Privacy Policy — TurboVIN
Last updated: September 18, 2026 — Effective: September 18, 2026
1. Who we are
TurboVIN is a service operated by Hexant Solutions LLC, a limited liability company organized in the state of Florida, United States.
Site: turbovin.com Address: 7901 4th St N # 35665, St. Petersburg, FL 33702, United States Privacy email: privacy@turbovin.com
This policy explains what information we collect, how we use it, who we share it with, and what control you have over it. It applies to the website, the mobile application, and all TurboVIN services.
2. Notice at collection
We collect the categories of information described in Section 3, for the purposes described in Section 6. We do not sell your personal information or share it for cross-context behavioral advertising.
You may exercise your privacy rights at any time as explained in Section 14.
3. What information we collect
3.1 Information you give us
| Data | When | Required |
|---|---|---|
| Vehicle VIN number | When you run a search | Yes |
| Email address | At payment (receipt and report delivery) or when creating an account | Yes on the web; optional in the iOS app |
| Questions to the AI chat | When you use the report chat | No |
| Support messages | If you write to us | No |
You may purchase without creating an account. The account is optional and serves to save your reports and reopen them during the 60 days in which they are available (see Section 12). We do not use passwords: you sign in with a code that we send to your email.
In the iOS app you may also purchase without providing an email address: the report is delivered in the app, and you do not receive the PDF copy by email (see Section 12).
3.2 Payment information
Payments on the web are processed through Stripe, Inc.
We do not store and do not have access to full card numbers. Stripe receives and stores that information directly under its own policies. We only receive the transaction confirmation, the last four digits, and the result of the charge.
Purchases made inside the iOS app are processed by Apple through in-app purchase, under its own policies. We do not receive your payment details: only the transaction confirmation we need to deliver your report.
3.3 Information collected automatically
- IP address
- Browser type and operating system
- Device type
- The pages and features you request, as recorded in our servers' technical logs
- A cookie that remembers the language you chose (see Section 11)
When the mobile application incorporates push notifications, it will also collect a notification token, only if you enable that feature. That feature is not available in the current version.
We do not collect precise GPS location or device advertising identifiers, and we do not use analytics or advertising tools (see Section 11).
3.4 Mobile application permissions
The application may request the following permissions. Both are optional and you will be able to revoke them at any time from your device settings.
| Permission | What for | Required |
|---|---|---|
| Camera | Scan the vehicle VIN | No |
| Notifications | Alerts about your reports | No |
If you do not grant the camera permission, you may enter the VIN manually. The application works the same.
Neither of these two features is available in the current version of the application. This section describes how we will treat them when they are released.
The application stores on your device the reports you purchase in it (its library), your recent searches, your language and, if you sign in, your session. If you purchase without an email address and without an account, it also stores a random code that lets the device you paid with reopen that report.
3.5 What we do NOT collect
- We do not ask for your Social Security number
- We do not ask for your driver's license
- We do not ask for credit information
- We do not collect biometric data
- We do not collect precise GPS location
- We do not use device advertising identifiers
- We do not collect information about your health, religion, ethnic origin, or political affiliation
4. Categories of personal information (California)
This table is included in order to comply with the disclosure requirements of the CCPA/CPRA.
| Category | Do we collect it? | Source | Who it is shared with |
|---|---|---|---|
| Identifiers (email, IP, session identifiers) | Yes | Directly from you and automatically | Stripe, Apple, Supabase, Resend, Vercel |
| Commercial information (purchases) | Yes | Directly from you | Stripe, Apple, accounting |
| Internet and network activity (server technical logs) | Yes | Automatically | Vercel |
| Approximate geolocation (by IP) | Yes | Automatically | Vercel, Supabase |
| Audio, video, or biometric data | No | — | — |
| Professional or employment information | No | — | — |
| Education information | No | — | — |
| Sensitive categories (SSN, license, health, origin) | No | — | — |
| Inferences about preferences | No | — | — |
We do not build profiles or inferences about our users. These providers receive the information to provide a service to us, not for their own advertising purposes: we do not sell personal information or share it for cross-context behavioral advertising.
Retention: see Section 12.
