What we collect, and the shorter list of what we do with it.

When a dealership signs up and uses the service, we collect:

We ingest the vehicle records your feed sends: VIN, stock number, specification, mileage, price, description, and photographs, which we re-host so they load quickly and stay available. We store a snapshot of each feed payload so we can tell what changed and avoid reprocessing what did not.

This is business data about vehicles, not personal information about people. If your feed contains personal information, for example a salesperson's name in a free-text description, it is published as part of that listing, so do not put anything in a feed you would not want on a public page.

A lead form on a dealer's listing page collects the name, email, phone, and message the shopper enters, along with the vehicle they were looking at and how they arrived.

We store that inquiry and deliver it to the dealership, by email or to their CRM. The dealership decides how it is then used and how long they keep it. We keep our copy so the dealer has a record and so delivery failures can be retried and audited.

We do not sell inquiries, broker them, share them with any other dealership, or use them to market anything of our own. This is not only a policy: charging for or reselling leads would break the model the whole product is built on.

The point of this product is telling a dealer that AI systems are reading and citing their inventory. That takes measurement, so it is worth stating exactly how much.

When a page on a dealer surface is requested, we may write one row recording: which dealer, which vehicle, what kind of visitor it was (a crawler, a verified agent, a person arriving from an AI answer, or an agent tool call), which AI platform it is attributable to, the referring URL, the path, the browser or bot user agent string, and the time.

We do not log IP addresses. There is no column for one. On dealer surfaces we do not build a profile of a visitor, we do not track anyone across sites, and we do not run advertising or identification tags. The one third-party tag there is Google Analytics, described below.

On dealer surfaces, apart from the referral cookie and Google Analytics described below, one first-party cookie is used, and only for attribution. When an AI crawler or a verified agent fetches a vehicle page, we set a cookie named __ai_ref that holds the name of that platform and nothing else. It lives for five minutes, it is read once and then cleared, and its only job is to connect the AI system that looked at a page to the person who arrives moments later with no referring URL. It carries no identifier and cannot be read by JavaScript or by another site.

One more first-party cookie can be set on any of our pages, but only when you arrive through a referral link, which is a link carrying a dealership's referral code. We then set a cookie named vi_ref that holds that code and nothing else, for 30 days, so that if you sign up, the dealership that referred you receives the free month our referral program promises. It says nothing about you, and it cannot be read by JavaScript or by another site.

We also run Google Analytics, and it is worth being plain about where. It runs on our own marketing site at vinindex.ai, and on the pages we publish for dealerships, measured in two separate properties so the two never mix. It sets its own cookies, which let it tell a returning browser from a new one, and lets us see which pages people land on, where they arrived from, and how they move through the pages. On dealership pages we use it to learn how shoppers use the pages we build, so we can make them better. There it does not load at all if your browser sends a Global Privacy Control signal. It is not in the dealer dashboard, and nothing it collects is shown to a dealer or used in any figure we report to one. We have switched off Google Signals and ad personalization on both properties, so it cannot be used to build advertising audiences or to follow anyone across other sites.

On vinindex.ai, including our marketing pages, signup, and the dealer dashboard, we also use PostHog to understand how people use the product: which pages they view, what they click, where a signup stalls, and which dashboard features dealers use. When you are signed in, those events are linked to your account and email address. PostHog may also record replays of sessions to help us fix confusing screens, with everything typed into forms masked. PostHog acts only on our instructions, never runs on a dealership's pages, and nothing it records is shown to a dealer or used in any figure we report to one.

Many of the visits to those pages are not people at all but the email security services that open every link in an email before it reaches the inbox. So that our numbers count people rather than those scanners, our servers check whether a visit to vinindex.ai comes from a network those services use. The address is checked and not kept. When it matches, we set a first-party cookie named vi_net that holds only that label, such as scanner_ip, for one day, and our analytics mark that browser's activity as a scanner's. The same label stops those services from removing a report a dealership has not asked us to remove.

