Privacy Policy

About this policy

Haki Auto is a vehicle-research service. It helps shoppers review vehicle specifications, market-price information, owner reports, recalls, service bulletins, efficiency information and other purchasing considerations. This policy explains the information the current service uses and stores.

Information used for vehicle research

Depending on the feature you use, you may provide:

• A vehicle identification number (VIN).
• Asking price, mileage and the state where you are shopping.
• A trim or configuration choice when the VIN does not resolve it.
• Vehicles, priorities and a current-car choice for Compare Cars.
• A choice to share a result: how long the link lasts and whether to show the full VIN (see “Shared results” below).
• An optional helpful/not-helpful response and optional feedback comment.

Asking price, mileage, shopping state, comparison priorities and current-car selections are used to produce the requested research or comparison. Except in a result you choose to share (see “Shared results” below), Haki Auto does not store those shopper inputs in its vehicle cache, analytics tables or operational-monitoring tables. An explicitly identified source trim may be stored with vehicle specifications. A shopper-selected trim is used to improve market-value research but is not stored as VIN-confirmed trim.

How VINs are handled

Haki Auto uses a VIN to identify and research a vehicle. A VIN may be stored in the vehicle specification cache and VIN search history, and may be sent to relevant vehicle-data providers when required to retrieve specifications. Admin activity displays masked VINs rather than displaying the complete value. A shared result stores the full VIN only if you choose to show it (see “Shared results” below).

VIN is excluded from research analytics, feedback records, Compare monitoring and browser-error monitoring. Whether a VIN is treated as personal information can depend on context and applicable law.

First-party research analytics

Haki Auto generates a random session identifier and stores it in your browser's sessionStorage. It is intended to represent the current browser-tab session rather than a persistent advertising identity. It helps count sessions and associate research lifecycle events.

Research analytics may include whether research started, succeeded or failed; year, make and model when known; verdict and Deal Quality; whether a shopper-confirmed trim was used; and whether major research components were available. VIN, asking price, mileage and shopping state are not stored in these analytics. Haki Auto does not use this identifier to build an advertising profile.

Optional feedback

After successful research, you may optionally select Yes or No in response to “Was this research helpful?” and may add a comment of up to 500 characters. Feedback may be reviewed through protected Admin tools. Please do not include names, contact details, account information or other sensitive information in a comment.

Website analytics and security monitoring

Haki Auto runs its own limited analytics and monitoring on its own pages to understand how the site is used, to check that it is working, and to protect it from abuse. This monitoring is operated by Haki Auto itself on its own systems. It does not send visitor information to third-party analytics or advertising services, and it does not set cookies of its own.

It is separate from the hosting, content-delivery, network and security providers that deliver and protect the site. Those providers necessarily handle ordinary technical request information, including network (IP) addresses, in their own systems and under their own privacy and data-retention policies, as described under “Operational monitoring” below. Statements in this section about what is or is not stored describe Haki Auto's own analytics and monitoring records only.

What is switched on. Haki Auto switches each part of this monitoring on separately, and describes it here before it begins. This policy describes four parts, and Haki Auto plans to start them on or after the date of this policy. A part collects nothing before it is switched on. As of the date of this policy:

• Visitor analytics: described in this policy; planned to start on or after the date of this policy.
• Service health monitoring: described in this policy; planned to start on or after the date of this policy.
• Security monitoring: described in this policy; planned to start on or after the date of this policy, in observation mode only.
• Returning-visitor identifier: described in this policy; planned to start on or after the date of this policy, and only while visitor analytics is switched on.
• Partner-link click counts: not applicable, because Haki Auto does not currently operate active partner referral integrations.

The descriptions below apply to a part only once it is switched on. This policy will be updated before any new kind of monitoring is switched on, and if a part is switched off or changes how it works.

Visitor analytics. Which public Haki Auto page was opened (the page address only, never a query string or anything you typed); an approximate device type (desktop, mobile or tablet); whether the visit arrived from a search engine, a social site, another website or directly (for another website, only its host name, never the full address or any search words); and approximate numbers of visitors and sessions. Automated traffic such as search-engine crawlers and uptime monitors is counted separately, as daily totals, and is not stored visit by visit.

Daily visitor codes. To count visitors and sessions without cookies, the server combines your network address and browser type with a secret key that it holds, and produces a short code (a keyed one-way hash). Haki Auto's monitoring uses the address and the browser text only to make the code and does not store them. The code is pseudonymous, not anonymous: it is designed so that it cannot be traced back to you without that key, and it is replaced with a different code every day so that it is not used to follow you from one day to the next. The optional returning-visitor identifier described next works differently.

