Privacy Policy

Version dated 29 September 2026

This policy explains what personal data the CarVinLog website (carvinlog.com) processes, why, where the data is stored and how you can control it.

Who the controller is and how to contact us

The operator (data controller) is Mercury Plus Ltd, United Kingdom.

• Email: dzmitry@mercuryplusads.com
• Telegram: t.me/carvinlog

What data we process and where it comes from

Visitors

You can browse the site without registering. Every page except the account pages runs the Top.Mail.Ru counter of VK: see below. There are no other counters or third-party scripts, no third-party fonts are loaded, and the site does not store search queries.

The server uses your IP address only to respond to your request and does not record it. The server log records the time, the address of the page opened (without any parameters after the '?') and technical details of the response: status code, size and duration. The address of a car page contains its VIN. If a search leads you to such a page, its address is recorded in the log. Your IP address, browser details and the page you came from are not recorded.

Top.Mail.Ru counter

The counter is a script of VK (VK LLC, Russia). It loads from VK's servers and sends them, straight from your browser:

• the address and title of the page you open: a car page's address and title contain its VIN, and a search page's address contains your query;
• the address of the page you came from;
• your IP address, browser type, operating system and device;
• the time of your visit, how long you stayed on the page and what you did there;
• a random number for your browser, kept in cookies and in the browser's local storage (see 'Cookies').

Once a day the counter loads another VK script, from privacy-cs.mail.ru, which matches the browser's number with identifiers in VK's services.

We look at the counter's reports: how many visitors there were, where they came from and which pages they opened. VK also uses this data for its own purposes, including advertising, under its privacy policy (in Russian).

You can switch the counter off in your browser: block cookies and site data for carvinlog.com, or block top-fwz1.mail.ru and privacy-cs.mail.ru, for example with an ad blocker.

Account

You need an account only to request the removal of a car page. We store:

• your email address (which is also your login) and a flag showing whether it has been verified;
• a hash of your password;
• the dates you registered and last signed in;
• if you have enabled two-factor sign-in, the authenticator app secret and backup codes.

We do not ask for your name or phone number. While you are registering, verifying your email address or resetting your password, the code and your email address are stored in a session record on the server.

You do not have to give us any data. Without an email address and password, the only things you cannot do are create an account and submit a request from your account area.

The site sends emails with verification codes, password reset codes and the decision on your request. If someone enters your address in the registration or password reset form, you may receive an email saying that an account with this address already exists or was not found. This way the site does not reveal to anyone else who is registered.

To protect against password guessing, the site records the time of each attempt to sign in, reset a password or enter a code, together with a hash of the email address or account number.

Removal requests and correspondence

For each request we store the VIN, when it was submitted, the link to your account, its status (under review, removed, rejected), when the decision was made and a note of which of us made it.

The operator receives a notification of the request via Telegram, and a copy of it is stored on the server. The notification contains the request number, the VIN, the car's year, make and model, a link to the page and your account's email address.

If you write to us via Telegram or by email, we receive your name and Telegram username or your email address. We also receive your messages and anything you send to confirm that the car is yours or that you are acting with the owner's consent.

Vehicle data

If a car belongs or belonged to a private individual, its VIN and related information may be that person's personal data. Some information may relate to sellers, dealers or inspectors.

Sources: car sale listings on the Korean website Encar (encar.com) and the reports attached to them: the pre-sale inspection, Encar diagnostics and the insurance history; and cars for sale and at auction (Auto Auction, Auction Pro) on Autobell Global, the export platform of Hyundai Glovis (autobellglobal.com), with the reports attached to them: the registration history, K Car and Autobell inspections and the auction grade; cars for sale on Lotte Auto Global, the export platform of Lotte Rental (lotte-autoglobal.net), with their inspection reports; and lots of the damaged-car auction HappyCar (주식회사 해피카, happycarservice.com), sold by insurance companies and private owners: our collector reads them on the website of the broker Carland Auction (carland.auction, CarLand Motors) and reads the VIN automatically from the lot's photos. Our collector programs gather this data regularly, and the site loads new and changed data every hour. Cars from the 2015 model year onwards appear on the site. The site is not affiliated with Encar, Hyundai Glovis/Autobell Global, K Car, Lotte Rental/Lotte Auto Global, HappyCar or Carland Auction.

