Privacy Policy — VINdicated.ai

Effective date: September 11, 2025

Last updated: September 11, 2025

VINdicated is designed to minimize sensitive data. You control your information. You can delete your data and delete your account. When documents or extracted text are uploaded for analysis, they are kept only as long as needed to provide the service and are scheduled for deletion within 30 days unless you delete them sooner.

This Privacy Policy explains how VINdicated.ai ("VINdicated," "we," "our," or "us") collects, uses, shares, and protects information when you use our websites, apps, and services (collectively, the "Services").

We separate our practices into two clear contexts:

1. The App (contract scan/analysis).

2. The Marketing Site & Affiliate Links (including third‑party tracking such as CJ Affiliate).

If you have questions, contact us at privacy@vindicated.ai.

1) The App (Contract Scan/Analysis)

What We Collect

• Account info you provide (such as email)

• Documents you upload for analysis (e.g., images/PDFs)

• Extracted text from those documents (OCR) used to generate results

• Deal summaries/analysis outputs created from your documents

• Basic usage/diagnostic data needed to operate the service (where applicable)

What we process.

• Information contained in documents you upload or scan (e.g., finance numbers, fees, rates, add‑ons, APR, trade‑in values, taxes, and other deal terms).

• Account information you provide (e.g., name, email) to create or manage your account.

• Payments: processed by Stripe. VINdicated.ai does not store full payment card numbers. See Stripe’s privacy policy for details.

• Basic technical data for service delivery and security (e.g., device type, approximate location derived from IP, timestamps, error logs).

What we try not to keep.

• We design the App to analyze numbers and deal terms and to avoid storing directly identifying information (e.g., names, addresses) longer than necessary for the analysis.

• By default, we do not retain uploaded documents beyond what’s necessary to complete the analysis and show your results.

• If you choose to save analyses to your account or export results, we will store only what is needed to provide that feature.

Lawful bases (GDPR/UK GDPR).

• Performance of a contract (to deliver the analysis you request).

• Legitimate interests (to keep Services secure; prevent fraud; improve core functionality).

• Consent (where we explicitly ask for, and you grant, consent—for example, for optional features or certain cookies outside the App).

Data Retention

• Uploaded documents and raw extracted text (OCR) are scheduled for deletion within 30 days after upload.

• Deal summaries and analysis results may remain available in your account so you can reference them later, unless you delete them.

• You may delete individual deals/documents at any time, and you may delete your account.

Your Controls (Export / Delete / Account Deletion)
You can:

• Export your data (where available)

• Delete individual deals/documents

• Delete your account (which removes your account data, subject to legitimate operational and legal requirements)

2) The Marketing Site & Affiliate Links (including CJ Affiliate) (including CJ Affiliate)

Our marketing website may use cookies and similar technologies for analytics, performance, fraud prevention, and to operate affiliate links. Some of these come from third parties such as CJ Affiliate.

What may be collected through affiliate/analytics tags.

• Browser and device information (user agent, browser type/version), cookie IDs, clicks, impressions, timestamps, referring URL, page URL.

• Transactional signals tied to affiliate performance (e.g., whether a referral resulted in a sign‑up or purchase).

• No directly identifying information (like your full name or contact info) should be sent via CJ’s tracking code, and we implement safeguards to prevent this.

CJ Affiliate role and data.

• VINdicated and CJ each act as independent controllers of certain data collected via CJ tags.

• CJ and/or advertisers may use data for attribution, performance measurement, fraud prevention, and network improvement, and may re‑market consistent with their own privacy notices.

• We do not sell your personal information as that term is defined under U.S. state privacy laws; however, cross‑context behavioral advertising by third parties (including via cookies) may be considered a “share.” You can opt out (see Your Privacy Rights & Choices below).

EU/UK consent.

• Where required, we obtain cookie consent before setting or reading non‑essential cookies (including CJ Affiliate cookies) and provide choices via our cookie banner.

Your Privacy Rights & Choices

Depending on your location, you may have rights to:

• Access, correct, or delete your personal information.

• Object to or restrict certain processing.

• Data portability.

• Withdraw consent (where processing is based on consent).

• Opt out of "sale"/"sharing" (U.S. state laws) and opt out of targeted advertising.

How to exercise rights.

• Use in‑product controls where available (e.g., delete saved analyses).

• Email us at support@vindicated.ai or privacy@vindicated.ai with your request and the region you’re in.

