Privacy Policy

1. Who operates Vehara

Vehara is operated by Jian Yang, an individual developer based in Maryland, United States. In this policy, “Vehara,” “we,” “us” and “our” refer to that service and operator. Questions or privacy requests may be sent to david_yj@msn.com.

2. Information we collect

Depending on how you use Vehara, we collect:

• Account information, such as email address, authentication identifiers and login-provider information.
• Vehicle information, such as VIN, make, model, year, mileage, specifications and owner-entered notes.
• Maintenance, insurance and document information, including uploaded vehicle photos and maintenance attachments.
• Sharing preferences and owner-provided sale contact details that you choose to publish.
• Messages, non-binding offers, counteroffers, decisions and sale-stage records exchanged between personal sellers and Dealers, plus messages from prospective buyers through a For Sale page and any contact details they optionally provide.
• Point purchases, balances, usage and refund-request records. Payment-card details are handled by Stripe and are not stored by Vehara.
• Feedback, support communications and information you send to us.
• Technical and usage information, such as browser and device characteristics, approximate location derived from IP address, security events, diagnostics, feature interactions, campaign parameters in promotional links and a random browser identifier used to avoid counting the same promotional landing repeatedly in one tab session.

3. How we use information

• Provide, secure and maintain accounts, vehicle records, secure reports, communication features and point-based services.
• Process point purchases and refund requests, and send billing, transactional or security messages.
• Apply your display and privacy choices, including sale contact controls.
• Deliver secure seller reports to selected Dealers, record report views, provide seller-Dealer messages and non-binding offer history, and show the current communication stage.
• Deliver private For Sale inquiries to the vehicle owner and make the owner's reply available to the buyer in the browser used to send the inquiry.
• When an authenticated user requests it, send the VIN of that user's vehicle to NHTSA to decode manufacturer information and retrieve model-level safety-recall campaigns, then cache the normalized result and enforce the usage limit shown in the product.
• When a signed-in user chooses AI VIN scanning, temporarily send the selected VIN photo to our configured AI service to read candidate characters, validate the VIN and confirm available vehicle identity information. The scan photo is not added to the vehicle gallery by this feature.
• Detect abuse, troubleshoot errors, prevent fraud and protect users and the service.
• Measure service reliability and understand feature usage so we can improve Vehara.
• Comply with law, enforce our terms and resolve disputes.

4. Public vehicle pages

Vehicle information is private by default unless you choose to share a secure report or publish a vehicle page. Published information may be viewed by anyone who receives its secure URL and may be copied or shared by visitors. Review your sharing settings before publishing. Do not upload or publish information you do not have the right to share.

A Vehicle History Check remains private unless you explicitly enable its For Sale summary. The public summary shows only the VIN ending, selected decoded specifications, a model-level recall count, source and refresh date; it does not publish the complete VIN or the private query record.

A prospective buyer may send a private inquiry without creating an account and may choose whether to provide a name, email address or phone number. Inquiry content and optional contact details are shown to the signed-in vehicle owner, not published on the vehicle page. A private browser token lets the buyer check the owner's reply from the same browser; clearing browser storage may remove that access.

5. When we disclose information

Text messaging originator opt-in data and consent will not be shared with any third parties, except as necessary to provide and support the SMS messaging service. We do not sell or share SMS opt-in data for third-party marketing or advertising.

We disclose information only as needed to operate Vehara, complete transactions, follow your instructions, protect rights and safety, or comply with law. Service providers may include Supabase for authentication, databases and file storage; Vercel and Cloudflare for hosting, delivery and security; Stripe for payments and billing; Resend and configured email infrastructure for messages; OpenAI for user-requested AI VIN-photo recognition and vehicle-image analysis; NHTSA for owner-requested VIN decoding and safety-recall data; and Sentry, Vercel Analytics, Google Ads or PostHog for diagnostics, campaign measurement and limited product analytics when enabled. These providers process information under their own terms and privacy commitments.

We may also disclose information in a business transfer or when reasonably necessary to respond to lawful process, prevent harm, investigate misuse or enforce agreements. Vehara does not sell personal information and does not use it for cross-context behavioral advertising.

6. Cookies and similar technology

Vehara uses browser storage and cookies that are necessary for authentication, session continuity, security and preferences. Promotional landing measurement stores a random browser identifier and a tab-session marker so repeated refreshes of the same campaign link are not counted as new visits. Cloudflare Turnstile may process device and network signals to distinguish legitimate users from automated abuse. Analytics tools may use similar technology to produce usage measurements when enabled.

7. Retention and security

We retain information while your account is active and as reasonably needed to provide the service, complete transactions, maintain security and audit records, meet legal obligations and resolve disputes. Deletion from active systems may not immediately remove limited copies from protected backups, which expire or are replaced according to operational retention practices.

We use administrative, technical and organizational safeguards designed for the nature of the information we handle. No online system can guarantee absolute security, so you should use a unique password, protect your account and promptly notify us of suspected unauthorized access.

8. Your choices and requests

You can update many vehicle, report-sharing, display and account settings within Vehara and unpublish public pages. You may request access, correction or deletion of personal information, or ask questions about processing, by emailing david_yj@msn.com. Review our data deletion request instructions before submitting an account-deletion request. We may need to verify your identity and may retain information where required or permitted by law.

If you enable text-message alerts, Vehara may send transactional messages about Dealer offers, messages and appointment updates. Message frequency varies with transaction activity, and message and data rates may apply. Reply STOP to opt out or HELP for help. Consent to text messages is not a condition of purchase, and you may also change the setting in your account.

9. Children and international use

Vehara is not directed to children under 13, and we do not knowingly collect their personal information. The service is operated from the United States. If you use it from another country, your information may be processed in the United States and other locations where our providers operate.

10. Changes to this policy

We may update this policy as Vehara changes. We will post the updated version here and revise the effective date. If a change materially affects how we use personal information, we will provide additional notice when appropriate.