Our marketing pages also run a website visitor identification service provided by Instantly, our sales email provider, through its Leadsy tag, which uses RB2B to do the identifying. We use it so that when someone from a dealership looks at our site, we can find out who they are and follow up with them about VIN Index. When the tag loads, RB2B receives the page you are on, the page that referred you, your browser details, and your IP address, and sets its own cookies; its script also looks up your approximate location from your IP address through a geolocation service. RB2B matches that against information it holds or obtains from its own sources, and may send us a name, work email address, job title, employer, and a professional profile link. Those details go into Instantly so we can contact you.

That service is confined much more tightly than Google Analytics. It never runs on a dealership's pages, in the dealer dashboard, on the private pages we prepare for individual dealerships, or on our privacy choices page. It does not load at all if your browser sends a Global Privacy Control signal, or if you have opted out on our privacy choices page. Section 16 explains how.

Some pages let a shopper pick a credit band, such as excellent or rebuilding, to see a realistic estimated monthly payment. That selection is something the shopper tells us about themselves in order to get useful arithmetic back. It is not a credit check.

We do not pull your credit. We do not obtain, request, or receive a consumer report or a credit score about you from anyone, we are not a consumer reporting agency, and choosing a band has no effect of any kind on your credit. Nothing on this platform runs a credit application.

A self-selected band is never attached to your identity in anything we publish or analyse. Where we report on shopping patterns, credit band appears only as an aggregate dimension across many people and is never joined to a name, an email, or an inquiry.

We use the information above to do the things the service exists to do, and not for other purposes:

Some of these are commercially tempting, which is why they are written down.

We use a small set of service providers, each for a stated purpose and under an agreement that limits them to it. None of them is permitted to use the information for their own purposes.

Our infrastructure and our service providers operate in Canada and the United States, and information may be processed in either country. While it is in another country it is subject to the laws of that country, including lawful access by its courts and authorities.

Where information leaves the country it was collected in, it stays protected by our agreements with those providers and remains subject to this policy. We remain accountable for it.

We keep information only as long as it serves the purpose it was collected for, or as long as the law requires. In practice that means:

Write to hello@vinindex.ai and mark it for the Privacy Officer. That address reaches the person accountable for privacy here, and it is the route for every request described in this section and the next. A postal address is available on request.

You can ask us for access to the personal information we hold about you, ask us to correct anything inaccurate, ask us to delete it, ask for a portable copy, and withdraw a consent you previously gave, subject to the limits the law puts on each of those. Withdrawing consent may mean we can no longer provide part of the service, and we will tell you plainly if that is the case rather than letting it fail quietly.

We acknowledge requests within 10 business days. We respond substantively within 30 days for requests under Canadian federal privacy law, and within 45 days for requests under a US state privacy law, with one further extension where the statute allows it and we tell you why. We do not charge for this.

We need to be able to tell it is you. We verify a request against information we already hold rather than asking you for new identity documents, and if we genuinely cannot verify you we will say so rather than handing your information to someone else.

If you think we have got something wrong, tell us and we will look at it again. You can also complain to the Office of the Privacy Commissioner of Canada, or to your state Attorney General, and you do not have to come to us first.

If you live in California, Virginia, Colorado, Connecticut, Texas, Utah, Oregon, Montana, or another state with a comprehensive privacy law, this section sets out what those laws give you and how our practices map onto their defined terms.

The categories of personal information we collect, in the statutory vocabulary, are: identifiers (name, email address, phone number, account identifier); customer records information (name, address, phone number); commercial information (plan, billing history, and the vehicle someone inquired about); internet or other electronic network activity information (the path requested, the referring URL, and the user agent string); and professional information (a person's role at a dealership). We collect these from you directly, from a dealership that gave them to us, from a dealer's inventory feed, from signup and recurring reads of public business-profile sources and a dealer's own contact or about pages, from the request itself when a page is fetched, and, for visitors to our own marketing site, from our visitor identification provider.

