VIN Lens Privacy Policy

Effective date: 2026-10-26

VIN Lens is a browser extension that finds the vehicle identification number (VIN) and registration details on a car listing page and shows that vehicle's history (auction records, registrations, inspections, odometer readings, recalls and safety checks) in the browser's side panel. This policy explains what the extension reads, what it sends to our server and what we keep.

What the extension reads

The extension runs automatically only on the car marketplaces and auction sites named in its store listing. On any other site it runs only after you click the VIN Lens icon on that tab, or on a site you allowed with "Always scan". On those pages it reads:

• the address (URL) and hostname of the page;
• up to 10 strings that look like a VIN, found in the page's structured data, embedded page data, element attributes and visible text;
• a visible vehicle registration number (plate) and first-registration date, where shown;
• the listing's title, price, mileage, make, model and year, where shown. On supported marketplaces these can also be read from the vehicle data the page itself loads.

It does not read or send cookies, passwords, form contents, request headers, local storage, the page's HTML or your browsing history, and it reads nothing on pages it does not run on.

What is sent to our server

When the side panel shows a page, the extension sends a request to the VIN Lens API (https://vin.vemyx.com) with the page URL, the hostname and the vehicle details listed above. The request also carries a random install identifier, generated by the extension and used only to apply fair-use request limits. Requests never include cookies, login credentials or site session tokens.

We use this data only to show you the vehicle's information: the VIN and registration details to look the vehicle up, and the page URL to recognise the listing and, on supported marketplaces, to read that public listing page from our server.

What we store

• Vehicle records, keyed by VIN: the VIN, when it was first and last requested, and cached results from the sources below. A vehicle record and its cached results are deleted 3 months after the vehicle was last requested; many cached results expire sooner. Owner names, addresses, owner-location fields and police case numbers are discarded, never stored.
• Plate-only results are stored under a keyed one-way hash of the plate, with the result encrypted using a key derived from the plate itself. The plate is never stored in readable form. These entries are deleted when they expire and at the latest 3 months after they were retrieved.
• Lookup logs: to investigate source failures we keep, for 30 days, the time of each source lookup, a random inspection identifier, the page hostname (never its full URL), the source, the kind of query, the VIN for VIN lookups, a keyed hash of the plate for plate lookups, the outcome, whether the cache answered, the duration and a sanitized error message.
• No page URLs are stored in the database or in logs. Public listing links found during a lookup may stay in the server's memory for up to five minutes.
• No accounts, no cookies, no advertising or analytics identifiers. VIN Lens has no sign-in and does not track you across sites.

In the browser, the extension keeps the last scanned page's URL and vehicle details per tab in session storage, which is cleared when the tab navigates or closes and when the browser exits. The random install identifier is kept in the extension's local storage until you uninstall it.

Server logs

Our server writes operational logs for each request: the time, method, API path (for example /v1/inspections, never the page URL), response status, duration and a request id. IP addresses, request bodies, cookies and authorization headers are not logged. Your IP address is used only in memory to apply request limits. Logs are rotated by size and overwritten as new logs are written, typically within days to weeks.

Third parties

To answer a request our server may contact the following, using its own anonymous connection. They never receive your cookies, credentials or marketplace session, and they see our server's address, not yours.

• The marketplace itself: for supported marketplaces such as AUTO.RIA and OLX, our server downloads the public listing page you are viewing.
• Public vehicle registries, inspection, emissions, recall and safety databases for the vehicle's country or manufacturer, and Ukrainian public vehicle lookups (such as Baza GAI, Carsua and AUTO.RIA's free vehicle check). They receive the VIN and, where a source requires it, the registration number and first-registration date.
• Auction-history archives receive the VIN.
• Plate photo archives receive the registration number, when enabled.
• Deep search: only when you press the deep-search button, our server opens some of these sources' public pages in its own isolated browser with the VIN or registration number.

The side panel names the source of every result it shows. Vehicle photos are loaded by your browser directly from the source's image servers, which can see your IP address as with any image on the web. Links to original pages open in a normal browser tab.

We do not sell or rent data, share it for advertising, or use it to determine creditworthiness or for lending.

Your choices and rights

• Uninstalling the extension stops all reading and sending immediately.
• You can withdraw a site you allowed with "Always scan" from the VIN Lens panel or Chrome's site access settings.
• We hold no accounts and no data tied to a named person. You can still contact us to ask about, or request deletion of, data related to a specific VIN or plate, and, if you are in the EU or UK, you may lodge a complaint with your data protection authority.

Children

VIN Lens is not directed at children and does not knowingly collect data from them.

Changes

We will update this page and its effective date when the extension's data handling changes.

Contact

VIN Lens is operated by Dmytro. Email: Dmytro.Melnychukk@gmail.com