Published:

• the VIN: in the page address, the page title, the caption of the main photo, data for search engines and on car cards on the home page and in the catalogue;
• the Encar listing number, the Autobell Global car and auction lot number, or the Lotte Auto Global car number, with a link to it, and the HappyCar lot number (without a link: HappyCar's and Carland Auction's pages open only after signing in);
• make, model, trim, year, date of first registration, mileage and technical specifications;
• price in won and US dollars, the FOB export price, the Lotte Auto Global export price excluding shipping, the auction lot price (the Auto Auction starting price, the Auction Pro Current Bid), the listing or auction date, the auction programme, round and hall, status, the Lotte Auto Global note that a buyer is negotiating (In consult), price history; HappyCar lots have no price;
• for HappyCar lots: whose cars are sold (insurance companies' or private owners'), the purpose (for repair, for parts), the closing time of bidding, the status (bidding open, bidding closed, withdrawn) and the total loss mark (전손);
• a summary of the insurance history:
  • the number and amounts of insurance payouts for damage to this car and for damage caused to other parties in accidents;
  • the number of changes of owner and of number plate;
  • flags for total loss, flood damage, theft and commercial use;
• a summary of the Autobell Global registration history: the number of owner changes and records of total loss, flood damage, rental and commercial use;
• the results of the pre-sale inspection (accidents, minor repairs, flood damage, modifications, recalls, mileage at the time of inspection, date; for Lotte Auto Global also records of rental and commercial use), of Encar body diagnostics and of the Autobell inspection (accidents, minor repairs, replaced and welded body panels, mileage, date);
• the Hyundai Glovis auction grade (letter A–F, number 1–9, ratings of the main systems);
• up to 12 photos, with EXIF metadata removed;
• our calculations: price relative to the market, mileage check, VIN decoding, similar cars.

Not published: sellers' names, phone numbers and addresses, dealer names, listing texts and inspectors' names. The Encar collector deletes these fields before writing to disk; the Autobell Global collector deletes registration numbers, phone numbers, addresses and inspectors' names; the Lotte Auto Global collector does not save the platform manager's name and phone number; the HappyCar collector does not save photos of documents (registration certificates and other papers with the owner's details) and does not pass on the photo the VIN was read from; it recognises documents automatically, so on rare occasions a heavily downscaled or blurred document may remain among the photos. An inspector's name may remain on a scan of the inspection form (see below). HappyCar's 'starting price' (the auction's costs charged to the buyer) and the city where the lot is kept are not published. The registration number is not carried over to the site, but it may be visible in the photos. Photos may also show people.

Stored but not published:

• by the collector:
  • raw Encar, Autobell Global and Lotte Auto Global responses;
  • the registration number and its change history;
  • the full insurance history with dates and amounts;
  • the number of seizures and liens;
  • short seller notes, photo captions, the region of the seller's office, inspectors' comments;
  • inspection and diagnostics record numbers;
  • scans of inspection forms for some cars, showing the registration number, the inspector's name and stamp, and the dealer's stamp;
  • inspection sheets and diagrams, inspection photos, inspectors' comments and inspection checklists from Autobell Global and K Car;
  • complete Lotte Auto Global inspection reports (they show the registration number) and the seller code on Lotte Auto Global;
  • HappyCar lot records and the rows of their lists on Carland Auction, including cars older than 2020 that do not appear on the site: the title, the auction's costs ('starting price'), the city and district where the lot is kept, every VIN reading taken from the photos and the number of the photo the VIN was read from;
  • K Car inspection results: they carry no VIN, so the site cannot check that an inspection belongs to the car;
• in the site database: an internal copy of the collector's record (without the registration number, the seller code, text recognition results, inspectors' comments or inspection checklists; for HappyCar without the auction's costs, the city where the lot is kept or the VIN readings), K Car inspection results, registration history records of government and special use, auction prices Autobell Global does not show, the list of options and the body panels marked in the Lotte Auto Global inspection report, and the original Encar, Autobell Global, Lotte Auto Global and HappyCar photo URLs.