We do not collect biometric information, precise geolocation of an individual, sensory data, education records, or protected classification characteristics. The only inference we hold about anyone is the one our visitor identification provider makes about who a marketing-site visitor is and where they work, and we do not use it to make any decision about that person beyond whether to contact them. The only category of sensitive personal information we hold is a dealer account credential, used solely to log that dealer in. We do not use or disclose sensitive personal information for any purpose beyond providing the service, so the right to limit its use has nothing to act on here.

You have the right to know and access what we hold, to correct it, to delete it, to obtain a portable copy, and to opt out of sale, sharing, targeted advertising, and profiling.

On sale and sharing: in the preceding 12 months, the only personal information we may have sold or shared is what the visitor identification tag on our own marketing site collects, which is identifiers and internet or other electronic network activity information, disclosed to RB2B and Instantly. We treat that as a sale, and as sharing for cross-context behavioural advertising, under every state law that could define it as one. You can opt out on our privacy choices page at vinindex.ai/privacy/choices, linked in the footer of every page as "Do not sell or share my personal information", or by writing to us. We honour a Global Privacy Control signal as a valid opt-out: when your browser sends one, the tag does not load.

On targeted advertising and profiling: we do not use personal information for targeted advertising, we run no third-party advertising trackers, and we do not profile anyone in furtherance of decisions that produce legal or similarly significant effects. Google Analytics runs on our marketing site and on dealership pages with Google Signals and ad personalization turned off, so it is not used for advertising.

If we refuse a request, we will tell you why, and you may appeal by replying to that decision. We will respond to an appeal in writing within 45 days. If we deny the appeal we will give you a way to complain to your state Attorney General.

An authorized agent may make a request for you if you give them written permission and we can verify it. We will never deny you a service, charge you a different price, or give you a lower quality of service because you exercised a privacy right.

We do not knowingly sell or share the personal information of anyone under 16. Our marketing site is directed at dealership staff, and we have no actual knowledge of having identified anyone under 16.

Access to the database is denied by default and granted per row, so one dealer's data is not reachable from another dealer's session. Administrative credentials are used only on the server and are never sent to a browser. Traffic is encrypted in transit. Passwords are stored hashed. Webhooks we send are signed so the receiver can verify them.

No system is perfectly secure, and we will not claim otherwise.

If a breach of our safeguards creates a real risk of significant harm to you, we will notify you and report it to the Office of the Privacy Commissioner of Canada, and to any US state regulator the law requires, as soon as feasible. We keep a record of every breach of security safeguards for at least 24 months, whether or not it was reportable, and we will give that record to the Commissioner on request.

This service is for dealerships and for adults shopping for a vehicle. It is not directed to children, and we do not knowingly collect information from them. If you believe a child has given us information, tell us and we will delete it.

This policy carries a version. When we make a substantive change we publish a new version and ask dealers to accept it. The version a dealer accepted, and when, is recorded on their account.

We review this page at least once every 12 months and update the version stamp when we do, so the date at the top is a date someone actually looked, not the date the file was created.

You can stop our visitor identification service from running for you in either of two ways. Set a Global Privacy Control signal in your browser, and the tag will not load on any of our pages. Or use the "Do not sell or share my personal information" link in the footer of every page, which takes you to vinindex.ai/privacy/choices.

The privacy choices page stores your decision in a first-party cookie named vi_optout, which lasts two years and does nothing except stop the tag from loading. It applies to the browser you set it in. To opt out across every device, or to have us delete the details we already hold about you, write to us at the address below.

If we have emailed you because you were identified on our site, every message we send includes a way to unsubscribe, and we stop within 10 business days of your request. We only email people about VIN Index in their capacity at a business, and we never use this route to contact car shoppers.

Opting out never affects a dealership's pages, their listings, or anything a dealer customer receives from us.