Privacy Policy

Last updated: [DATE OF PUBLICATION]

This policy explains what personal information [LEGAL ENTITY NAME] (“RepairAhead,” “we,” “us”) collects through repairahead.com (the “Site”) and our emails, how we use it, and your choices. The short version: you can use the free VIN and recall check without giving us anything, and we don't store that VIN. If you join our list, we store your email and a few details about the signup. Once the paid report launches, buying one means we collect and store your VIN, mileage and related details so we can make and deliver it. We don't use advertising cookies, and we don't sell your information.

1. What we collect

a. Email list sign-ups (now)

We do not store your raw IP address, your VIN, your name, your location beyond country, or any payment card details in our sign-up database.

b. Report purchases (once sales open; not active yet)

To produce and deliver the personalized N20 Ownership / Used-Car Report, we collect and store:

Payments are handled by Stripe, Inc. Stripe collects your card details directly; we never see or store your full card number. We receive your name, email, order details, payment status and the brand and last four digits of your card. Stripe's own privacy policy covers the data it processes.

We use report data only to make, deliver and support your report (including refunds and re-issues), to keep required business records, and to fix errors in our process. We don't sell it, don't share it for advertising, and don't give it to repair shops or other businesses.

2. The free VIN and recall check

The VIN check runs in your browser. Your browser sends the VIN directly to the U.S. National Highway Traffic Safety Administration's public vPIC decoder and recalls services (vpic.nhtsa.dot.gov and api.nhtsa.gov), which also see your IP address as part of the request. We never receive or store the VIN from the free check. NHTSA's handling of that request is covered by NHTSA's own privacy policy. If you then sign up, only the decoded model description goes with your email (see the table above). If you open a link that contains a VIN (such as ?vin=…), the VIN is in the page address, so it may appear in your browser history.

3. Cookies, analytics and logs

• No advertising or tracking cookies. The Site doesn't set cookies, and we don't use advertising pixels, cross-site tracking or session recording.
• Analytics. [IF ENABLED: We use Cloudflare Web Analytics, which Cloudflare describes as privacy-first analytics that doesn't use cookies or fingerprinting, to count page views and see which pages and referrers are popular.] [IF NOT ENABLED: delete this bullet.]
• Hosting and security logs. The Site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes your IP address, browser details and the pages you request to deliver the Site and protect it from attacks, under its own privacy policy and data processing terms.

4. How we use information

We use it to: send the emails you asked for; deliver and support anything you buy; keep the Site secure and prevent spam or abuse; understand, in aggregate, how people find and use the Site; comply with law; and enforce our Terms. We don't use your information to make automated decisions that have legal or similarly significant effects on you.

5. Who we share it with

We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We share it only with service providers who process it for us under contract, and only as needed:

• Cloudflare, Inc.: hosting, storage of the sign-up list (Cloudflare Workers KV), security, and analytics if enabled.
• [ORDER STORAGE / EMAIL DELIVERY PROVIDER]: storing report orders and emailing the PDF, once sales open. [Fill in when chosen.]
• [EMAIL PROVIDER, e.g. Buttondown / Mailchimp / Resend]: sending our emails. [Add when chosen; until then, emails are not sent.]
• Stripe, Inc.: payment processing, once we sell anything (see section 1b).

We may also disclose information if the law requires it, to protect our rights or someone's safety, or to a successor if the business is reorganized (for example, into an LLC) or sold, in which case this policy continues to apply to your information. We will not share your email or vehicle details with repair shops, retailers or data buyers without first asking for your separate, express consent.

6. Emails and unsubscribing

We only email people who ticked the consent box. Every marketing email identifies us, includes our postal address and has a working unsubscribe link. We process unsubscribe requests promptly and always within 10 business days. You can also unsubscribe by emailing .

7. How long we keep it

Sign-up records stay until you unsubscribe or ask us to delete them, or until [24] months after our last email to you if you never open or click one, whichever comes first. After you unsubscribe, we keep only your email address on a suppression list so we don't email you again. Rate-limit hashes expire after about an hour. Report orders (VIN, mileage, build month, other report inputs, email and the generated PDF) are kept for [2 years] after purchase so we can handle support, refunds and re-issues, and are then deleted. [Lawyer: confirm the 2-year retention placeholder.] Basic transaction records (order ID, date, amount, tax) are kept as long as tax and accounting laws require (generally [7] years), without the VIN or mileage.

8. Security

We use reasonable safeguards for a business of our size: data is stored with Cloudflare and encrypted in transit (HTTPS); access to the list requires a secret export key known only to us; and we collect as little as possible. No method is perfectly secure. If a breach affecting your personal information happens, we'll notify you and regulators as the law requires.

9. Your choices and rights

Anyone, wherever you live, can email to: get a copy of the information we hold about you; correct it; delete it (including your report order's VIN, mileage and PDF, apart from the basic transaction records the law requires us to keep); or unsubscribe. We'll verify the request comes from the email address in question and respond within 30 days (or sooner if the law requires). We won't treat you differently for making a request.

Some state privacy laws, such as the California Consumer Privacy Act, give residents specific rights. Those laws generally apply only to businesses above certain size or data-volume thresholds, which we don't currently meet. We still honor the requests above for everyone. [Lawyer: confirm no state law currently applies, and revisit at scale or if we ever sell or license data.]

Visitors outside the U.S. The Site is run from the United States and is intended for U.S. owners of U.S.-market vehicles. If you're in the European Economic Area or the UK, we process your sign-up data based on your consent (which you can withdraw at any time by unsubscribing) and our legitimate interest in securing the Site. You may request access, correction, deletion, restriction, portability or objection, and you may complain to your local data-protection authority. Your data is stored and processed in the United States.

10. Children

The Site is meant for adults and isn't directed to children under 13. You must be 18 or older to join our list or buy anything. We don't knowingly collect personal information from children under 13; if you believe a child has given us information, email us and we'll delete it.

11. Changes to this policy

We'll post any change here with a new “Last updated” date. If we make a material change to how we use information we already have (for example, sharing it with a new kind of partner), we'll ask for your consent or email you before it takes effect, as the law requires.

12. Contact

[LEGAL ENTITY NAME] · [MAILING ADDRESS: PO box or commercial mail-receiving agency address] ·