Why and on what legal basis

• Account, codes and emails: to provide the service you have asked for (Art. 6(1)(b) GDPR).
• Removal requests, notifications about them and correspondence: to deal with your erasure request or objection, as data protection law requires (Art. 6(1)(c)). In other cases, our legitimate interest in responding to enquiries (Art. 6(1)(f)).
• Server log, attempt limiting, security cookies, backups: our legitimate interest in keeping the site secure and restoring it after a failure (Art. 6(1)(f)).
• Top.Mail.Ru counter: our legitimate interest in knowing how many people visit the site and where they come from, and in promoting the site with advertising on VK (Art. 6(1)(f)). How to switch the counter off: see 'Top.Mail.Ru counter'.
• Collecting and publishing vehicle data, including notifying search engines: our legitimate interest in transparency in the used car market, so that a buyer can check a car's history, mileage and price (Art. 6(1)(f)). You can object: see 'Right to object'.
• Removal log: our legitimate interest in making sure a removed car does not reappear and in detecting misuse of requests (Art. 6(1)(f)).

We do not make automated decisions that have legal or similarly significant effects on you. A person reviews every request.

Who we share data with and where it is stored

• HOSTKEY: hosting, with the server in Frankfurt (Germany). All site data, collector data and backups are stored here.
• Resend (Plus Five Five, Inc., USA) sends the site's emails and receives your email address and the text of the email. The transfer to the USA is based on:
  • Resend's certification under the EU-U.S. Data Privacy Framework and its UK Extension;
  • the standard contractual clauses with the UK Addendum in Resend's data processing agreement.
• Telegram: the operator receives request notifications and corresponds with you through it.
• Namecheap: the operator's email (Private Email) and forwarding of emails sent to @carvinlog.com addresses.
• VK (VK LLC, Russia) receives the Top.Mail.Ru counter's data straight from your browser. The UK does not recognise Russia as providing an adequate level of data protection, and we have no contractual data protection safeguards with VK.
• Search engines index published pages, including car pages with VINs.
  • We notify Yandex of car page addresses ourselves using the IndexNow protocol. Bing, Naver, Seznam, Yep and Amazon also receive them through IndexNow.
  • Google finds pages through links and the sitemap.
  • Search engines do not receive any visitor or user data from us.

Test copies of some of the collector's data are stored on the project owner's work computer in Poland. The earliest copies still contain fields that the collector now deletes. Transfers to Germany and Poland are based on the UK's recognition of an adequate level of data protection in EEA countries.

How long we keep data

• Account: until you delete it, including if your email address is unverified.
• Attempt-limiting records last from 10 seconds to 5 minutes. Expired records are not erased immediately but at the next clean-up of the internal table.
• Server logs are size-limited (several files of 10 MB each) and are overwritten as they fill up.
• Top.Mail.Ru counter data is kept by VK, and VK, not us, decides for how long. The counter's cookies stay in your browser for up to 333 days (see 'Cookies').
• Removal log: indefinitely, because without the VIN a removed car would reappear on the site. When an account is deleted, the link to it is erased.
• Request notifications (on the server and in Telegram) and sign-in session records on the server are not currently deleted automatically.
• Vehicle data is kept on the site until the page is removed. Sold and withdrawn cars remain in the archive. Collector records are not deleted automatically.
• Backups:
  • the site database is backed up daily, and the last 14 copies are kept (about two weeks);
  • the collector databases are backed up daily, and the last 7 copies are kept.

Cookies

When you simply browse pages, the site itself sets no cookies: the Top.Mail.Ru counter does. There are no other third-party cookies and no advertising on the site.

csrftoken, sessionid and messages are needed for signing in and for the account area to work. lang is set only if you click RU or EN yourself. The site does not currently read it, because the page address determines the language.

