Check Engine Plan — Privacy Policy

1. Introduction & who we are

Dantes Creative Labs LLC (“DCL,” “we,” “us,” or “our”) is an Arizona limited liability company and independent software studio based in Phoenix, Arizona, United States. We build mobile applications and web tools. This policy describes our privacy practices for Check Engine Plan, a web application we operate at checkengineplan.com (the “Service”). It also covers your interactions with us in connection with the Service, such as support and refund requests.

For the purposes of the EU and UK General Data Protection Regulation (together, “GDPR”), DCL is the “controller” of the personal information described in this policy. For the purposes of U.S. state privacy laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), DCL is the “business” that determines the purposes and means of processing.

EU/UK representative (Article 27). DCL has not appointed a representative in the European Union or the United Kingdom under Article 27 of the GDPR. If a representative is later appointed, that representative's name and address will appear here and in the How to contact us section. Until then, individuals in the EEA or UK may contact us directly at contact@dantescreativelabs.com.

You can reach us at any time at contact@dantescreativelabs.com. Full contact details are in the How to contact us section below.

2. Scope of this policy

This policy applies to information we handle through the Service and to individuals worldwide who use it or interact with us in connection with it. It does not apply to:

• The practices of Stripe, which processes your payment when you buy a report. Stripe has its own privacy policy, available at stripe.com/privacy, that governs its handling of your payment information.
• The practices of Anthropic, whose API we use to generate reports, described in AI processing via the Anthropic API.
• Third-party websites, products, or services that we link to.

Where this policy and any on-page notice conflict, the on-page notice controls for the specific feature it describes.

3. Information we handle

Check Engine Plan is designed to collect as little as possible. There are no user accounts and no passwords. Stripe collects your payment details and checkout email address directly; your full card data never touches our servers. We retrieve the checkout address only after successful payment, use it to send the private report link, and do not copy it into our application database. The information we handle is limited to what is needed to generate and deliver your report:

Sources of information. We collect the code and vehicle details directly from you. Stripe provides the checkout session ID, payment status, and checkout email address after payment. Resend returns a provider message ID plus an API acceptance or error result; this does not prove inbox delivery. Vercel generates request and runtime metadata automatically when it hosts and serves the application.

Sensitive information. We do not intentionally store your name, full payment-card number, or special categories of sensitive personal information. A VIN identifies a vehicle, not a person, and providing it is optional.

No advertising or tracking. We do not sell or share your personal information, and we do not use third-party advertising networks or cross-site tracking. See How information is shared.

4. Payments via Stripe

When you buy a report, the one-time $7.99 payment is processed by Stripe through Stripe Checkout. Stripe collects your payment details and checkout email address directly. After successful payment, Stripe provides our server with the checkout session ID, payment status, and email address. We use the address only to send your private report link through Resend and do not store it in Supabase. Your full card number never touches our servers.

Stripe handles your payment information under its own privacy policy, available at stripe.com/privacy. There is no subscription and no stored payment method with us; each report is a separate one-time purchase.

5. AI processing via the Anthropic API

Your report is generated by a large language model via the Anthropic API. To generate it, we send your inputs — the OBD-II code and vehicle details (year, make, model, mileage, and VIN if provided) — to Anthropic for processing. We do not send your checkout email address, payment details, or email-send metadata to Anthropic. Anthropic processes the report inputs under its own privacy practices, available at anthropic.com/privacy.

6. Where your data lives

Your report inputs, generated report, Stripe checkout session ID, and email-send workflow state are stored in Supabase, a hosted Postgres database located in the United States. The checkout email address is not stored there: our Vercel-hosted server checks it after successful payment and retrieves it again from Stripe when the generated report is ready, then passes it to Resend with the private report URL. Resend processes the recipient address, fixed message content, and send metadata in the United States and currently retains email data for 30 days. Vercel processes runtime request metadata in its hosting infrastructure. DCL is based in the United States. If you use the Service from elsewhere, this information may be transferred to and processed in the United States.

7. Report permalinks

Each report lives at its own unguessable link. There is no account or password protecting it; instead, the link itself is the key: anyone who has the link can view that report. We do not list or index report links, and we instruct search engines not to index them (via robots directives), but we cannot control what happens to a link after you share it.

Share your report link only with people you trust — for example, your mechanic. If you post the link publicly, anyone who finds it can read the report, including the vehicle details and VIN (if provided) it contains. If you want a report deleted, see Data retention & deletion.

