Privacy Policy | ServiceStamp

1. Introduction

Service Stamp Ltd (Company No. 17159900), trading as ServiceStamp ("we", "our", or "us"), with its registered office at Unit 5 Grahamstown Rd, Sedbury, Chepstow, NP16 7AD, United Kingdom, is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, store and protect your information when you use our vehicle service history checking service at servicestamp.us.

We are a company based in the United Kingdom serving customers in the United States. The systems that store your data for this site run in the United States (Section 5), and our team accesses them from the United Kingdom.

2. Information We Collect

2.1 Information You Provide

When you use our service, we collect:

Email address: for sending your report, order confirmation and receipt
Vehicle Identification Number (VIN): to confirm the vehicle's make and model year and to retrieve its service history from the manufacturer
Name: if you enter it at checkout or in a message to us
Payment information: processed securely by Stripe (we do not store your full card details)
Account and sign-in data: your email address and the secure magic-link tokens we use instead of passwords
Reviews: the rating, comment and display name you submit when reviewing a report
Support and contact messages: your name, email address and the content of messages you send us
Marketing choice: whether you opted in to marketing email, and the wording you agreed to

2.2 Automatically Collected Information

In our server request logs (used for security, abuse prevention and basic operation):

Browser and device information: IP address, browser type, device type, operating system
Rate-limiting data: a hashed (pseudonymized) version of your IP address, held briefly to enforce fair-use limits on VIN checks

Only if you give analytics consent (see Section 9):

Usage data: pages visited, time spent on site, referring websites, campaign parameters
Analytics cookies: Google Analytics and Ahrefs Analytics cookies (see Section 9)

3. How We Use Your Information

3.1 To Provide the Service

To confirm the vehicle's eligibility and retrieve and generate your service history report
To deliver your purchased report by email and in your dashboard
To process your payment securely and issue receipts and refunds
To provide customer support for your order
To operate your account, dashboard and sign-in links

3.2 Legal and Operational Purposes

To comply with tax, accounting and other legal requirements
To respond to lawful requests from authorities
To detect and prevent fraud, abuse and technical issues, including enforcing fair-use limits with hashed IP addresses
To improve our service and user experience using non-tracking signals (for example server logs and support messages)

3.3 With Your Consent

To set analytics cookies (Google Analytics, Ahrefs) and analyze aggregated usage patterns, only if you accept analytics in the cookie banner
To send optional marketing email, only if you opt in at checkout or in your account settings

Marketing email and CAN-SPAM: every marketing email we send will identify us as the sender, include our postal address and carry a working unsubscribe link, and we will honor an unsubscribe within 10 business days. Transactional emails about your order (receipts, report links, sign-in links, refund notices and a one-time request to review your report) are not marketing and are sent to every customer. You can change your marketing choice at any time in your account settings.

You can withdraw cookie consent at any time via the “Cookie preferences” link in the footer. Withdrawal does not affect processing carried out before withdrawal.

4. Data Sharing and Third Parties

We work with service providers who process data on our behalf to run the service:

4.1 Service Providers

Stripe (payment processing): Stripe, Inc. processes all payments and stores card details securely. Stripe is PCI DSS Level 1 certified. See Stripe's Privacy Policy.
Manufacturer data provider: we retrieve official manufacturer service history through an authorized third-party data provider that has secure access to manufacturer systems. We send the VIN only; never your name, email or payment details.
NHTSA (vehicle decode): before payment we send the VIN to the National Highway Traffic Safety Administration's public vehicle database to confirm the make, model and model year. No personal information is sent with it.
Neon (database hosting): your email, VIN and report data are stored in a Neon Postgres database with encryption in transit and at rest, hosted on cloud infrastructure in the United States.
Resend (email delivery): our transactional and, if you opt in, marketing emails are sent through Resend, which processes your email address and the message content in order to deliver them. See Resend's Privacy Policy.
Vercel (hosting): our website runs on Vercel, which processes requests to serve pages and keeps short-lived server logs (including IP addresses) for security and operation. Vercel also sets the infrastructure cookies described in Section 9.1. See Vercel's Privacy Policy.
Upstash (rate limiting and caching): we use Upstash Redis to enforce fair-use rate limits and to cache vehicle decodes. It holds hashed (pseudonymized) identifiers and VIN decode results only, never your email address. See Upstash's Privacy Policy.

4.2 We Never Sell Your Data

We do not sell, rent or trade your personal information, and we do not share it with third parties for their own marketing.