• Manage cookies via the site’s cookie banner and your browser settings.

• Use the Global Privacy Control (GPC) signal; we honor GPC where required.

• In the U.S., you can also use the “Do Not Sell or Share My Personal Information” link in our footer (or visit /privacy-choices) to opt out of sale/sharing/targeted advertising.

CJ Affiliate and third‑party opt‑outs.

• Manage affiliate/advertising cookies through our cookie banner.

• See CJ’s privacy resources and opt‑out instructions (links below) for additional choices.

Children’s Privacy

Our Services are not intended for individuals under 18. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

Our Services are not directed to children, and we do not knowingly collect personal information from individuals under 16.
Please do not use the Services if you are under 16.

Security

We use administrative, technical, and physical safeguards designed to protect information.
No system is perfectly secure.
Please use strong, unique passwords and keep your devices up to date.

International Transfers

We may process and store information in the United States and other countries.
Where required, we rely on appropriate safeguards (e.g., Standard Contractual Clauses) for cross‑border transfers.
For CJ Affiliate data, see CJ’s transfer mechanisms in their legal resources.

Data Retention Summary

• Uploaded documents and raw extracted text (OCR) are scheduled for deletion within 30 days after upload.

• Deal summaries and analysis results may remain available in your account so you can reference them later, unless you delete them.

• You may delete individual deals/documents at any time, and you may delete your account.

Data Sharing Off
We do not share user deal data with third parties at this time.
If we ever introduce an optional, opt-in feature for sharing anonymized and aggregated data (to improve community benchmarks), it will be clearly explained in-app and will require explicit user opt-in.

What We Never Sell
We do not sell your personal information.

Do Not Track / GPC

Our Services respond to Global Privacy Control (GPC) where required by law.

Third‑Party Links

Our site may link to third‑party sites.
We are not responsible for their privacy practices.
Review their policies before sharing information.

Changes to This Policy

We may update this Privacy Policy from time to time.
If we make material changes, we will post the updated policy and revise the "Last updated" date above.

Contact Us

VINdicated.ai (Controller)
Attn: Privacy
Email: privacy@vindicated.ai
Alternate support: support@vindicated.ai
Mailing address:
Brian McGarry
VINdicated.ai
3618 W. 80th Lane #1085
Merrillville, IN 46410
United States
Phone: +1 (219) 333‑4447

If you are in the EU/UK and wish to contact a representative or Data Protection Officer (if/when appointed), email privacy@vindicated.ai and include “EU/UK Privacy” in the subject line.

CJ Affiliate Disclosures & Links

We use CJ Affiliate for performance‑based links and attribution on our marketing site.
CJ may set cookies or similar identifiers to track referrals and measure performance.
We do not allow the CJ tracking code to collect directly identifying information.

For information on CJ’s privacy practices and data transfer terms, visit:

CJ Privacy Notice: https://www.cj.com/legal/privacy CJ US Data Processing Addendum (US DPA): http://www.cj.com/legal/us-dpa CJ Standard Contractual Clauses / Model Clauses: https://www.cj.com/legal/model-clauses

To manage cookies and opt‑out of non‑essential tracking on our site, use the cookie banner.
You can also adjust your browser settings to block or delete cookies.

Region‑Specific Notices

California (CPRA)

• We do not "sell" personal information for money.

• Some third‑party cookies used for cross‑context behavioral advertising may constitute "sharing."

• You can opt out of sharing/targeted advertising via our cookie banner, by using the GPC signal, and via the “Do Not Sell or Share My Personal Information” link in our footer (or at /privacy-choices).

• You have the right to know, delete, correct, and opt out of sharing/targeted advertising.

• Sensitive personal information, if any, is used only for limited, permissible purposes.

EU/UK (GDPR/UK GDPR)

• Controller: VINdicated.ai (and, for certain affiliate data, CJ as an independent controller).

• Legal bases: performance of a contract, legitimate interests, consent (where applicable).

• Transfers: Standard Contractual Clauses and other safeguards as applicable.

• Rights: access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent.

• Complaints: You may lodge a complaint with your local Supervisory Authority.

Notes for Users

• This policy is intended to be clear and simple; it does not limit your rights under applicable law.

• If anything here conflicts with a law in your region, the law controls.

 

Marketing communications.
If you opt in, we may send VINdicated.ai updates and launch announcements. You can opt out at any time by clicking “unsubscribe” in any email. We do not sell or share your personal information for marketing purposes. Vindicated