Privacy Policy
Last updated: 4 November 2026
This policy explains what personal data OBD4 uses, why, and what rights you have under the EU General Data Protection Regulation (GDPR).
Who is responsible
The team that runs OBD4 is responsible for your data. For anything about your data, use the contact form.
What we use, why, and our legal basis
| Data | Purpose | Legal basis (GDPR Article 6) |
|---|---|---|
| Username, email address, password (stored as a hash), accepted terms version and date | Creating and securing your account, signing in, account emails | Contract, 6(1)(b) |
| Optional profile details: display name, bio, country, timezone, website, workshop, experience | Showing your profile, as you choose | Contract, 6(1)(b) |
| Publications, comments, edit history, votes, follows, saved items, suggestions | Providing the community features | Contract, 6(1)(b) |
| Notifications and notification settings | Telling you about replies, solutions and followed tools, as you choose in your settings | Contract, 6(1)(b) |
| IP address and browser details in session records and server logs; IP address in temporary rate limits | Keeping the site secure and preventing abuse | Legitimate interests, 6(1)(f) |
| Reports, moderation decisions and account sanctions | Enforcing the rules, handling complaints, meeting legal duties for online platforms | Legitimate interests, 6(1)(f), and legal obligation, 6(1)(c) |
| VIN or vehicle details you enter in the VIN decoder | Identifying the vehicle you asked about | Legitimate interests, 6(1)(f), in providing the tool you requested |
| IP address and browser details, processed by Cloudflare when you allow the security check | Stopping spam and automated sign-ups on forms | Consent, 6(1)(a); you can withdraw it under Cookie settings in the footer |
| Name, email address and message sent through the contact form | Answering you and keeping a record of requests | Legitimate interests, 6(1)(f), and legal obligation, 6(1)(c), for rights requests and legal notices |
Our legitimate interests are running a safe, reliable community and answering people who contact us. You can object to this processing at any time; see your rights.
A username and email address are required to create an account. Without them we cannot provide one. You can read most of OBD4 without an account. We collect this data from you directly, although other people may mention you in a report.
What is public
Your username, display name, the profile details you fill in, and your publications, comments and accepted solutions are public and may be indexed by search engines. If you allow it in your settings, who you follow is also public.
Your email address, IP address, saved items, notification settings, reports and moderation history are not public.
VIN decoder
You can use the decoder without an account. A VIN can count as personal data, so please only enter one you have a reason to look up.
- Your vehicle selection is stored in your session and ends with it. You can clear it at any time on the vehicle page.
- If you save a vehicle to your account, we store its details and the first 11 VIN characters, never the serial number, until you remove it. Saved vehicles are private and not shown on your public profile.
- To identify the vehicle, our server sends the VIN to the US National Highway Traffic Safety Administration's public vPIC service and, where enabled, to the commercial VIN data provider Vincario. Your name, account and IP address are not sent with it.
- The US lookup is an international transfer made because you asked for the decoding (GDPR Article 49(1)(b)).
- We keep their answers for up to 30 days so we don't repeat lookups. They are stored under a keyed hash rather than the VIN itself.
Who receives data
We do not sell personal data or use it for advertising. We share it only with:
- our hosting and backup providers and our email delivery provider, who act on our instructions under data processing agreements,
- Cloudflare, which runs the security check on forms if you allow it,
- the VIN data services described above,
- authorities, courts or others where the law requires it or where it is needed to establish or defend legal claims.
If a provider handles personal data outside the European Economic Area, we rely on an adequacy decision or standard contractual clauses. You can ask us for a copy of the safeguards.
How long we keep data
| Data | How long |
|---|---|
| Account and profile data | Until your account is deleted; we delete it within 30 days of a confirmed request |
| Public contributions | Stay on the site without your name after account deletion, as other members rely on them. Contact us to remove any that identify you. |
| Session records | Removed after they expire, 2 hours after your last activity |
| Temporary rate limits | Up to one hour |
| Server logs | Up to 30 days |
| Backups | Up to 30 days, then overwritten |
| Read notifications | 180 days |
| VIN lookup answers | Up to 30 days |
| Vehicles saved to your account | Until you remove them |
| Reports, moderation records and correspondence | Up to 3 years after the case closes, or longer if needed for a legal claim |
Your rights
You have the right to:
- get a copy of your personal data and information about how we use it,
- have inaccurate data corrected (you can change most of it in your settings),
- have your data deleted, and restrict how we use it, in the cases set out by law,
- receive data you gave us in a portable format,
- object at any time to processing based on our legitimate interests.
To use these rights, use the contact form and give the email address on your account. We answer within one month, free of charge.
You can also complain to the data protection authority where you live or work, or where you think the breach took place.
Automated decisions
We do not make decisions with legal or similarly significant effects by purely automated means, and we do not profile you for marketing. A publication that an automatic check places in the review queue is decided by a moderator.
Children
OBD4 accounts are for people aged 16 or over. If you believe a younger child has an account, please contact us and we will delete it.
Security
We use encrypted connections, hashed passwords, restricted staff access and limits on repeated attempts. If a data breach puts your rights at high risk, we will tell you without undue delay.
Cookies
We use essential cookies, and Cloudflare's security check only if you allow it. See the cookie information.
Changes
If we change this policy, we update the date at the top. We tell members by email or on-site notice about changes that materially affect them.