Privacy Policy

Oriental VIN Decoder (“we”, “us”, “our”) is operated by Oriental Outsourcing. We provide live VIN validation and specification decoding for USA and Canada vehicles through our production web application and REST API at vin-decoder.orientaloutsourcing.com. Privacy requests: management@orientaloutsourcing.com.

This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit our website, create an account, use the dashboard or API, subscribe to a plan, or contact us. We design the Service to support obligations under the EU GDPR and UK GDPR (where applicable), California CCPA/CPRA and similar US state privacy laws (where applicable), and payment-card security expectations by keeping card data within PCI DSS–scoped payment providers (Razorpay and PayPal). This policy is effective as of the date shown above and applies to the live production Service.

Account and identity data: name, email address, password hashes (we never store plaintext passwords), Google OAuth identifiers when you sign in with Google, and optional two-factor authentication settings. Billing and subscription data: plan, invoices, payment status, provider customer/order/capture identifiers — we do not store full card numbers, CVV, bank passwords, or PayPal login secrets. Service usage data: VIN inputs you submit, decode result metadata, API key labels and hashed secrets, request and navigation logs needed for quotas, security, and product operations. Support, feedback, and demo requests you send us. Technical data: IP address, user agent, device/browser signals, approximate location derived from IP, and cookies or similar identifiers required for sessions and security.

We process personal data to: (a) provide, operate, and secure the live Service (contract — Art. 6(1)(b); legitimate interests — Art. 6(1)(f)); (b) authenticate users, prevent abuse, and investigate fraud (legitimate interests / legal obligation — Art. 6(1)(c)/(f)); (c) enforce plan quotas, overage billing, and API access (contract); (d) process subscriptions, invoices, and taxes via payment providers (contract / legal obligation); (e) send transactional email such as verification, billing, security, and usage alerts (contract / legitimate interests); (f) improve reliability using limited product telemetry (legitimate interests); and (g) fulfil data-subject and regulatory requests (legal obligation). Where consent is required by local law for a specific activity, we will obtain it.

We use essential cookies and local storage for authentication sessions, CSRF and security protections, and preferences required to run the product. We may use limited analytics identifiers to understand product usage. You can control non-essential cookies in your browser; disabling essential cookies may prevent sign-in or secure session features from working.

Paid plans are processed by Razorpay and/or PayPal. Card numbers and sensitive authentication data are collected and processed by those providers under their PCI DSS scope and their own privacy terms. We receive payment status, transaction identifiers, and limited billing metadata needed to activate subscriptions and issue invoices. Oriental VIN Decoder does not store raw payment card Primary Account Numbers (PAN) on our servers.

We use carefully selected subprocessors for hosting and infrastructure, transactional email delivery, authentication (including Google sign-in when enabled), and payment processing (Razorpay and PayPal). Personal data may be processed in regions where those providers operate. Where GDPR/UK GDPR applies to transfers outside the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent transfer mechanisms required by law.

We retain account, decode, and billing records while your account is active and as needed to provide the Service, resolve disputes, and meet legal, tax, and audit obligations. Inactive trial accounts are retained for 30 days to allow conversion. After standard account closure, data is retained for a limited retention window unless a valid erasure request applies sooner. GDPR erasure permanently deletes or anonymizes personal data except records we must keep by law (for example certain invoice and fraud-prevention records).

We apply industry-standard controls including TLS encryption in transit, hashed passwords, access controls, API key hashing (full key shown once at creation), optional two-factor authentication, and least-privilege operational practices. No method of transmission or storage is completely secure. If we become aware of a personal-data breach we will notify affected users and regulators as required by applicable law.

Where applicable, you may request: access to your personal data; a portable export; rectification of inaccurate data; restriction of processing; objection to processing based on legitimate interests; and erasure (including our in-product GDPR erasure workflow where available). You may lodge a complaint with your local supervisory authority. To exercise rights, use in-app privacy settings where available or email management@orientaloutsourcing.com. We may verify your identity before fulfilling a request.

If you are a consumer under the CCPA/CPRA or similar US state laws, you may have rights to know, delete, and correct personal information, and to opt out of certain “sales” or “sharing.” We do not sell personal information for money. We process account and usage data to provide the Service. We will not discriminate against you for exercising privacy rights. Submit requests to the contact below.

The Service is directed to businesses and adults. We do not knowingly collect personal data from children under 16 (or the higher age required in your jurisdiction). If you believe a child has provided us personal data, contact us and we will take appropriate deletion steps.

We may update this Privacy Policy to reflect product, legal, or operational changes. The effective date at the top of this page will be revised when changes take effect. Material changes may also be communicated by email or in-product notice where appropriate.

Privacy and data-protection requests: management@orientaloutsourcing.com.