Privacy Policy

This Privacy Policy describes how Latent Software LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA ("we", "us"), processes personal information in connection with VehiclesDB (the websites, APIs, and services available at vehiclesdb.com). For the services, we are the data controller. This Policy supplements any privacy terms in the Latent Software Terms; for VehiclesDB, this Policy controls.

The short version: VehiclesDB is a database about vehicles, not people. We collect the account, billing, and usage information needed to run a paid data service, we use service telemetry (including API queries) to operate, secure, and improve the services, and we do not sell personal information.

1. What we collect

Account data — email address, name (if provided), password hash, organization/workspace membership, and settings.
Billing data — processed by Stripe, our payment processor; we receive and store customer, subscription, invoice, and payment-status records, but we do not store full payment-card numbers. Stripe's own privacy policy applies to its processing.
Usage and log data — API requests and website visits generate logs and metering records: request parameters and inputs (for example, query strings submitted to resolution endpoints), endpoints called, volumes, timestamps, response codes, IP address, and user-agent.
Security and session data — sign-in events (successful and failed), session and device records (IP address, user-agent, approximate location derived from IP), used for account security features such as device management and new-device alerts.
Agreement acceptance records — when you accept our terms (at signup and at certain later events), we record the documents and versions accepted, the timestamp, your IP address, and your browser user-agent, as evidence of contract formation.
Communications — emails and support messages you send us.
Website analytics — we measure how the website is used with two tools: Umami, which we host ourselves and which sets no cookies, and Google Analytics 4, a Google service that does set cookies in your browser. Between them they record pages viewed, the referring page, approximate location derived from IP address, device and browser type, and on-page interactions.
Session replay and heatmaps — our self-hosted Umami instance also records a reconstruction of on-page activity (clicks, scrolling, mouse movement, and navigation between pages) so we can find where the interface confuses people. Session replay runs on our public website pages only — it is not active on our sign-in and sign-up pages, or in the signed-in account areas (dashboard, settings, billing, and organization pages). Text entered into form fields is masked and is not recorded, and replays are retained for 30 days and then deleted.
Cookies — we use strictly necessary cookies (session, authentication, CSRF) and analytics cookies set by Google Analytics. We do not run advertising trackers, and we have disabled Google Signals and ad personalization on our Google Analytics property, so analytics data is not used to build advertising profiles. See "Your rights" below for how to opt out of analytics.

Do not submit personal data through the API except where the documentation expressly provides for it; API inputs are processed and retained as described below.

2. How we use it

to provide, operate, meter, and bill the services (performance of a contract);
to secure the services and accounts, prevent fraud and abuse, and enforce our terms (legitimate interests; legal obligations);
to operate, analyze, and improve the services and our datasets, including using submitted queries and telemetry to improve matching, coverage, and quality (legitimate interests; contract);
to understand how the website is used and to diagnose usability problems, using the website analytics and session replay described above (legitimate interests; consent where the law of your country requires consent for analytics cookies or similar technologies);
to communicate service, security, and billing notices, and, with your consent where required, product news (you can opt out of non-essential email at any time);
to comply with law, and to establish, exercise, or defend legal claims — including retaining agreement-acceptance records as evidence of contract formation and for fraud prevention.

We may aggregate or de-identify data so it no longer relates to an identifiable person and use and disclose such data for any purpose.

3. Sharing

We share personal information only with: service providers acting on our instructions (hosting and infrastructure, content delivery and DDoS protection, payment processing (Stripe), email delivery, error and log tooling, website analytics and session replay (Google Analytics, and our own Umami instance)); professional advisers (lawyers, accountants) under confidentiality; authorities where required by law or to protect rights, safety, or the integrity of the services; and successors in connection with a merger, acquisition, financing, or sale of assets, in which case this Policy continues to apply until amended. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

4. International transfers

We are a U.S. company; data is processed in the United States and in the countries where our providers operate. Where required (for example, for transfers from the EEA/UK/Switzerland), we rely on the European Commission's Standard Contractual Clauses (a copy is available on request via [email protected]) or, where applicable, an adequacy decision or a provider's certification under a recognized transfer framework.

5. Retention

We keep account data for the life of the account; agreement-acceptance records for the life of the account and thereafter for as long as needed to establish, exercise, or defend legal claims (typically the applicable limitation periods); billing records as required by tax and accounting law; security logs and session records for a limited operational period; session replay recordings for 30 days; website analytics data for the retention period configured on the relevant analytics property; and API/service logs for as long as needed for the purposes above, after which they are deleted, aggregated, or de-identified. Specific retention periods or criteria for each category are available on request. We may retain data longer where required by law or to resolve disputes.

6. Your rights

Depending on your location, you may have rights to access, correct, delete, export, or restrict the processing of your personal information, to object to processing based on legitimate interests, and to withdraw consent. You can exercise these by emailing [email protected]; we will verify the request and respond as required by law. You may also lodge a complaint with your local supervisory authority.

Opting out of analytics. You can stop Google Analytics from collecting data in your browser by installing Google's opt-out browser add-on. Both our analytics and our session replay can also be stopped by blocking analytics cookies and scripts in your browser settings or with a content blocker, or by enabling your browser's tracking-protection features. Blocking analytics does not affect your ability to use the website or the API.

California residents: we do not "sell" or "share" personal information as defined by the CCPA/CPRA; you may nonetheless exercise access, deletion, and correction rights as described above, and we do not discriminate for exercising them.

7. Children

The services are for business use and are not directed to children under 16; we do not knowingly collect their data.

8. Security

We use reasonable technical and organizational measures appropriate to the risk (encryption in transit, hashed credentials, access controls, audit logging). No system is perfectly secure; report suspected issues to [email protected].

9. Changes; contact

We may update this Policy; material changes will be notified by email or in-product notice, and the "Last updated" date always reflects the current version. Questions and requests: [email protected], or by mail to the address above.