Privacy and Cookie Policy
Version: 2026-09-24
1. Controller
The controller of personal data is ANYTIME RPA sp. z o.o., ul. Grzybowska 87, 00-844 Warszawa, Polska, tax ID (NIP) 5272893150. Contact for personal data matters: support@vehistra.com.
2. Where the data comes from
- From you – when you create an Account, request page removal, buy Credits, enter invoice details, send an import enquiry or contact us.
- From the sign-in provider – when you sign in we receive from Kinde (and from Google if you use Google sign-in) your email address, whether it is verified, your display name and profile picture URL.
- From Stripe – payment status, transaction identifiers and invoice and tax details.
- From external sources – data about vehicles offered at auction (such as Copart or IAAI) from auction data providers and public databases (such as NHTSA): VIN, lot number, photos, condition and damage notes, mileage, location, date and price. This data concerns vehicles, but according to the CJEU (judgment of 9 November 2023, C‑319/22) a VIN can be personal data for someone able to link it to the owner. That is why we offer a free right to object and to erasure (section 7).
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Account and sign-in | email, name, profile picture, sign-in identifier | Art. 6(1)(b) – contract |
| Removal Service | email, name (optional), page address, VIN or lot number, option, progress history, consents given when ordering | Art. 6(1)(b) – contract |
| Payments, Credits, invoices | payment data from Stripe, Credit history, invoice details (name, tax ID, address) | Art. 6(1)(b) – contract; Art. 6(1)(c) – tax and accounting obligations |
| Import enquiry and passing it to Import Companies | email, phone (optional), message, vehicle and calculator data | Art. 6(1)(a) – consent |
| Contact, complaints, GDPR requests | data you send us | Art. 6(1)(c) and (f) |
| Public auction archive and VIN checks | vehicle data from section 2(4) | Art. 6(1)(f) – legitimate interest: informing about vehicle history and safer used-car trading |
| Security and abuse prevention | hashed IP address and browser identifier, operation logs | Art. 6(1)(f) |
| Establishing and defending claims | order data, correspondence, operation logs | Art. 6(1)(f) |
Providing data is voluntary, but without it we cannot create an Account, fulfil an order or pass on an enquiry. You can withdraw consent at any time without affecting earlier processing.
4. Recipients
We share data only as needed to run the Service:
- Kinde – sign-in and identity management,
- Google – Google sign-in if you choose it; removal requests for our URLs in search results (without your data),
- Stripe – payments, tax and invoices; for some operations Stripe acts as a separate controller,
- Vercel – web application hosting,
- Hetzner Online – application servers in the EU,
- Neon – database,
- Bunny.net (BunnyWay d.o.o.) – image storage and delivery,
- NHTSA – VIN decoding; receives only the VIN you enter,
- Import Companies – import enquiries, only with your consent,
- accounting and legal advisers and public authorities where required by law.
Processors acting on our behalf are bound by data processing agreements (Art. 28 GDPR). Where data leaves the European Economic Area we rely on a European Commission adequacy decision (such as the EU‑US Data Privacy Framework) or standard contractual clauses. You can request a copy of the safeguards.
5. Retention
| Data | Period |
|---|---|
| Account | until the Account is deleted, then until claims are time-barred |
| Payments, invoices, Credit history | 5 years from the end of the year in which the tax payment deadline passed |
| Removal requests and their log | until claims related to the order are time-barred |
| Import enquiries | until the matter is closed or consent is withdrawn |
| Correspondence and complaints | until the matter is closed, then until claims are time-barred |
| Hashed IP and browser identifiers | as long as needed to prevent abuse, no longer than the limitation period |
| Auction archive | until a successful objection or page removal, or until the right to publish the data expires |
6. Automated decisions
Removal requests may be approved automatically after payment; a person reviews doubtful cases. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
7. Your rights and free erasure
- You have the right to access, rectify and erase your data, to restrict processing, to data portability, to object to processing based on legitimate interest (including publication in the auction archive) and to withdraw consent.
- If an archive page contains data about you, write to support@vehistra.com free of charge with the page address. We reply without undue delay and within one month. No purchase is required; the paid Removal Service is an additional service (priority handling, Google request, monitoring).
- You can lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00‑193 Warsaw) or with the supervisory authority in your country.
8. Cookies
The Service uses necessary cookies for sign-in, security and remembering your privacy choice. Optional analytics requires your consent.
| Cookie | Purpose | Duration |
|---|---|---|
| access_token, id_token, refresh_token (including numbered parts) | keeps a signed-in session | until sign-out or session expiry |
| ac-state-key | protects the sign-in flow | during sign-in |
| post_login_redirect_url | returns you to the page you started from | during sign-in |
We load optional Microsoft Clarity analytics only after your consent (GDPR Art. 6(1)(a)). Clarity provides heatmaps and interaction recordings with content masking. We do not record account, payment, administration or form pages, or URLs containing query parameters or vehicle identifiers. We do not send names, emails or account identifiers as custom Clarity parameters. Advertising consent remains denied.
Microsoft receives analytics data. Its [privacy statement](https://privacy.microsoft.com/privacystatement) describes processing and international transfers. [Clarity privacy information](https://clarity.microsoft.com/privacy) explains recordings, masking and data retention.
The necessary `vehistra_analytics_v1` cookie remembers consent or refusal for 180 days. After consent, Clarity may set `_clck` (up to 1 year) and `_clsk` (up to 1 day). Refusing analytics does not restrict site use. Select Cookie settings in the footer to decline analytics or change and save your choice. Withdrawal stops recording and removes our Clarity cookies without affecting earlier lawful processing. Payments take place on Stripe's page, which uses its own cookies. You can delete cookies in your browser settings; without the necessary cookies sign-in will not work.
9. Security and changes
We use encrypted connections, role-based access control and store IP addresses only as hashes. We do not store card data – Stripe handles it. We will announce material changes to this Policy in the Service and by email to Account holders.
Questions about these terms or your data?