Returning-visitor identifier. In addition to the daily codes, Haki Auto uses one identifier that lets it recognize that the same browser has come back on a later day, so that it can tell how many of its visitors are new and how many are returning. When the analytics script runs in your browser (it runs on the home page) and this identifier is switched on, your browser creates a random identifier that is not made from your network address, your browser details or anything else about you, and keeps it in localStorage under the name haki-visitor-id. Once in each browser session, the script sends this identifier to Haki Auto. The server immediately turns it into a keyed hash using its secret key and discards the identifier itself. Haki Auto stores only that hash, the first and last time it was seen, and the number of different days on which it was seen. This record is not stored together with page views, daily visitor codes, VINs, research or feedback records. It is used only to count new and returning visitors. It is not used for advertising, for personalization or to build a profile of you, and it is not shared with other companies. Like the daily codes, it is pseudonymous.

How the daily codes and the returning-visitor identifier differ. A daily code is made on the server from your network address and browser type and is replaced every day, so it can count visitors within one day but is not used to link one day's visit to the next. The returning-visitor identifier is created in your browser and stays there until it is removed, so the same hash can be recognized on many different days; that is how a returning browser is recognized. It recognizes a browser, not a person: another browser or device, a private browsing window, or cleared site data starts a new identifier.

How long the identifier is kept. Haki Auto keeps the stored hash for about 13 months after the browser was last seen, and replaces the key that makes the hash about every 13 months, after which older records can no longer be matched to your browser. The identifier in your browser stays there until you clear the site data that your browser keeps for Haki Auto, or until the analytics script removes it, as described under the privacy signals below.

Service health. Aggregate counts of requests by type of page or service (for example, a vehicle specification lookup); the outcome class (success, client error or server error); how many responses were slow, and response-time totals; and individual failure events recording which component failed, the kind of failure and when. These records contain no visitor, session or network-address codes.

Partner-link clicks. If Haki Auto offers partner links, such as insurance or financing links, and visitor analytics is switched on, it may count clicks on them: the kind of partner, where on the page the link was, and the daily visitor code. Haki Auto does not currently operate active partner referral integrations, and this policy will be updated before it does.

Your browser's privacy signals. Haki Auto honors Global Privacy Control and Do Not Track for visitor analytics: if your browser sends either signal, your page views and any partner-link clicks are counted without a visitor or session code, and no returning-visitor identifier is created or sent. If one was stored in your browser earlier, the analytics script removes it the next time it runs there, and the server ignores an identifier that arrives together with either signal. The script also removes a stored identifier if the returning-visitor identifier is later switched off. These signals affect visitor analytics and the returning-visitor identifier only. These signals do not turn off security monitoring. When security monitoring is switched on, it may still record a limited security event, including the pseudonymous source code described below, if a request triggers one of its rules. These signals also do not change what hosting, content-delivery, network or security providers process to deliver and protect the site.

Security monitoring. To detect automated data collection, excessive requests, repeated failed administrator sign-ins and requests for sensitive or configuration files, Haki Auto keeps short-lived counters and records limited security events: the time, the type and severity of the finding, the kind of page or service requested, the reason it was flagged, a few supporting counts, the action taken, and a pseudonymous source code made in the same way from the network address alone and replaced every seven days. Haki Auto's security monitoring does not store the address itself. High activity, or viewing a page's source code, is not treated as wrongdoing on its own. Security monitoring starts in observation mode: it records and flags findings but does not refuse any request, and Haki Auto will update this policy before it turns on request refusals or sign-in throttling as part of security monitoring. If rate limits or sign-in throttling are later enabled, a request may be temporarily refused with a message asking you to try again later.

What Haki Auto's analytics and monitoring records do not store. In the analytics, service-health and security-monitoring records described in this section, Haki Auto does not store VINs, asking prices, mileage, location, form contents, request bodies, query strings, network (IP) addresses, User-Agent text, names or email addresses, or the returning-visitor identifier itself (only a keyed hash of it). This describes those records only: VINs and other information you submit for vehicle research are handled as described in the sections above, and hosting, content-delivery, network and security providers may process network addresses and browser information as described under “Operational monitoring”.

Operational monitoring

Haki Auto records limited research and Compare lifecycle information and sanitized browser-error categories to understand availability and reliability. Application monitoring for Compare and browser errors excludes VIN, price, mileage, location, vehicle identity, shopper/session identifiers, IP and User-Agent fields, raw error text, request bodies, URLs and stack traces. The separate website analytics and security monitoring described in the section above handle network and browser signals differently, as explained there.

