What we collect, and what we do not

The short version

• We never see or store your card details. Payment happens on Paystack.
• We store your email address, the VINs you checked, and your orders.
• We do not sell your data, and we do not tell anyone which VIN you looked up.
• The seller of the car is never notified that you ran a check.
• You can ask us to delete everything, and we will.

What we collect

When you decode a VIN

The VIN itself. The free decode does not require an account or an email address, and a decode you never pay for is not attached to you.

When you buy a report

Your email address, the VIN, a phone number if you give us one, and the details of the order — amount, currency, payment reference, the channel you paid by (card, transfer or USSD) and the fee. We keep this because it is the record of a transaction: it is how your report reaches you, how you sign in to read it again, and how we answer you if something goes wrong.

When you sign in

We email you a one-time link. We store a hashed version of that link and a session identifier tied to your email address. There is no password to steal because there is no password.

What we never hold

Card numbers, CVVs, bank credentials or BVNs. Payment is handled entirely by Paystack, a licensed Nigerian payment processor — the card details are entered on their systems, not ours, and they are never transmitted to us. We receive only a reference confirming a payment succeeded.

Why we hold it

To deliver the report you paid for, to let you sign back in and read it, to apply bundle credits you have already bought, to answer support questions, and to keep the financial records a business is required to keep.

We do not build advertising profiles, and we do not sell or rent your details to anyone.

Who else sees anything

Running a report means asking other parties about a vehicle. We send them the VIN. We do not send them your name, email or phone number.

• Vehicle history providers. The VIN only, to retrieve the US accident, salvage, title and odometer records.
• Local verification partners. The VIN only, for the Nigerian customs, registration and stolen-vehicle checks.
• Paystack. Your payment details, which you give to them directly.
• Our email provider. Your email address, so we can send your report and your sign-in links.
• Our hosting provider. Which runs the servers this site sits on.

We may also disclose information where the law requires it — for example a valid order from a Nigerian court or law-enforcement authority.

How long we keep it

Reports are cached for a limited period so that re-checking the same VIN does not bill the upstream source twice; after that the cached copy expires. Sign-in links expire shortly after they are issued, and sessions expire on their own. Order records are kept longer, because they are financial records.

If you ask us to delete your account, we remove your email address, your credits and your saved reports. We may retain the minimum transaction record required for accounting, with your personal details stripped from it.

Your rights

Under the Nigeria Data Protection Act you can ask us what we hold about you, ask us to correct it, ask us to delete it, and object to how we use it. Write to hello@carcheck.ng and we will respond.

Cookies

We set a cookie to keep you signed in. That is what it is for, and it is not used to track you across other websites. We do not run advertising cookies.

Children

This is a service for people buying vehicles, and it is not directed at anyone under 18.

Changes

If we change what we collect or who we share it with, we will change this page. It lives in the same repository as the site, so its history is part of the site’s history.

Contact

Questions about any of this, or a request to see or delete your data: hello@carcheck.ng.