Who is responsible?
DARBAZ AS (931 122 851), Nordbyringen 22C, 2069 Jessheim, Norway, is responsible for personal data processed by VINBYCAR. Contact support@vinbycar.com for privacy questions.
Information and purposes
We process your email and account identifiers to provide sign-in; VIN, report language, order and payment references to fulfil orders; and messages you send us to provide support. This processing is necessary for the contract or steps you request before a contract. We retain legally required accounting information to comply with legal obligations. Limited technical logs and fraud controls protect the service under our legitimate interest in security.
Cloudflare determines the connection country so that we can show local prices. Website language uses browser preferences or your saved choice. A VIN photo selected in the website is read on your device; we do not upload that image for recognition.
Service providers and recipients
Cloudflare hosts the site and handles web requests. Supabase provides the customer database and authentication, with the project in Ireland. Stripe processes payments; we do not store full payment card details. Resend handles transactional and support email. The VIN is used with relevant vehicle data sources to retrieve the requested record, including the Norwegian vehicle lookup where applicable. Reports are prepared by our report engine on a managed Windows computer.
Providers may process information outside the EEA. Applicable provider agreements and transfer safeguards, such as European Commission standard contractual clauses where required, govern those transfers. Contact us for information about the safeguards relevant to your data. We do not sell customer information.
Retention
Report download access expires after seven days. This is an access period, not a promise that every stored copy is deleted on that date. Account, support and transaction data are retained while needed to provide the service, resolve enquiries, protect legal claims or meet legal obligations. Accounting records subject to Norwegian retention rules are normally retained for five years after the end of the financial year. You may request deletion of information that we no longer need; legal retention duties may limit what can be erased.
Your rights
Subject to applicable conditions, you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. You may complain to Datatilsynet or your local data protection authority. We may need proportionate verification before acting on a request. We do not use your VIN report to make automated decisions with legal or similarly significant effects on you.
Required account and order information is needed to provide those services. You can browse public information without creating an account. See the cookies and local storage notice.
Updated 11 October 2026.