Polityka prywatności
This policy explains what personal data Infranova Limited (the "Operator", "we") processes when you use priormile.com and buy a vehicle history report, why we process it, how long we keep it, who we share it with, and what rights you have. We wrote it to be read, not skimmed - it is short because we collect little.
1. Who is responsible
The data controller is Infranova Limited, 3 Salisbury Road, Tsim Sha Tsui, Kowloon, Hong Kong - the operator of priormile.com. Contact for all privacy matters: support@priormile.com.
2. What we process, and why
| Data | Where it comes from | Why we process it | Legal basis |
|---|---|---|---|
| VINs you enter, and the preview/report generated for them | You | To decode the vehicle, show the free preview and deliver the report you bought. A VIN identifies a vehicle, not a person; it can become personal data if combined with the buyer's identity, which is why it is listed here. | Contract (free preview, report delivery) |
| Email address | You, at checkout or when requesting a sign-in link | To send the receipt, invoice and report, and to let you open your reports again without a password. | Contract |
| Order and payment data: order number, product, price, currency, tax, country, payment status, last 4 digits and brand of the card (never the full number), VAT ID if you entered one; and how you reached the purchase page - the type of page you came from on this site, your language, and a coarse category for the site that referred you (for example “search engine” or “AI assistant”), never the referring address itself | You and the payment provider | To take payment, issue invoices and credit notes, detect fraud and keep the accounting records the law requires. The three source fields are aggregate categories, kept so we can tell which pages and languages lead to a purchase; they cannot single you out, and we never store the referring URL. | Contract; legal obligation (tax/accounting); legitimate interest (the three source fields) |
| Country derived from your IP address | Our edge network (request header) | To show prices in the right currency and charge the right VAT rate. | Legal obligation (VAT); legitimate interest |
| Technical logs: truncated/hashed IP address, user agent, request path, timestamps, error details | Your browser | To keep the Service secure, rate-limit abuse and diagnose faults. | Legitimate interest (security) |
| First-party analytics events (page viewed, VIN submitted, checkout started, order paid, report opened) with page path, language, referrer, the type of page you came from and a coarse category for the referring site; plus an anonymous id cookie if you consented | Your browser | To understand how the site is used and improve the purchase flow. | Legitimate interest (without identifier); consent (anonymous id) |
| Google Analytics 4 measurement (page path, language, device and coarse location derived from your IP, the same funnel steps, the value of a completed order) and the identifiers Google sets in its own cookies | Your browser, only after you accept cookies | To measure traffic and the purchase funnel with the same tool our search and marketing reporting uses. | Consent (withdraw it any time - see the Cookie Policy) |
| Support correspondence | You | To answer your questions and handle refunds. | Contract; legitimate interest |
We do not ask for your name or address to buy a report. We do not sell personal data, and we do not use it for advertising.
3. What the report itself contains
Reports are about vehicles. Records in a report (title history, accidents, odometer readings, recalls, liens, listings, ownership periods) come from third-party sources and may indirectly relate to previous owners - for example, the state where a car was registered. We do not include names or addresses of previous owners in reports, and the Service may not be used to identify or locate a person (see the Terms of Service).
4. How long we keep it
| Data | Retention | Why that long |
|---|---|---|
| Orders, invoices, credit notes, payment records | 10 years from the end of the fiscal year | Tax and accounting law |
| Your email address and sign-in (session) records | 2 years after your last sign-in or purchase, then deleted or anonymised (orders keep an anonymised reference) | So you can come back to your reports; then no longer needed |
| Report snapshots you bought | At least 90 days online; kept for the lifetime of the order record in anonymised form | To serve the report and to resolve disputes |
| Raw data fetched from the vehicle-data provider, and VIN lookup cache | 90 days by default, or as the provider's terms require | To avoid paying twice for the same record; provider licence |
| Copies of the emails we sent you (receipt, report link, sign-in link) | 90 days | Delivery troubleshooting and support; the invoice itself stays a fiscal record |
| Payment status messages from the payment provider | 12 months (once processed) | To reconcile payments and investigate payment disputes |
| Technical logs | 30 days | Security and diagnostics |
| Analytics events | 12 months | Year-over-year comparison; then aggregated |
| Support emails | 2 years after the conversation ends | To handle follow-ups and disputes |
A scheduled job deletes or anonymises data when the period ends. If you ask us to delete your data (section 7), we do it sooner, except for the records the law obliges us to keep.
5. Who we share it with
We use a small number of service providers ("processors") who process data on our instructions under a data-processing agreement:
- Cloudflare - edge network, DNS and protection against abuse; sees IP addresses and request metadata for every request.
- Our vehicle-data provider - a licensed provider of official title records and other vehicle records; receives the VIN you enter (and nothing about you) to return the records.
- Hosting - the servers and storage where the Service, its database and your reports run, operated by us on infrastructure we control.
- Payment provider - processes your payment; receives the amount, currency, your email address and the payment details you enter on its page. It is an independent controller for the payment itself.
- Email delivery - sends receipts, reports and sign-in links to your address.
- Our live-chat tool (self-hosted Chatwoot) - runs on a support server we operate and is loaded only after you tap "Chat with us"; nothing of it loads for anyone who does not. It receives what you type (and your name or email if you give them), the address of the page you opened it from and of the pages you move to while it is loaded (on a VIN page that address contains the VIN), your browser type and language, and - as any server you connect to - your IP address. It is never offered on a page whose address carries a sign-in, order or report link token, so those never reach it.
- Google (Google Analytics 4) - measures how the site is used, and only if you accept cookies. It receives the page path (never the query string, so report and order links are stripped), your language, device and an approximate location derived from your IP address, which Google truncates and does not store. Advertising features, ad personalisation and data sharing are switched off for our property, and we never send it your email address, your VIN or a report link.
We disclose data to authorities only when the law requires it, and we inform you where we are allowed to.
6. Where data is stored
The Service, its database and your reports are hosted on servers we operate in the European Union. Cloudflare processes requests at the edge location closest to you, which may be outside the EU. The vehicle-data provider, Google Analytics (if you accepted cookies) and (for US cards) the payment provider process data in the United States. The Operator is established in Hong Kong and our staff access the data from there. Where personal data leaves the European Economic Area, we rely on the European Commission's standard contractual clauses or on an adequacy decision.
7. Your rights
Depending on where you live (and in particular if you are in the EU, the UK, Switzerland or a US state with a privacy law), you have the right to:
- access the personal data we hold about you and get a copy;
- correct it if it is wrong;
- delete it ("right to be forgotten"), subject to records we must keep by law;
- restrict or object to processing based on legitimate interest;
- port the data you gave us in a machine-readable format;
- withdraw consent at any time (the analytics cookie - see the Cookie Policy), without affecting processing before withdrawal;
- complain to a supervisory authority, in particular the one where you live or work.
To exercise a right, email support@priormile.com from the address you used with us, or tell us which address that was. We answer within 30 days. We do not discriminate against you for exercising your rights.
8. Security
Traffic is encrypted in transit (TLS). Card details are entered on the payment provider's page and never reach our servers. Access to production systems is limited to the people who run the Service, backups are encrypted, and secrets are stored outside the code. No system is perfectly secure; if a breach affects your data we will inform you and the relevant authority as the law requires.
9. Children
The Service is not directed at children under 16 and we do not knowingly collect their data.
10. Changes
We may update this policy. The version and effective date are shown at the top. If a change materially affects how we use your data, we will tell you by email (if we have your address) or with a notice on the site before it takes effect.
11. Contact
support@priormile.com
Infranova Limited, 3 Salisbury Road, Tsim Sha Tsui, Kowloon, Hong Kong