Wynkoop Consulting LLC (“we,” “us,” or “our”) operates Car Key API. This policy explains how we handle personal information when you visit our website, contact us, use a customer account or our API, or interact with a Car Key API lookup widget.

1. Information we collect

Inquiries and communications: your name, email address, company, project description, requested vehicle coverage, estimated usage, and information you include in messages.
Accounts and settings: your email, company, password hash, account status, API key identifiers and hashes, and widget settings such as business names, contact links, and permitted website origins. Passwords and authentication credentials are stored in hashed form.
Service activity: requested vehicle makes, models and years, request paths, timestamps, status codes, duration, and limited request and response previews. Account owners can see activity associated with their API keys and widgets.
Billing: Stripe customer and subscription identifiers, subscription status, usage totals, and related billing records. Payment details are collected by Stripe through its hosted checkout and billing portal; our application does not collect or store your full payment card number.
Technical information: IP addresses and connection information used to serve requests, operate infrastructure, and limit abuse. Hosting and other service providers may process browser and request information when delivering the service.

Please do not submit passwords, API keys, vehicle owner details, or other sensitive personal information in inquiry text or vehicle lookup parameters.

2. How we use information

We use information to respond to inquiries, provide and administer accounts, deliver vehicle lookups, configure widgets, measure billable usage, process payments, send account and password-reset messages, troubleshoot problems, protect the service, and meet legal obligations.

3. Cookies and external resources

Account pages use an essential session cookie named catalog_session for sign-in and request security. Sessions expire after 12 hours. Blocking this cookie can prevent account features from working. The public marketing pages do not include advertising or analytics scripts.

Marketing pages load fonts from Google Fonts, which receives connection information such as your IP address when your browser requests those resources. Stripe's hosted pages have their own cookie and privacy practices. See Google's privacy policy and Stripe's privacy policy.

The service does not use personal information for cross-site targeted advertising. It does not change its behavior in response to a browser's Do Not Track signal.

4. When information is disclosed

We disclose information to providers that help us operate the service: hosting and storage providers, Amazon Web Services for infrastructure and email delivery, Stripe for payments and usage billing, and Make it Real for storing access inquiries. Information is provided as needed for those functions.

Widget lookup activity is associated with the account that operates the widget and may be viewed by that account's authorized users. A website embedding a widget may separately collect information under its own privacy policy. Following a widget's contact link takes you to that business's chosen destination.

We may also disclose information when required by law, to protect rights and security, to advisers supporting our business, or in connection with a merger, acquisition, or transfer of the service, subject to applicable privacy obligations. We do not sell personal information or share it for cross-context behavioral advertising.

5. Retention and security

Customer request and response history is available for 30 days and scheduled for deletion after that period. Previews are size-limited and redact credentials and temporary image URLs. Billing usage records are retained separately. We retain account information, inquiries, communications, and billing records for as long as needed to provide the service, resolve disputes, maintain necessary business records, or comply with law. Backup copies may remain until they are rotated out.

We use measures such as hashed credentials, access controls, and encrypted connections to protect information. No storage or transmission method can guarantee complete security.

6. Your choices and requests

You can manage API keys, widgets, and billing through your account. To request access to, correction of, or deletion of your personal information, or to ask about our practices, email michael@wynkoopconsulting.com. You do not need to create an account to make a request. We may need to verify your identity and authority before providing or changing information.

Depending on your location and which laws apply, you may have rights to obtain a copy of information, restrict or object to processing, withdraw consent where processing is based on consent, or complain to a privacy regulator. California residents may have rights to know, access, correct, or delete personal information, and to exercise applicable rights without discrimination. Authorized agents may contact us on your behalf; we may request proof of authorization. Some records may be retained where permitted or required by law.

7. International use and children

Information may be processed in the United States and other locations where our providers operate, whose privacy laws may differ from those where you live. The service is intended for business users and is not directed to children under 13. If you believe a child has provided personal information, contact us so we can investigate and remove it as appropriate.

8. Changes and contact

We will post updates here with a revised effective date. For material changes, we will provide additional notice where required by applicable law.

For privacy questions or requests, contact Wynkoop Consulting LLC at michael@wynkoopconsulting.com.