What we collect when you use Vindraft, why we collect it, and how to control it.
This policy explains what Vindraft LLC collects when you use vindraft.com, why we collect it, and what choices you have. It applies to visitors and customers of our site.
This policy explains what Vindraft LLC collects when you use vindraft.com, why we collect it, and what choices you have. It applies to visitors and customers of our site.
| What | When | Why |
|---|---|---|
|
Email address |
You sign in or buy a report |
To send your one-time sign-in code, your report, and receipts |
|
VIN or license plate you search |
You run a check |
To look up and save your report |
|
Payment details |
You pay for a report or plan |
Card numbers go straight to Stripe, our payment processor. We only keep the amount, date and a Stripe reference ID, never your full card number |
|
Sign-in session |
You sign in |
Keeps you signed in for up to 30 days, in a cookie named vindraft_session |
|
Report history |
You run a check |
So you can revisit a report you already paid for, from your account |
If you start a VIN check and do not finish it, we may keep the email you entered so we can send you a link back to it. You can opt out of these emails at any time, and every one includes an unsubscribe link.
Vindraft uses one cookie that matters, vindraft_session. It keeps you signed in and stores nothing but a random, hard-to-guess session code. It is set to HttpOnly, so page scripts cannot read it, and SameSite=Lax, which blocks it from being sent on requests from other sites.
We do not use tracking cookies to build an ad profile of you.
NMVTIS does not contain information on all motor vehicles in the United States, because some states do not yet report their vehicle data to the system. A vehicle history report is not a substitute for an independent vehicle inspection.
We briefly hash and check the IP address behind a sign-in code request, only to stop automated abuse. We do not use it to build a location profile of you.
We do not sell your personal information. We share it only with:
Looking up a VIN with NHTSA's public databases does not send your email or any personal information to NHTSA. It sends only the VIN itself, the same way it would for anyone using NHTSA's free public tools directly.
We keep your account and report history for as long as your account is open, so you can come back and see past reports. If you ask us to delete your account, we delete your personal information within a reasonable time, except where we must keep payment records for tax or legal reasons.
Vindraft is for adults. It is not directed at children under 18, and we do not knowingly collect information from them.
Sign-in codes and session tokens are stored as one-way hashes, not as plain text, so even we cannot read them back. Payment happens through Stripe's own encrypted checkout. No system is perfectly secure, but we build with these protections on purpose, not as an afterthought.
If we change this policy in a meaningful way, we will update the date at the top of this page and, where required by law, tell you by email.
Questions about your data? Email support@vindraft.com or see our Contact page.
300 Delaware Ave Ste 210
Wilmington, DE 19801, United States
