Privacy Policy

When you check a VIN

• Your browser sends the VIN to our server, which looks it up with the public vPIC service of the US National Highway Traffic Safety Administration (NHTSA). To find recalls, complaints and safety ratings, our server sends NHTSA the vehicle’s make, model and model year (or NHTSA’s own vehicle ID), not the VIN.
• Our server logs record the VINs that are looked up and any error messages from NHTSA. These logs are kept by our hosting provider, Vercel. Apart from these logs, our server doesn’t store your VIN checks.
• When you start a check from another page, the VIN becomes part of the page address (for example/vin-check?vin=…). It can then appear in your browser history and in the page addresses that analytics tools record (see below).
• You don’t need an account or contact details to check a VIN, and we don’t keep a history of your checks for you.

Links to carVertical

• The paid vehicle history report is sold by carVertical, a separate company. Our links to carVertical contain an affiliate code and, once you’ve entered one, the VIN you checked. carVertical receives them when you open such a link. Read more about how we make money.
• If our free lookup can’t identify the vehicle, the VIN check redirects you to carVertical automatically, and the VIN is passed on in the same way.
• Buying a report and paying for it happens on carVertical’s website, under carVertical’s own privacy policy and terms. ProVINCheck doesn’t see your payment details.

When you use the contact form

The contact form asks for your name, email address and message. Our server sends them in one email, through Google’s Gmail service, from the site’s own mailbox to the site owner’s mailbox, with your email address as the reply-to address so that we can answer you. The server doesn’t log your message or store it anywhere else; the email stays in those mailboxes.

Analytics

The site uses these analytics services:

• Google Analytics (Google). It loads on every page, whatever you choose in the cookie banner, including “Essential Only”. It records visits and the pages you view, including their addresses, and uses cookies to recognise returning browsers.
• Vercel Web Analytics and Speed Insights (Vercel, our hosting provider). They load on every page, whatever you choose in the cookie banner, and measure page views and how fast pages load.
• Microsoft Clarity (Microsoft). It loads on every page and records how pages are used, such as clicks, scrolling and mouse movement, to produce session recordings and heatmaps. The site passes your cookie choice to Clarity’s consent setting: “Accept All Cookies” sends a consent signal when you click it and on every later page load; “Essential Only” sends a signal that you don’t consent when you click it, but later page loads send no signal, so Clarity’s default settings apply. Before you choose, no signal is sent.

We also send these tools a few events of our own, such as “VIN search submitted” (with the length of the VIN entered) and clicks on report buttons (with the button’s position and label, your device type and whether a valid VIN had been entered). These events don’t contain the VIN itself, but the page address recorded with a page view can, as explained above. Clarity receives only the event names.

We don’t currently use the Facebook (Meta) Pixel or any other advertising tracker.

Cookies and browser storage

The site’s own scripts store these items in your browser (our server sets no cookies):

• cookieConsent (local storage): your cookie banner choice. It stays until you clear this site’s data.
• theme (local storage): light or dark mode, saved only if you switch it yourself.
• NEXT_LOCALE (cookie): the language you picked in the language switcher. It expires after one year.
• Session storage: whether you closed a promotional pop-up or have seen the image slider hint. It is cleared when you close the tab.

Google Analytics and Microsoft Clarity can also set their own cookies, as described by Google and Microsoft.

Other services your browser connects to

• Vercel hosts the site. As with any website, delivering a page involves processing your IP address and the details your browser sends with each request.
• The map on the USA page loads map data from the jsDelivr content delivery network (cdn.jsdelivr.net), so your browser connects to it directly.
• Fonts and images are served from our own domain. Facebook and Instagram are only contacted if you click our links to them; we don’t embed their widgets.
• When a browser blocks content under our security policy, it can send us a report. Our server logs only the type of rule, the origins involved and the page path, without query strings, IP addresses or browser details.
• Our server refuses requests to its data endpoints that don’t come from this site. For a refused request it logs only the method, the path and a reason code, without header values or query strings.

Your choices

• To change your cookie banner choice, clear this site’s data in your browser settings; the banner then appears again.
• You can block cookies and scripts with your browser settings or extensions. Google offers a browser add-on for opting out of Google Analytics.
• The VIN is sent to carVertical only when you open one of our carVertical links or the VIN check redirects you there.

Questions and requests

For questions about this policy or requests about your data, please write to us through our contact form.

If the way the site handles data changes, we will update this page and the date above. See also our Terms of Use and About page.