The Top.Mail.Ru counter sets its cookies as soon as you open a page. In the browser's local storage the counter writes entries whose names start with tmr_: the browser's number, the time of the first visit, the request number and other technical data. The VK script from privacy-cs.mail.ru writes rb_sync_id there. They stay there until you delete them. The counter's code loads from VK's servers, and VK can change this set of entries.

Your rights

Under the UK GDPR (and the EU GDPR, if it applies to you) you can:

• access your data and obtain a copy of it;
• have it corrected;
• have it erased;
• restrict its processing;
• object to its processing (see below);
• receive your account data in a machine-readable format.

Write to us by email or via Telegram. We may ask you to confirm that the request comes from you. For vehicle data, we may also ask you to confirm that you own the car or are acting with the owner's consent. We reply within one month. In complex cases the law allows us to extend this period, and we will tell you if we do.

You can complain to the ICO, the UK supervisory authority (ico.org.uk). If the EU GDPR applies to you, you can also complain to the supervisory authority in the EU country where you live or work, or where you believe your rights have been infringed.

Right to object

You have the right to object at any time, on grounds relating to your particular situation, to our processing of your data based on our legitimate interest (Art. 6(1)(f) GDPR). This includes the publication of your car's data. We must then stop the processing. There are two exceptions: where we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, and where the data is needed to establish or defend legal claims. You can object by submitting a request from your account area, by email or via Telegram.

How to remove a car page

1. Register and verify your email address.
2. In your account area, enter the VIN, tick the box confirming that you own the car or are acting with the owner's consent, and submit the request. The page stays on the site until we have made a decision.
3. Send us the request number and VIN via Telegram or by email. We will ask you to confirm that the car is yours or that you are acting with the owner's consent.
4. We will tell you our decision by email. You can see the status of the request in your account area.

When we decide to remove a page, we immediately remove the page, its photos, listings and price history. The page address then shows a notice that the information was removed on request. New listings with this VIN are not loaded onto the site, and search engines are notified via IndexNow. Your browser may show the old version of the page for up to a minute.

After removal, the following remain:

• the VIN and the request in the removal log, so that the car does not reappear;
• data in backups, for up to about two weeks;
• the collectors' records. The collectors are not aware of the removal. While the car is on Encar, Autobell Global, Lotte Auto Global or HappyCar, they keep updating it, but it no longer appears on the site. If you would like us to delete these records as well, write to us.

We do not remove a page that has been hidden following a complaint from a rights holder. The car's data remains in the database and continues to be updated, and the photo files can still be opened via direct links. To have the data deleted, you need to submit a removal request.

How to delete your account

In your account area, click 'Delete account' and enter your password. We immediately delete your email address, password hash, registration and sign-in dates, and your two-factor sign-in with its backup codes.

Your requests remain in the removal log (VIN, dates, status) with no link to you. Removed cars stay removed. We may still review an undecided request after you delete your account, but we will not be able to tell you the decision. Account deletion cannot be undone.

Your email address may remain:

• in database backups, for up to two weeks;
• in notifications about your requests on the server and in the operator's Telegram;
• in sign-in session records on the server;
• in your correspondence with us;
• in Resend's logs.

If you would like us to delete the notifications, session records and correspondence, write to us. If you cannot sign in, reset your password or write to us from the address your account is registered with.

Security

• The whole site runs over HTTPS. Cookies are sent only over HTTPS, and scripts on the page cannot access the session cookie.
• Passwords are stored only as a hash. You can enable two-factor sign-in.
• The number of attempts to sign in and to enter codes is limited. The site does not reveal whether an email address is registered.
• Our server does not record visitors' IP addresses or browser details. The Top.Mail.Ru counter receives them straight from the browser.
• The database runs on the server's internal network with no internet access. Server security updates are installed automatically. Only the server administrator can read the backups.

No system offers complete protection. If you notice a vulnerability, write to us.

Children

The site is intended for adults. We do not ask for your age and do not knowingly collect children's data.

Changes to this policy

When we change this policy, we publish the new version on this page and update the date at the top.