What we collect when you use Vindraft, why we collect it, and how to control it.
Last updated: October 23, 2026
This policy explains what Valtora Ventures LLC ("Vindraft," "we," "us") collects when you use vindraft.com, why we collect it, and what choices you have. It applies to visitors and customers of our site.
| What | When | Why |
|---|---|---|
| Email address | You sign in or buy a report | To send your one-time sign-in code, your report and receipts |
| VIN or license plate you search | You run a check | To look up and save your report |
| Payment details | You pay for a report or plan | Card numbers go straight to Stripe, our payment processor. We only keep the amount, date and a Stripe reference ID, never your full card number |
| Sign-in session | You sign in | Keeps you signed in for up to 30 days, in a cookie named vindraft_session |
| Report history | You run a check | So you can reopen a report you already paid for, from your account |
| Site usage | You visit pages | Pages viewed and steps completed, through Google Analytics (see section 3) |
If you enter your email and do not finish checking out, we may email you up to three reminders with a link back to your report. Every one has an unsubscribe link.
Our own sign-in cookie, vindraft_session, stores nothing but a random session code. It is HttpOnly, so page scripts cannot read it, and SameSite=Lax, which blocks it from being sent on requests from other sites.
We use Google Analytics to understand how people use the site, for example which pages they visit and which steps of a check they complete. It sets its own cookies (named _ga). We never send Google your email address, your name, or the VIN you searched. If you reached us through a Google ad, Google may record that click so we can tell which ads lead to purchases.
You can block these with your browser's cookie settings, the Google Analytics opt-out add-on, or Google's ad settings. Stripe sets its own cookies on the payment form to prevent fraud.
We briefly check the IP address behind a sign-in code request, only to stop automated abuse. We do not use it to build a location profile of you.
We do not sell your personal information. We share it only with:
We keep your account and report history while your account is open, so you can come back to past reports. If you ask us to delete your account, we delete your personal information within a reasonable time, except payment records we must keep for tax or legal reasons.
Vindraft is for adults. It is not directed at children under 18, and we do not knowingly collect information from them.
Sign-in codes and session tokens are stored as one-way hashes, not plain text, so even we cannot read them back. Payment happens through Stripe's own encrypted form. No system is perfectly secure, but we build with these protections on purpose.
If we change this policy in a meaningful way, we will update the date at the top of this page and, where required by law, tell you by email.
Questions about your data? Email support@vindraft.com.
Valtora Ventures LLC