Legal
Privacy Policy
Last updated: November 2024. This policy describes how VinLens handles data you submit through our query tools and 查博士 (ChaBoShi) ordering flow.
1. Data controller
VinLens ("we", "us") operates this website as a query and ordering layer for Chinese-market vehicle data. We are the data controller for the personal information you submit on this site. Questions can be sent to support@vinlens.example.
2. Information we collect
- Account data — email address, name, avatar URL and authentication identifiers supplied by Supabase Auth or by Google / Facebook when you choose to sign in with those providers.
- Vehicle identifiers — the 17-character VIN you enter or scan, plus any normalized representation we derive from it.
- Uploaded documents — the 行驶证 (vehicle registration certificate) photo you submit for mileage verification. This is transmitted to our upstream data provider (Tanshu) and is not stored permanently on VinLens servers.
- Order data — contact name, email, phone and the ChaBoShi package you select, plus the simulated payment identifier generated in the demo environment.
- Technical logs — IP address, browser user agent, requested URL and error diagnostics, used for abuse prevention and debugging.
3. How we use data
We process the data above only to:
- Return factory, mileage, battery and claims data for a VIN;
- Submit 行驶证 photos to Tanshu for asynchronous mileage parsing;
- Place and fulfil 查博士 (ChaBoShi) report orders;
- Maintain your account and order history;
- Detect abuse, troubleshoot errors and comply with legal requests.
4. Sharing with sub-processors
To deliver the service we share the minimum necessary data with:
- Supabase — authentication and hosted Postgres database (account, orders, saved reports).
- Tanshu (探数) — VIN-based factory specifications and mileage-verification API.
- 查博士 / ChaBoShi — official report fulfilment partner for orders placed on the /chaboshi page.
We do not sell personal data. We disclose information only when required by a valid legal request from a competent authority.
5. Data retention
- VIN reports you save while signed in are retained until you delete them from your account.
- Order records are retained for the period required by tax and consumer-protection law in the jurisdictions we operate.
- 行驶证 photos are transmitted in real time and discarded after we receive the parsed mileage result; we do not retain the original image on VinLens infrastructure.
- Application logs are retained for up to 30 days.
6. Your rights
Depending on your jurisdiction, you may request access, correction, deletion or portability of your personal data, and you may object to certain processing. To exercise these rights, email support@vinlens.example from the address associated with your account. We will respond within 30 days.
7. Cookies and local storage
We use a single vl_session httpOnly cookie to keep you signed in across Server Components and API routes. We do not use third-party advertising cookies. Supabase and OAuth providers may set their own cookies subject to their own policies.
8. International transfers
Data may be processed in data centres outside your country of residence, including mainland China (Tanshu / 查博士) and the region where our Supabase project is hosted. We rely on standard contractual clauses and equivalent safeguards where required.
9. Demo preview
When a data provider is not configured, VinLens returns deterministic sample data generated from the VIN. Such responses are clearly marked with a "DEMO PREVIEW" banner and must not be relied upon for purchase decisions.
10. Contact
For privacy questions or data requests, contact us at support@vinlens.example.