Hosting, content-delivery and network-security providers that deliver and protect the site necessarily handle ordinary technical request information, such as visitors' network (IP) addresses, browser and device details, requested addresses and timestamps, and may keep their own logs and traffic or security statistics. Database and uptime-monitoring providers process the technical information needed for their own services. All of this happens in the providers' systems, separately from Haki Auto's own analytics and monitoring, and is governed by each provider's own privacy and data-retention policies. Haki Auto does not control how long those providers keep this information, and this policy does not state their retention periods.

Vehicle-data and service providers

Current research may involve:

• NHTSA and its vPIC service for VIN decoding, recalls, owner complaints and manufacturer communications.
• Vehicles.dev for vehicle specifications and market-value research.
• fueleconomy.gov and EPA data for efficiency and compatible vehicle configurations.
• MarketCheck for current dealer-listed vehicle inventory, used only by the Better Deals private beta described below.
• OpenAI, for the AI-assisted answers in Ask Haki described below.
• Hosting, PostgreSQL database, content-delivery and network-security, and externally configured uptime-monitoring infrastructure.

Haki Auto sends only the information needed for the requested lookup. For example, VIN is used for VIN-based specification research, while market-value research may use year, make, model, mileage, state and available trim or configuration information. Provider availability, coverage and data practices are outside Haki Auto's control.

Ask Haki (AI-assisted answers)

Ask Haki is an optional assistant that answers questions about a vehicle you have researched. When it is available, it uses an artificial-intelligence model provided by OpenAI to write each answer. Answers are generated by an AI model, may be incomplete or wrong, are checked against Haki Auto's own research findings before they are shown, and are not professional advice.

What is sent. When you submit a question, Haki Auto sends OpenAI the text of your question together with a limited set of Haki Auto's own research findings for the vehicle, chosen to match the question. Depending on the question, these can include the vehicle's year, make, model, trim and drivetrain; the asking price and mileage you entered and Haki Auto's market-value comparison; recall, owner-complaint and service-bulletin summaries; and fuel-economy and ownership-cost estimates. Haki Auto does not send OpenAI the VIN you researched, your state or ZIP code, your network (IP) address, your browser details, or any cookie or session identifier.

Your question is sent as you write it. Haki Auto does not remove personal information from a question. Please do not include names, contact details, VINs or other personal or sensitive information in a question: anything you type in a question is sent to OpenAI.

What Haki Auto keeps. Haki Auto does not store your question or Ask Haki's answer in its database and does not write them to its logs. To answer follow-up questions without repeating every lookup, Haki Auto keeps the research findings for the vehicle temporarily in the server's memory, which can include the VIN you researched, for up to 15 minutes of inactivity and no more than 60 minutes. Looking up a vehicle for Ask Haki uses the same vehicle-data providers described above and may add the vehicle's specifications to the vehicle specification cache, as ordinary research does.

OpenAI. OpenAI processes what Haki Auto sends it as a service provider, under its own terms and its own privacy and data-retention policies. Haki Auto asks OpenAI not to keep a retrievable copy of each response (it sets the API's “store” option to false) and sends no name, account or user identifier with the request. That request does not control everything OpenAI may retain, for example for abuse monitoring or where the law requires it, and Haki Auto does not control OpenAI's retention periods and this policy does not state them.

Haki Auto limits how often questions can be asked; see “Rate limiting and cost protection” under Security.

Better Deals private beta

“Same Car, Better Deals Nearby” is a limited, invitation-controlled private beta currently available only for supported Utah ZIP codes. It runs only when an authorized shopper deliberately selects “Find Better Deals” — it never runs automatically.

When you run a Better Deals search, Haki Auto processes:

• The researched vehicle's year, make, model, trim and available configuration details (such as powertrain, drivetrain, engine or cab).
• The asking price and mileage used for the comparison.
• The ZIP code, search radius and vehicle condition you enter for the search.

The information needed for the listing search is sent server-side to MarketCheck to retrieve current dealer-listed inventory for comparison.

MarketCheck listing information and Haki Auto's derived comparisons are request-scoped. No MarketCheck listing records are stored in PostgreSQL, no listing archive, price history or cross-request listing cache is created, listing results are not placed in localStorage, sessionStorage or IndexedDB, and listing content, invitation codes and session-cookie values are not written to application logs or analytics.

A dealer listing link may take you to a third-party dealer website governed by that dealer's own privacy practices, which Haki Auto does not control.

Beta access cookie

Successfully redeeming a Better Deals invitation code creates an opaque, short-lived, first-party session cookie used only to authorize the Utah private beta. The cookie is HttpOnly, marked Secure in production, uses SameSite=Strict, and is limited to the API path that serves the beta.