5. Data Storage and Security

5.1 Where We Store Your Data

Our database, cache and hosting for this site run in data centers in the United States
Our team, based in the United Kingdom, accesses that data to operate the service and provide support
All data is encrypted both in transit (TLS) and at rest
Access to personal data is restricted to authorized personnel only

5.2 Security Measures

We implement industry-standard security measures including:

Encrypted data transmission (HTTPS/TLS 1.3)
Encrypted database storage
Regular security monitoring
Passwordless, token-based sign-in
Access controls and logging

6. Data Retention

We keep personal information only for as long as we need it for the purpose it was collected for:

Your account, email, VIN and purchased reports: kept for as long as we operate the service, so that the lifetime report access you purchased is honored (see our Terms, Section 3), or until you delete your account. Deleting your account removes your reports immediately and permanently.
Payment and order records: retained for 7 years to meet tax and accounting requirements. If you delete your account, these records are kept with personal details removed.
Support and contact messages: kept for up to 24 months after the conversation ends
Reviews: kept while the related report exists
Website usage data: retained for up to 24 months for analytics purposes

You can request deletion of your personal information at any time (see Section 7).

7. Your Privacy Rights

Whatever state you live in, you can ask us to:

Access the personal information we hold about you and receive a copy in a portable format
Correct inaccurate or incomplete information
Delete your personal information (we may need to keep order records for tax and accounting purposes, with personal details removed)
Opt out of marketing email at any time

Residents of California and certain other states have additional rights under their state privacy laws, including the right to know the categories of information we collect and share, the right to opt out of any sale or sharing of personal information, and the right not to be discriminated against for exercising these rights. We honor these requests for every US customer.

To exercise any of these rights, contact us via our contact form or at hello@servicestamp.us. We will respond within 45 days. We do not carry out automated decision-making that produces legal or similarly significant effects about you.

8. Children's Privacy

Our service is not directed to children under 13 and is not intended for anyone under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately and we will delete it.

9. Cookies and Tracking

We use cookies and similar technologies (including localStorage and sessionStorage) to operate the site and, with your consent, to understand how it is used. On your first visit you'll see a cookie banner; non-essential cookies are not set until you accept them. You can change your choice at any time via the link in the footer.

9.1 Strictly Necessary (no consent required)

These are required for the service you've requested and cannot be switched off:

Session and authentication cookies: to keep you logged in and maintain your browsing session
Security cookies: CSRF protection and abuse prevention
Consent storage: ss_consent_v1 in localStorage records your cookie choices so we don't re-prompt
Stripe (checkout only): __stripe_mid and __stripe_sid, set by Stripe on the checkout page for fraud prevention
Vercel infrastructure cookies: bot-challenge and routing cookies set by our hosting provider

9.2 Analytics (consent required)

Only set if you accept analytics in the cookie banner. They help us understand how the site is used so we can improve it:

Google Analytics 4: _ga, _ga_*, _gid, _gat_*. Retained up to 2 years (default 14 months for event data). Provided by Google LLC. See Google's Privacy Policy.
Ahrefs Analytics: first-party cookies set by analytics.ahrefs.com for aggregate traffic measurement. See Ahrefs' Privacy Policy.
Campaign parameter tracking: utm_params in sessionStorage, used to attribute traffic sources to analytics events. Cleared automatically when the browser tab closes.

9.3 Marketing (consent required)

Only set if you accept marketing in the cookie banner. Used solely to measure whether our advertising works, by matching a purchase to the ad click that led to it. We do not use these for personalized advertising or remarketing.

Google Ads conversion measurement: _gcl_au and other _gcl_* cookies (typically retained around 90 days). Provided by Google LLC. See Google's Privacy Policy.
Campaign parameter storage: campaign identifiers from ad links (including the Google click ID) held in utm_params sessionStorage and, if you buy, stored against your order so we can attribute the sale. Cleared automatically when the browser tab closes.

9.4 Withdrawing or Changing Consent

Open at any time to change or withdraw consent. Withdrawing analytics or marketing consent stops new cookies being set, and we delete the corresponding Google cookies immediately when you save the change.

10. International Data Transfers

Your data is stored in the United States and accessed from the United Kingdom by our team, and some of our service providers (Section 4) process data in other countries. We use contractual safeguards with our providers and the security measures in Section 5 wherever your data is processed.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by:

Updating the "Last updated" date at the top of this page
Sending an email notification if the changes materially affect your rights

12. Complaints

If you have concerns about how we handle your personal information, please contact us first via our contact form; we will respond within two business days. You may also contact the consumer protection office or attorney general of the state where you live. As a company registered in the United Kingdom, we are also registered with the UK Information Commissioner's Office (registration ZC148476), which supervises our data protection practices.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us:

Email: hello@servicestamp.us
Mail: Service Stamp Ltd, Unit 5 Grahamstown Rd, Sedbury, Chepstow, NP16 7AD, United Kingdom
Website: servicestamp.us