Short version: the site sets no cookies and runs no ad trackers; we count visits with cookieless analytics. If you fill in the request-access form we keep what you typed so we can reply. If you call the API we log the request so we can run and secure it. The data we return is about vehicles, not people. The details are below.
Who we are and what this covers
OtoIndex is a vehicle-data product built and operated by OtoIndex Inc. (“OtoIndex”, “we”, “us”). This policy covers the public website at vinspeclookup.com, the free try-it sandbox, and the OtoIndex Car Data API (together, the “Service”).
It does not cover the Otopair shop platform at otopair.com, which has its own policy, or third-party sites we link to.
What we collect
We collect as little as the Service needs to work. Specifically:
- Request-access form. Name, work email, company, use case, expected volume, and any message you write. You choose to give us this; nothing on the site requires it.
- Sandbox and API requests. The IP address, requested route, query parameters (for example a VIN or year/make/model), timestamp, response status, and latency of each request. For authenticated API calls, the API key used.
- API accounts. When keyed access is provisioned: your name, email, company, the keys we issue you, and usage counts against your plan.
- Email you send us. If you write to us directly, we keep the correspondence.
- Site analytics. Cookieless page-view and performance measurement: the page path (never its query string), referrer, country, device and browser type, page-load timings, and a few named events such as running a sandbox request, copying a code sample, or sending the request-access form. Events never carry a VIN, your email, or anything you typed.
- Campaign tags. If you arrived through a link with
utm_tags (for example from an ad), we keep those tags for your browser session and include them with your request-access form, so we know which campaign brought you.
We do not set cookies on the marketing site, run advertising trackers or ad pixels, fingerprint browsers, or buy data about you from anyone.
How we use it
- To reply to your request and provision access to the API.
- To run, secure, and rate-limit the Service, including stopping abuse of the free sandbox.
- To meter usage and bill for paid plans.
- To diagnose failures and improve response quality and coverage.
- To send service notices about your account or the API (changes, incidents, deprecations).
We do not sell personal data, and we do not use your form submission for marketing you have not asked for.
Vehicle data and people
The data the API returns describes vehicles, not people. Fluid capacities, part numbers, service intervals, and labor times are properties of a vehicle configuration.
Per-VIN service history is delivered sanitized: it excludes owner identity, contact details, costs paid, and the identity of the shop that performed the work. It is not intended to identify, and we do not use it to identify, any individual. Do not use the Service to attempt to do so.
A VIN you send in a request is processed to answer that request and retained only in request logs as described below.
How long we keep it
- Form submissions and correspondence. until the conversation is closed and no longer needed, or you ask us to delete it.
- Sandbox rate-limit records. IP counters live in memory for the 60-second rate window and are not written to storage.
- API request logs. 90 days, then deleted or reduced to aggregate counts that no longer identify a caller.
- Site analytics. kept by our hosting provider as aggregate reports; we don't store visitor-level records ourselves.
- Account and billing records. for the life of the account, and afterwards as long as tax and accounting law requires.
Security
All traffic to the Service is encrypted in transit. API keys are shown once at creation and stored hashed; the sandbox's shared key lives only on our servers and is scoped to read-only access. Access to production data is limited to the people who operate it.
No system is perfectly secure. If we learn of a breach affecting your personal data, we will notify you without undue delay, as the law requires.
Your choices and rights
You can ask us to show you, correct, export, or delete the personal data we hold about you, or to stop processing it, by emailing developer@otopair.com. We will respond within 30 days. Deleting an account deletes its keys and stops all access immediately.
Depending on where you live (including the EU/UK under GDPR and California under the CCPA/CPRA), these rights may be guaranteed by law, and you may also have the right to complain to a supervisory authority. We do not discriminate against anyone for exercising them.
Where data is processed
We are based in the United States and process data there. If you use the Service from elsewhere, your data will be transferred to and handled in the United States under this policy.
Children
The Service is a business tool and is not directed at anyone under 18. We do not knowingly collect personal data from children; if you believe we have, contact us and we will delete it.
Changes to this policy
When we change this policy we will update the effective date above. For material changes affecting API account holders we will also email you. Continued use after the effective date means you accept the updated policy.
Contact
Privacy questions and requests: developer@otopair.com. For the terms that govern use of the API, see the Terms of Service.