Information we collect
Guest VIN checks do not require a CarCheckOnline.com account. Our first-party audit log records the checked VIN, report availability, selected provider and important checkout outcomes so we can fulfill requests, diagnose problems and understand the purchase funnel. Google accounts store the Google account identifier, verified email address, display name and optional profile image returned with authorization. Email accounts store the submitted email, display name, a unique password salt and a slow one-way password hash; the original password is never stored. Password recovery uses a randomly generated, one-time reset token; only its cryptographic hash is stored by CarCheckOnline.com.
Payment information
PayPal processes wallet, debit-card and credit-card payments. CarCheckOnline.com does not receive or store full card numbers, card security codes or PayPal passwords. We retain only the order reference, amount, currency, environment and verification status needed to fulfill and support a purchase.
How information is used
Account data is used to authenticate you, maintain prepaid credit balances, provide VIN search, purchase and report history, fulfill selected VIN reports, send essential account, payment and report-delivery notifications, prevent duplicate credits, investigate payment issues and respond to support requests. We do not sell account information or use transactional email for third-party advertising.
Storage and retention
Account and transaction records are stored on protected service infrastructure. Successful VIN searches made while signed in are retained with the account so the account owner can revisit them. Generated report PDFs remain in private file storage and are delivered through unguessable signed links only after a completed purchase. Anyone who receives a signed report link can view or download that PDF without signing in; refunded or invalidated purchases lose access. A validated VIN availability response, containing the VIN, vehicle description and available providers but no payment or identity data, may be shared in a temporary cache for up to seven days. Expired entries are never served and are deleted during subsequent lookups. Session cookies are HTTP-only and expire after 30 days. Password-reset links expire after 30 minutes; expired and used recovery records are removed during subsequent recovery activity. First-party funnel audit events are automatically deleted after 400 days. Purchase records may be retained while the account is active and for the period reasonably needed for payment reconciliation, fraud prevention, tax, accounting and legal obligations.
Your choices
You may use the single-report guest checkout without creating a CarCheckOnline.com account. The consent banner offers essential-only operation, aggregate analytics, or analytics with advertising measurement. The preference is saved in first-party browser storage and a consent cookie for up to 400 days, and can be cleared through browser settings. Google account access can be revoked from your Google Account permissions. Account deletion and data-access instructions, together with a verified support address, will be published before public customer launch.
Third-party services
The service uses Google for optional account sign-in, Google reCAPTCHA for abuse prevention, PayPal for payments, SMTP2GO for essential transactional email delivery, Google Analytics for consent-aware aggregate funnel measurement, and vehicle-history data providers for VIN availability and report generation. With analytics consent, verified registrations, VIN-search outcomes and purchases may also be sent from our server to Google Analytics through Measurement Protocol. These events use an anonymous Analytics client identifier and never include a raw VIN, email address or payment details. SMTP2GO receives the destination email address and message contents required to deliver account, payment and report-ready notices; it does not receive card numbers or PayPal passwords from CarCheckOnline.com. reCAPTCHA may receive a short-lived action token, interaction signals, IP address and browser user-agent to evaluate whether a request is legitimate. These services process information under their own privacy terms.