What we collect
VINs you look up. A VIN identifies a vehicle, not a person. When you look one up, we cache the result for 30 days: the decoded vehicle data, whether a sticker is available, and the sticker PDF if the manufacturer publishes one. That way the next lookup is instant and we don’t hit manufacturer and government servers again. If no sticker exists, the result is cached for 24 hours. We also keep a simple log of searches (the VIN, the vehicle and whether a sticker was found, with no IP address or other personal data) so we can see which brands people look up.
Your IP address, briefly and only in hashed form, to rate-limit lookups (20 per hour) and stop abuse. We store a one-way hash, not the address itself, and limiter entries are overwritten every hour.
Anonymous visit counts. To see how the site is doing, we record which page was viewed, the referring website, the country (from Cloudflare), whether it’s a phone or a computer, and browser errors or clicks on the buy, scan and example buttons. To count distinct visitors in a day we store a one-way hash of your IP address and browser, salted and reset every day, so it can’t be traced back to you or linked across days. These records are deleted after 60 days.
Your email address, only if you buy a report, sign in (by email link or with Google) or use the contact form. If you sign in with Google, Google tells us only your email address; we don’t get your password, contacts or anything else. We use it to send your report link, sign-in links, receipts and replies to your messages. We don’t send marketing email.
Orders and reports. If you buy a report, we keep the order (product, VIN, email, amount and status) and the report itself, so your permanent report link keeps working.
Payments
Dodo Payments processes all payments as our merchant of record, so your receipt comes from them. We never see or store your card number. Dodo Payments’ own privacy policy applies to the payment details you give them.
Cookies
We only use cookies the site needs to work:
sbv_pass: remembers for one hour that you passed the bot check, so you don’t have to solve it on every lookup.sbv_session: keeps you signed in to your account for 30 days. Only set if you sign in.sbv_oauth: lasts 10 minutes while you sign in with Google, to make sure the sign-in came from your browser.
Our visit counts use no cookies and don’t track you across sites. We don’t use advertising trackers.
Who we share data with
Only the services we need to run the site:
- Cloudflare: hosting, security and the bot check (Turnstile).
- Dodo Payments: payments (merchant of record).
- Resend: sending emails.
- Google: only if you choose “Continue with Google” to sign in.
- NHTSA and vehicle manufacturers: they get the VIN and nothing about you when we look it up.
- Our licensed data partners: they get the VIN only, and only when you buy a report that needs their data.
We never sell your data, and we don’t share it with advertisers.
Affiliate links
We don’t show affiliate links today. If we add them and you click one, the partner’s site may set its own cookies to credit us for the referral. Their privacy policy applies on their site. See our affiliate disclosure.
Your rights
You can ask us to show you, correct, export or delete the personal data we hold about you: your email, orders and reports. Email support@stickerbyvin.com from the address you used. If you’re in the EU/EEA or the UK, you also have your rights under the GDPR, including the right to complain to your data-protection authority. We keep order records for as long as accounting law requires.
Changes
If this policy changes, we’ll update the date at the bottom of this page.
Last updated November 5, 2026.
