
- Your driver's license is read on your phone. The number, birth date and street address are not saved as details. A copy you choose to keep is encrypted on your phone and never uploaded.
- We ask before using any of these.
Your choices
You can edit your profile, and delete your account and its data from Account in the app. We keep only the records we must, listed on our Delete account page: for example, a business agreement you signed for a dealership, lender or insurer stays as the signed record (the name you signed with, your role, the business, the date, and the IP address and device you signed from), no longer linked to your account, for as long as we may need it to comply with legal obligations, resolve disputes or enforce the agreement. Questions: support@vinmaven.com.
In the app, Account → Privacy (“Help improve VINMaven”) turns off usage counting: screens, taps, speed traces and the record of taps and screens kept beside an error. Error reports still reach us, without your name or email. On the web, Your privacy choices turns off visit counting and the portal's error recordings. After you delete your account, error reports tied to your account ID are deleted by our error-monitoring provider (Sentry) within 90 days. Usage records are tied to your account ID only, never your name or email; ask us and we'll delete those too.
Your rights
Wherever you live, you can ask for a copy of your data, a correction, deletion, or a portable copy, and you can appeal if we say no. Use the app (Account), Delete account, or email support@vinmaven.com. We answer within 45 days.
Children
VINMaven is for adults 18 and over. We don't knowingly collect data from children.
Languages
This policy is in English today. Translations into each language the app supports are on the way; until then, write to support@vinmaven.com in any of the app's languages and we'll answer in it.