8. How information is used

We use the information described above to:

• Generate your report from the code and vehicle details you enter, via the Anthropic API;
• Confirm your payment through the Stripe checkout session ID and deliver the report you bought;
• Email the private report link to the address used at Stripe Checkout;
• Keep your report available at its permalink;
• Process refund requests within the 7-day refund window; and
• Respond to you if you contact us for support, using only the information you choose to include in your message.

We do not add checkout addresses to a mailing list or use them for product announcements, promotions, advertising, or other marketing. We do not build advertising or behavioral profiles or use your data for cross-context behavioral advertising. See How information is shared.

9. Legal bases for processing (EU/UK)

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with similar requirements, we rely on the following legal bases:

Performance of a contract

To provide the Service you purchase — generating your report, confirming payment, emailing its private link, and keeping it available at that link (GDPR Article 6(1)(b)).

Legitimate interests

To respond to support and refund requests you send us, to prevent fraud and abuse, and to keep the Service working securely, where those interests are not overridden by your rights and freedoms (GDPR Article 6(1)(f)).

Legal obligation

To comply with applicable laws, regulations, and lawful requests, including tax and accounting obligations relating to payments (GDPR Article 6(1)(c)).

10. How information is shared

We are not in the business of selling or sharing data. We share information only in the limited circumstances described here.

10.1 Service providers

We use a small number of service providers to operate the Service:

• Stripe processes payments and provides the paid checkout session ID, payment status, and checkout email address used for transactional delivery. See Payments via Stripe and stripe.com/privacy.
• Anthropic receives your report inputs (code and vehicle details) through its API in order to generate the report. See AI processing via the Anthropic API.
• Supabase hosts our database, where your inputs, report, checkout session ID, and email-send workflow state are stored. We do not store the checkout email address there. See Where your data lives.
• Resend sends the one-time report-link email and processes the recipient address, fixed message content (including the private report URL), and delivery metadata. We keep open and click tracking disabled.
• Vercel hosts the web application and its server routes and automatically generates runtime logs containing request and function metadata. An actual request path can contain the private report identifier.

10.2 People you share a report link with

Anyone you give a report link to can view that report. That sharing is under your control, not ours. See Report permalinks.

10.3 Legal, safety, and business transfers

We may disclose information if we believe in good faith that doing so is necessary to comply with a law, regulation, legal process, or governmental request; to enforce our terms; or to protect the rights, property, or safety of DCL, our users, or the public. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy.

10.4 What we do not do

We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA and similar U.S. state laws. We do not use third-party advertising networks or permit any third party to track you across websites through the Service. In the preceding twelve (12) months, we have not sold or shared personal information for cross-context behavioral advertising.

11. Data retention & deletion

Reports are kept so their permalinks keep working. Because there are no accounts, your report link is the only way back to your report, and deleting reports on a schedule would break links people rely on — for example, a link you shared with your mechanic. We therefore retain reports and their associated inputs and checkout session IDs unless and until you ask us to delete them.

Checkout email. We check the address after successful payment and retrieve it again from Stripe when attempting the one-time send; we do not retain a copy in Supabase. Resend currently retains sent-email data for 30 days. Stripe retains checkout information under its own policy and legal obligations. We never retain checkout addresses to build a marketing list.

Hosting logs. Vercel automatically creates runtime logs when the Service receives a request. Our launch configuration uses Vercel's standard Pro runtime logs, which Vercel currently retains for one day. We do not enable Observability Plus or Log Drains for this Service, do not share log links, and do not add private report identifiers or caught provider payloads to our own application error messages.

Deletion on request. If you would like your report and its associated data deleted, email contact@dantescreativelabs.com and include the private report link plus, if requested, the Stripe receipt or checkout address so we can locate the record and reasonably verify the request. We may retain limited records where required for legal, tax, accounting, fraud, or dispute-resolution purposes.

If you email us for support, we keep your message only for as long as needed to help you and to keep a reasonable record, and then delete it, unless a longer period is required to comply with our legal obligations or resolve disputes.