5. About the VIN you look up
The VIN identifies a vehicle, not a person. However, in certain cases a VIN may be linked to an identifiable person.
How we treat it:
- We store the VINs of the reports you purchase in order to show you your previous reports and to avoid charging you twice for the same report
- We do not currently store the VINs that are searched in the search tool when a purchase is not completed. If we start storing them, we will use them only in aggregate form to understand which vehicles people search for and to improve the service, and we will keep them for no more than 12 months
- We do not publish, sell, or share the list of VINs you look up
- We do not publicly link a VIN with the identity of the person who looked it up
- We do not use the VINs looked up to build profiles of people
About the Driver's Privacy Protection Act (DPPA): the personal information contained in vehicle records is protected by federal law. TurboVIN reports do not include personal information of previous owners.
6. How we use your information
- Generate and deliver the report you purchased
- Process the payment and send you the receipt
- Give you access to your reports during the 60 days following the purchase
- Answer your questions in the AI chat about that report, when that feature is available
- Handle support requests
- Detect and prevent fraud and abusive use of the service
- Diagnose technical errors and improve the stability of the service
- Understand in aggregate form what is searched for in the service and improve the product
- Send you marketing communications if you gave your consent (see Section 10)
- Comply with legal, tax, and contractual obligations
We do not use your information to make automated decisions that produce legal effects concerning you.
7. Artificial intelligence
7.1 How it works
The report includes a plain-language explanation of the records. When the AI chat is available, the report also includes a chat that answers questions about the vehicle looked up.
- The explanation of the records is prepared by TurboVIN; producing it does not send your report to any AI provider
- When you use the AI chat, your questions and the content of the report are sent to an AI service provider that processes them on our behalf, under contract, to generate each answer
- We delete the conversation history together with the report, 60 days after the purchase
7.2 Recommendation
Do not write sensitive personal information in the chat. It is designed for asking questions about the vehicle, not about you.
7.3 Limitations
Artificial intelligence explains the records in the report; it does not verify them and does not generate them. It may make mistakes. Do not make purchase decisions based solely on the chat.
8. Who we share information with
We do not sell your personal information. We share it only with:
| Who | What for | What they receive |
|---|---|---|
| ClearVin | Obtain the vehicle history | The VIN looked up |
| NHTSA (vPIC) | Decode the VIN for the free preview | The VIN looked up |
| Stripe | Process the payment on the web | Payment data and email |
| Apple | Process purchases made inside the iOS app | Transaction data |
| AI service provider (when the AI chat is available) | Generate chat answers | The content of the report and your questions |
| Supabase | Database and storage | Account and report data |
| Vercel | Hosting of the site and the API | Technical data of each request, including the IP address |
| Resend | Send receipts and communications | Email address and message content, including the PDF copy of the report that we send you upon delivery, if you gave us an email address |
| Accountants and advisors | Tax and legal compliance | Transaction records |
| Authorities | When required by law | Strictly what is required |
We could also share information in the event of a sale, merger, or acquisition of the company. If that occurs, we will notify you.
All of our providers are contractually obligated to protect your information and to use it solely to provide us with the contracted service.
9. When you share the report
The service allows you to share your report in two ways: by downloading it as a PDF, or by generating a link to share.
9.1 The sharing link
When you decide to share a report, we generate a link that is different from yours:
- It allows the report to be viewed and the PDF to be downloaded
- It does not give access to the artificial intelligence chat, which remains reserved for you as the purchaser
- You may revoke it at any time from your report. Upon revoking it, the link stops working for everyone
- In any case, it stops working when the report expires, 60 days after the purchase (see Section 12)
Your personal link, the one you receive in the purchase email, is never shared and retains full access.
9.2 What we cannot control
When you share a report, that information leaves our control. We are not responsible for how the person who receives it handles it, nor for the privacy practices of WhatsApp or of any other application you use to share it.
Whoever receives the link while it is active may view it and download the PDF. If someone has already downloaded the file, revoking the link does not delete that copy.
The PDF file you download remains on your device, under your control. If you uninstall the application, those files are handled according to the settings of your operating system, which is beyond our reach.
Share reports only with people you trust.
