Privacy Policy

Last updated: July 26, 2026

1. What this policy covers

TitlePull LLC ("TitlePull") operates titlepull.com and provides vehicle history reports. This policy describes what information is collected, how it is used, and your rights regarding that information.

2. Information collected

When you purchase a report, the following is collected: your email address, the VIN of the vehicle being checked, payment information (processed by Stripe, card numbers are never stored by TitlePull), and IP address for fraud prevention. When you contact support, any information you choose to share is collected.

3. How information is used

Email address: to deliver your report, send transactional confirmations, and (if you opt in) send marketing emails. VIN: to look up the vehicle history report from the upstream data provider. Payment information: processed by Stripe to complete the transaction. IP address: to prevent fraudulent transactions.

4. Who information is shared with (sub-processors)

VinData (VDP LLC), the upstream Approved NMVTIS Data Provider, receives the VIN you submit so it can return the corresponding records. OpenAI, L.L.C. receives the resulting data so its AI model can generate the plain-language report summary; OpenAI does not use this data to train its models. Stripe processes payments. Resend (Resend, Inc.) delivers transactional and marketing emails. Supabase (Supabase, Inc.) hosts the application database and stores your report PDF for up to 90 days. Supabase runs on AWS infrastructure. Umami (Umami Software, Inc.) provides privacy-friendly, cookieless website analytics. It receives only aggregate usage data such as pages viewed, referring site, browser type, and approximate country, and it does not receive your VIN, your report, your email, or any other personal information. TitlePull does not sell your information to third parties and does not use advertising cookies or cross-site tracking. The only analytics we use is the privacy-friendly, cookieless tool described in Section 5.

4a. State DMV data and the Driver Privacy Protection Act

Vehicle title data sourced from state DMVs through NMVTIS is used in accordance with the Driver Privacy Protection Act (DPPA, 18 U.S.C. § 2721). TitlePull's reports do not include driver names, addresses, or other personal identifying information about vehicle owners. Reports describe the vehicle's title history, brand history, and odometer history only.

5. Cookies and analytics

TitlePull uses Umami, a privacy-friendly and cookieless analytics tool, to understand aggregate website usage such as which pages are visited, how many visitors we receive, where they arrive from, and general browser and country information. Umami does not use cookies, does not track you across other websites, does not store your IP address, and does not collect personal information. We do not use analytics for advertising, and we do not sell or share this data. Aggregate analytics data is processed by Umami on servers in the United States. Separately, basic traffic data is visible through standard server logs (which record IP address, request URL, timestamp, and user agent, the same information any web server records); server-log data is retained for 90 days and is not shared with any third party.

5a. Cookies and local storage

TitlePull stores a small amount of data in your browser's localStorage to remember your in-progress VIN form so you don't lose it on a page refresh, and to associate your post-checkout report view with the email you used at purchase. Stripe sets payment-processing cookies during checkout for fraud detection. These are controlled by Stripe and are not used by TitlePull for advertising or tracking. We do not set third-party advertising cookies and do not run any cross-site tracking pixels. Our analytics tool, Umami, is cookieless and sets no cookies. You can clear localStorage and cookies at any time via your browser settings.

6. Data retention

  • PDF report files: download links remain active for 90 days from purchase, after which the report is anonymized or deleted per our data provider agreement.
  • Vehicle history data (VIN, title records, retrieved data): retained for up to 90 days per our data provider agreement, then anonymized or deleted.
  • Email address and order metadata: retained for the period required for tax and customer-service purposes (up to 7 years).
  • Analytics data (aggregate site-usage data, with no personal information): retained by our analytics provider (Umami) in line with the data-retention settings on our account.
  • Audit logs (no PII): retained for the period required by federal NMVTIS reporting rules, in compliance with our upstream provider's reseller obligations.

6a. Security

TitlePull uses industry-standard security controls to protect your information. All data transmitted between you and TitlePull is encrypted in transit using TLS 1.2 or higher. Personal information stored in our database is encrypted at rest. Access to production systems is restricted to authorized personnel using multi-factor authentication. PDF reports are delivered via signed, time-limited URLs that expire after 90 days. We do not store payment card numbers, Stripe handles all payment processing.

If TitlePull experiences a data breach affecting your personal information, we will notify you and applicable regulators as required by law.

7. Your rights

Depending on your jurisdiction (EU/UK/California/etc.), you may have rights to access, correct, or delete your personal information. Some retention obligations are required by law, such as the 90-day vehicle history data retention required by our agreement with our upstream data provider, and the retention period generally used for transaction and tax records, typically up to 7 years, and override deletion requests to that extent. To exercise these rights, email support@titlepull.com. Because our analytics is cookieless and collects no personal information, we do not display a cookie-consent banner.

7a. California residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

  • Right to know: request a copy of the personal information we have collected about you in the past 12 months
  • Right to delete: request deletion of your personal information, subject to legal retention requirements
  • Right to correct: request correction of inaccurate personal information
  • Right to opt out of sale or sharing: as stated below, TitlePull does not sell or share personal information for cross-context behavioral advertising
  • Right to limit use of sensitive personal information: TitlePull does not use sensitive personal information for purposes that would trigger this right
  • Right to non-discrimination: we will not discriminate against you for exercising any of these rights

Do Not Sell or Share My Personal Information. TitlePull does not sell personal information and does not share personal information for cross-context behavioral advertising as those terms are defined in the CPRA. We do not need a separate opt-out mechanism because we do not engage in these practices.

To exercise any California right, email support@titlepull.com with the subject line "California Privacy Request." We may need to verify your identity before processing the request. Our website analytics is aggregate and cookieless, is not used for advertising, and does not involve the sale or sharing of personal information.

8. Children

TitlePull is not directed at children under 13 and does not knowingly collect information from children under 13.

9. Changes to this policy

This policy may be updated from time to time. Material changes will be posted at titlepull.com/privacy with an updated "last updated" date.

10. Contact

Questions about this policy: support@titlepull.com.