12. Security

We use reasonable administrative, technical, and organizational measures designed to protect information. We operate no accounts or passwords; full payment details go directly to Stripe; checkout addresses are processed only by server-side code and are not returned by report or status endpoints; and the email contains no VIN, diagnostic code, vehicle details, or report contents. The Service uses HTTPS, report links are unguessable, report responses are private and non-indexable, Resend open/click tracking remains disabled, and access to short-retention hosting logs is limited to authorized operators.

No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for controlling who you share your report link with; anyone with the link can view the report.

13. Children's privacy

The Service is intended for a general audience of vehicle owners and is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children under 13 in a manner that would require verifiable parental consent under the U.S. Children's Online Privacy Protection Act (“COPPA”) or similar laws. The Service operates no accounts; Stripe collects the checkout address used for report delivery.

In the European Economic Area and the United Kingdom, the minimum age at which a child can consent to the processing of personal information (the “digital age of consent”) is set by local law and ranges from 13 to 16 depending on the country. Where you are in the EEA or UK, we do not knowingly collect personal information from anyone below the applicable local minimum age without the consent or authorization of a parent or guardian as required by that local law.

If you believe a child has provided us with personal information, please contact us at contact@dantescreativelabs.com and we will take appropriate steps to delete it.

14. Your privacy rights & choices

You have choices about your information, and depending on where you live, you may have specific legal rights. Because there are no accounts, the practical way to exercise most rights is to email us with the private report link and, if requested, the Stripe receipt or checkout address so we can locate the purchase and reasonably verify the request.

14.1 California residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know / access the categories and specific pieces of personal information we have collected about you, the sources, purposes, and categories of recipients;
• Delete personal information we have collected from you, subject to legal exceptions;
• Correct inaccurate personal information we maintain about you;
• Opt out of sale or sharing of your personal information for cross-context behavioral advertising — note that we do not sell or share personal information, so there is nothing to opt out of;
• Limit the use and disclosure of sensitive personal information — we do not collect or use sensitive personal information to infer characteristics about you, so there is nothing to limit; and
• Not be discriminated against for exercising your privacy rights.

Categories of personal information. The table below maps the information described in Information we handle to the categories enumerated under the CCPA/CPRA. We do not “sell” or “share” (for cross-context behavioral advertising) any category of personal information.

You may exercise these rights by emailing contact@dantescreativelabs.com. You may use an authorized agent to submit a request on your behalf; we may ask the agent to provide proof of authorization. Because we do not maintain accounts, include the report link and, if requested, the Stripe receipt or checkout address so we can locate the relevant record and reasonably verify the request.

14.2 EU, UK, and other regions (GDPR and similar laws)

If you are in the EEA, the UK, or a jurisdiction with comparable laws, you may have the right to request access to, correction of, or deletion of your personal information; to restrict or object to certain processing; to data portability; and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local data-protection or supervisory authority.

14.3 How to exercise your rights

To make any privacy request, email us at contact@dantescreativelabs.com, tell us what you would like to do, and include your report link plus any requested purchase-verification detail. We will respond within the timeframes required by applicable law. There is no charge to make a request in most cases, and we will not discriminate against you for making one.

15. Do Not Track & Global Privacy Control

Some browsers offer a “Do Not Track” (“DNT”) setting. Because there is no common industry standard for how to respond to DNT signals, we do not currently respond to them. We do, however, honor the Global Privacy Control (“GPC”) and similar opt-out preference signals where legally required. Because we do not sell or share personal information for cross-context behavioral advertising, a GPC signal will not change how we handle your information — there is nothing for it to opt out of.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we do, we will revise the “Effective” date above and post the updated policy at https://dantescreativelabs.com/products/check-engine-plan/privacy/. If we make material changes, we will take additional steps to notify you where required by law. Your continued use of the Service after an update takes effect means you have reviewed the current policy.

17. How to contact us

If you have any questions, requests, or concerns about this Privacy Policy or our privacy practices, please contact us:

Email

contact@dantescreativelabs.com

Mail

Dantes Creative Labs LLC
4539 N 22nd St, Ste R
Phoenix, AZ 85016
USA

Policy URL

https://dantescreativelabs.com/products/check-engine-plan/privacy/

EU/UK representative (Article 27). DCL has not appointed a representative in the European Union or the United Kingdom under Article 27 of the GDPR. If a representative is appointed, that representative's name and address will be listed here. In the meantime, individuals in the EEA or UK, and supervisory authorities, may contact us directly using the email and mailing address above.

We will do our best to resolve any concern you bring to us directly.