10. Marketing communications
We will send you transactional emails necessary for the service: receipts, confirmations, and important notices. These cannot be disabled while you use the service.
We do not currently send promotional emails. We will send them to you only if you gave your explicit consent. Purchasing a report does not amount to subscribing to marketing communications.
You may unsubscribe at any time through the link at the bottom of each email, which opens turbovin.com/en/baja, or by writing to privacy@turbovin.com.
We comply with the CAN-SPAM Act: every promotional email includes our real physical address and a functioning unsubscribe mechanism.
11. Cookies and tracking technologies
11.1 Cookies we use
We use essential cookies only. Our site sets a single cookie of its own, NEXT_LOCALE, which remembers the language you chose. Signing in does not use cookies. Payment on the web takes place on Stripe's checkout page, which sets its own cookies under its own policies.
Because we use no non-essential cookies, we do not show a consent banner or a cookie preferences page: there is nothing to accept or reject.
11.2 No analytics or advertising
We do not use analytics tools, advertising pixels (such as Meta's), or other third-party tracking technologies, on the site or in the application, and we do not use device advertising identifiers. If we ever did, we would update this policy before starting.
11.3 Browser privacy signals
We do not sell your personal information or share it for cross-context behavioral advertising, so a Global Privacy Control (GPC) signal from your browser has nothing to stop. If that changed, we would treat a GPC signal as a valid opt-out request.
12. How long we keep your information
| Data | Retention |
|---|---|
| Reports (report data, stored PDF and HTML, and sharing links), with or without an account | 60 days from the purchase |
| Account data | Until you delete the account (see Section 14.5) |
| VIN history of purchased reports | With the purchase record, which we retain as stated for payment records |
| VINs looked up without a purchase | Not currently stored; 12 months at most if we start storing them |
| Payment records | 7 years (tax and accounting obligation) |
| AI chat conversations | Deleted together with the report, 60 days from the purchase |
| Technical and security logs | Kept by our hosting provider (Vercel) under its own retention; we keep no separate copy |
| Support emails | 24 months |
| Marketing suppression list | Indefinite |
About reports: a report can be opened for 60 days from the purchase, with or without an account. After that period it expires: we delete the report data and the stored documents, and the purchaser link, the sharing links, and the chat stop working. We retain the record of the purchase. The PDF copy that we email to you when the report is delivered, if you gave us an email address, is yours, and this period does not affect it. A report purchased in the iOS app without an email address can be opened only in the app, for the same 60 days. Looking up the same vehicle again is a new purchase.
About the suppression list: when you unsubscribe, we keep a minimal record of your email address. This is necessary in order to make sure we do not contact you again, and it is required by the CAN-SPAM Act. That record is kept even if you delete your account, for the same reason.
Legal hold: if we receive a claim, a lawsuit, or a legal demand, we will suspend the automatic deletion of the relevant information until the matter is resolved.
13. Data security
We apply the following measures to protect your information:
- Encryption in transit through HTTPS/TLS across the entire site and the application
- Encryption at rest applied by our database and storage provider, Supabase, which encrypts the database, the files, and the backups on disk (AES-256)
- We do not use passwords, so we do not store any: account access is performed with a one-time code that we send to your email, which expires after a few minutes and stops working as soon as it is used
- Report access links are random credentials, and we mask them in our technical logs
- Card data never touches our servers; Stripe handles it
No transmission over the internet is 100% secure. We cannot guarantee absolute security, but we work actively to protect it.
Breach notification: if a security incident occurs that affects your personal information, we will notify you in accordance with applicable law, including Florida Statute § 501.171.
14. Your privacy rights
14.1 What you can request
Depending on where you live, you may have the right to:
- Access the information we hold about you
- Know what categories we collect, from what sources, and with whom we share them
- Correct inaccurate information
- Delete your information
- Obtain a copy in a portable format
- Opt out of the sale or sharing of your information for advertising purposes
- Limit the use of sensitive information
- Not be discriminated against for exercising these rights
14.2 How to exercise them
Write to us at privacy@turbovin.com. We do not use a form: email is the channel for every request.
We will respond within 45 days. If we need more time, we will inform you and we may extend it by an additional 45 days.
