Privacy Policy

DRAFT FOR ATTORNEY REVIEW. NOT LEGAL ADVICE. A non-lawyer wrote this draft to match what the site's code actually does as of [DATE]. A licensed attorney needs to review it before launch. Items in [BRACKETS] must be completed, and notes marked “Lawyer” are to be removed before publishing. If the code changes (new fields, an email provider, analytics, payments), update this page first.

Last updated: [DATE OF PUBLICATION]

This policy explains what personal information [LEGAL ENTITY NAME] (“RepairAhead,” “we,” “us”) collects through repairahead.com (the “Site”) and our emails, how we use it, and your choices. The short version: you can use the VIN and recall check without giving us anything. We only store your email and a few details about the signup if you join our list, we don't use advertising cookies, and we don't sell your information.

1. What we collect

Information	When	Why
Email address	You join the list	To send the checklist, launch news and related emails you asked for
Consent record: that you ticked the consent box, the wording you agreed to and its version	You join the list	To show that you asked to hear from us
Sign-up time (date and time)	You join the list	Record-keeping and consent proof
Vehicle model decoded from your VIN check (for example “2014 BMW 328i”), not the VIN itself	Only if you ran a VIN check before signing up	To send information relevant to your car
How you found us: the form name, campaign tags in the link you clicked (UTM parameters), and the referring page address (the browser's Referer header)	You join the list	To understand which channels work
Country (two-letter code, estimated by our host from your IP address)	You join the list	To understand where readers are and which laws apply
Hashed IP address: a one-way SHA-256 hash of your IP address combined with a secret value, used as a counter key	Each sign-up attempt	To block spam (at most 10 attempts per hour). Deleted automatically after about an hour, and never linked to your email

We do not store your raw IP address, your VIN, your name, your location beyond country, or any payment card details in our sign-up database.

2. The VIN and recall check

The VIN check runs in your browser. Your browser sends the VIN directly to the U.S. National Highway Traffic Safety Administration's public vPIC decoder and recalls services (vpic.nhtsa.dot.gov and api.nhtsa.gov), which also see your IP address as part of the request. We never receive the VIN. NHTSA's handling of that request is covered by NHTSA's own privacy policy. If you then sign up, only the decoded model description goes with your email (see the table above). If you open a link that contains a VIN (such as ?vin=…), the VIN is in the page address, so it may appear in your browser history.

3. Cookies, analytics and logs

No advertising or tracking cookies. The Site doesn't set cookies, and we don't use advertising pixels, cross-site tracking or session recording.
Analytics. [IF ENABLED: We use Cloudflare Web Analytics, which Cloudflare describes as privacy-first analytics that doesn't use cookies or fingerprinting, to count page views and see which pages and referrers are popular.] [IF NOT ENABLED: delete this bullet.]
Hosting and security logs. The Site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes your IP address, browser details and the pages you request to deliver the Site and protect it from attacks, under its own privacy policy and data processing terms.

4. How we use information

We use it to: send the emails you asked for; deliver and support anything you buy; keep the Site secure and prevent spam or abuse; understand, in aggregate, how people find and use the Site; comply with law; and enforce our Terms. We don't use your information to make automated decisions that have legal or similarly significant effects on you.

5. Who we share it with

We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We share it only with service providers who process it for us under contract, and only as needed:

Cloudflare, Inc.: hosting, storage of the sign-up list (Cloudflare Workers KV), security, and analytics if enabled.
[EMAIL PROVIDER, e.g. Buttondown / Mailchimp / Resend]: sending our emails. [Add when chosen; until then, emails are not sent.]
Stripe, Inc.: payment processing, once we sell anything. Stripe collects your payment details directly; we receive only your name, email, order details and the last four digits and brand of your card.

We may also disclose information if the law requires it, to protect our rights or someone's safety, or to a successor if the business is reorganized (for example, into an LLC) or sold, in which case this policy continues to apply to your information. We will not share your email or vehicle details with repair shops, retailers or data buyers without first asking for your separate, express consent.

6. Emails and unsubscribing

We only email people who ticked the consent box. Every marketing email identifies us, includes our postal address and has a working unsubscribe link. We process unsubscribe requests promptly and always within 10 business days. You can also unsubscribe by emailing .

7. How long we keep it

Sign-up records stay until you unsubscribe or ask us to delete them, or until [24] months after our last email to you if you never open or click one, whichever comes first. After you unsubscribe, we keep only your email address on a suppression list so we don't email you again. Rate-limit hashes expire after about an hour. Purchase records are kept as long as tax and accounting laws require (generally [7] years).

8. Security

We use reasonable safeguards for a business of our size: data is stored with Cloudflare and encrypted in transit (HTTPS); access to the list requires a secret export key known only to us; and we collect as little as possible. No method is perfectly secure. If a breach affecting your personal information happens, we'll notify you and regulators as the law requires.

9. Your choices and rights

Anyone, wherever you live, can email to: get a copy of the information we hold about you; correct it; delete it; or unsubscribe. We'll verify the request comes from the email address in question and respond within 30 days (or sooner if the law requires). We won't treat you differently for making a request.

Some state privacy laws, such as the California Consumer Privacy Act, give residents specific rights. Those laws generally apply only to businesses above certain size or data-volume thresholds, which we don't currently meet. We still honor the requests above for everyone. [Lawyer: confirm no state law currently applies, and revisit at scale or if we ever sell or license data.]

Visitors outside the U.S. The Site is run from the United States and is intended for U.S. owners of U.S.-market vehicles. If you're in the European Economic Area or the UK, we process your sign-up data based on your consent (which you can withdraw at any time by unsubscribing) and our legitimate interest in securing the Site. You may request access, correction, deletion, restriction, portability or objection, and you may complain to your local data-protection authority. Your data is stored and processed in the United States.

10. Children

The Site is meant for adults and isn't directed to children under 13. You must be 18 or older to join our list or buy anything. We don't knowingly collect personal information from children under 13; if you believe a child has given us information, email us and we'll delete it.

11. Changes to this policy

We'll post any change here with a new “Last updated” date. If we make a material change to how we use information we already have (for example, sharing it with a new kind of partner), we'll ask for your consent or email you before it takes effect, as the law requires.

12. Contact

[LEGAL ENTITY NAME] · [MAILING ADDRESS: PO box or commercial mail-receiving agency address] ·