We will verify your identity before processing the request, in order to protect your information. Verification may require you to confirm the email address associated with your account or details of a purchase.
14.3 Authorized agent
You may designate an authorized agent to submit requests on your behalf. We will require proof of the authorization and we may ask you to confirm directly that you granted that permission.
14.4 Right to appeal
If we deny your request, you may appeal by writing to privacy@turbovin.com with the subject line "Appeal". We will respond within 60 days explaining our decision.
If the appeal is denied, you may file a complaint with the Attorney General of your state.
14.5 Deletion of your account
You can delete your account from the application. Deletion happens at that moment; if you ask for it by email, we carry it out after verifying your identity and in any case within 30 days. We delete:
- Your account, that is, the link between your email address and the account
- Your sessions, so every device where you were signed in is signed out
- The account's credit balance
- Any pending sign-in code
- The AI chat conversations on the reports the account held
What happens to the reports you purchased: they are not deleted early. Each one remains available through its purchase link (and, if you bought it in the iOS app without an email address, in the app on the device you paid with) until its 60 days from the purchase end; then our automatic deletion process removes it, like any other report (see Section 12). Access through the account's library stops working at once.
We retain:
- Payment records for 7 years (transaction identifier, amount, date, last four digits, and the email address of the purchase), no longer linked to the account. Tax law requires us to keep them and we cannot delete them upon request.
- Report credits purchased for your email address, which belong to that address rather than to the account.
- The record of your arbitration opt-out, if you sent one (Terms of Service, Section 19.6).
- A minimal record of your email address on our marketing suppression list, if you ever unsubscribed. We keep it precisely so as not to contact you again, and the CAN-SPAM Act requires us to maintain it.
- Technical logs kept by our hosting provider, until they expire under its own retention.
Deletion is permanent. We cannot restore a deleted account, and once a report is deleted we cannot recover it. If you need it again, you will have to purchase it again.
Deleted data may remain in our database provider's backups until those backups expire under its own retention.
If you uninstall the application, the files you have downloaded to your device are deleted according to the settings of your operating system. That is beyond our control.
If you purchased without creating an account, you may ask us to delete your data by writing to privacy@turbovin.com from the email address you used for the purchase.
14.6 California residents
Under the CCPA/CPRA you have the rights described above. TurboVIN does not sell your personal information or share it for cross-context behavioral advertising, as the CCPA/CPRA defines those terms, and has not done so in the preceding 12 months. For that reason we do not offer a "Do Not Sell or Share My Personal Information" link: there is no sale or sharing to opt out of. If that ever changed, we would update this policy and give you that choice before it began.
We do not sell or share the personal information of minors under 16 years of age.
14.7 Florida residents
Under the Florida Digital Bill of Rights you have equivalent rights of access, correction, deletion, portability, and opt-out.
14.8 Other states
Residents of states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana, among others, have substantially similar rights. We apply these rights uniformly to all users in the United States.
15. Minors
TurboVIN is directed at persons over 18 years of age. We do not knowingly collect information from minors under 18 years of age.
If we discover that we have collected information from a minor, we will delete it. If you are a parent or guardian and you believe that your child gave us information, write to us at privacy@turbovin.com.
16. International transfers and access from abroad
Our servers and most of our providers are located in the United States. If you access from outside the U.S., your information is transferred to and processed there, where data protection laws may differ from those of your country.
Part of our technical team operates from outside the United States and may access operational data in the course of their duties. That access is subject to contractual confidentiality obligations.
17. Third-party links and services
Our site and application may link to third-party sites or integrate with them. We are not responsible for their privacy practices. We recommend that you read their policies.
The application stores (Apple App Store and Google Play) collect their own information when you download the application, subject to their policies.
18. Changes to this policy
We may update this policy. When we do, we will change the "last updated" date above. Previous versions are available on request from privacy@turbovin.com.
If the change is material, we will notify you by email or through a visible notice on the site at least 30 days before it takes effect.
19. Contact
Hexant Solutions LLC 7901 4th St N # 35665 St. Petersburg, FL 33702 United States
Privacy: privacy@turbovin.com Support: support@turbovin.com Web: turbovin.com