The cookie contains only token-management values — a version marker, a key identifier and an expiration time. It does not contain the invitation code, your name, email address, VIN, ZIP code or IP address.

Entering an invitation code does not create an account or verify your personal identity. A valid session only shows that some browser redeemed a still-valid invitation code.

Shared results

Share Result lets you create a link to a saved copy of one vehicle research result so someone else can read it. It is available only when Haki Auto turns it on.

What is saved. When you create a link, Haki Auto saves a snapshot of the result as it was at that moment: the vehicle (year, make, model and trim), the verdict and Deal Quality, the recall, owner-complaint and service-bulletin findings, fuel-economy information, and the asking price, mileage, state and confirmed trim you entered. The snapshot does not change, and Haki Auto does not refresh it from data providers when someone opens it, so it can go out of date.

The VIN. The full VIN is saved only if you choose to show it. Otherwise only a masked VIN, with all but the last six characters hidden, is saved and shown.

What is not saved or shown. A shared result does not include your name or other identity, ZIP code, financing, insurance or warranty details, or any Ask Haki question or answer, and the page does not show who created it. It does not include MarketCheck listing information or the Vehicles.dev market-value estimate.

Who can open it. The link is unlisted: Haki Auto does not publish a list of shared results. Anyone who has the link can open the shared result until it expires or you stop sharing it, and a person you give it to can pass it on.

How long it lasts. You choose 7, 30 or 90 days (30 by default). You can stop sharing earlier from the browser you used to create the link, and a stopped link stops working immediately. Haki Auto then keeps the saved snapshot and link record for 90 more days after the link expires or is stopped, whichever comes first, and then deletes them. A link that is still active is never deleted.

Your browser. So that you can stop a link later, your browser keeps a short list in localStorage under the name haki.share-result.manage.v1. Each entry holds only the link's public identifier, a private management code, when the link expires and a short vehicle label. It does not hold the VIN, asking price, mileage, research inputs, the snapshot or provider data. The management code is never part of the link, is not shown to the person you share with, is not sent to analytics, and is sent only in the request to stop sharing. Entries are removed when you stop a link, and expired entries are cleaned up. If you clear your browser's site data you can no longer stop those links yourself, but they still expire on their own date.

Cookies and browser technologies

Haki Auto's own application uses one essential first-party cookie — the beta access cookie described above — solely to authorize the Utah Better Deals private beta. Hosting, content-delivery, network and security providers may set their own technical cookies, for example if a security check is shown; those are not set by Haki Auto's application. The beta access cookie is not used for advertising, cross-site tracking, browser fingerprinting or third-party analytics SDKs. Haki Auto also uses sessionStorage for the first-party random research analytics identifier described above. Share Result also uses localStorage, only to let you stop a link you created, as described under “Shared results”.

Website analytics and monitoring set no cookies. When switched on, they use two kinds of browser storage, and only while visitor analytics is switched on. First, small settings kept in sessionStorage for the current tab session (whether the returning-visitor option is on, and whether the identifier has already been reported in this session); these are not visitor identifiers and are not used to recognize you on a later visit. Second, once the returning-visitor identifier is switched on, one random identifier kept in localStorage that is used to recognize your browser on later visits, as described under “Website analytics and security monitoring”. It is not created when your browser sends Global Privacy Control or Do Not Track, and you can remove it at any time by clearing the site data that your browser keeps for Haki Auto. The current service does not create a persistent cross-site advertising profile.

Retention

• Vehicle specification cache: retained until manually removed, corrected or superseded.
• VIN search history: retained for 90 days.
• Research attempts without feedback: retained for 90 days.
• Research attempts with feedback and their feedback: retained for one year.
• Compare attempts and sanitized browser-error events: retained for 30 days.
• Ask Haki questions and answers: not stored by Haki Auto. The research findings kept for follow-up questions stay in server memory for up to 15 minutes of inactivity (60 minutes at most).
• Shared results (the saved snapshot and link record): the link lasts 7, 30 or 90 days (30 by default); the snapshot and link record are deleted 90 days after the link expires or is stopped, whichever comes first. Active links are not deleted.
• Website analytics records (page views and partner-link clicks), aggregate service health counts, failure events and daily automated-traffic totals, once those parts are switched on: retained for about 35 days.
• Security events, once security monitoring is switched on: retained for about 90 days.
• Returning-visitor records (a keyed hash of the browser identifier, with the first and last time it was seen and the number of days it was seen), once the returning-visitor identifier is switched on: retained for about 13 months after the browser was last seen.
• Daily statistics that contain no visitor codes: retained for up to about 13 months.

Cleanup runs in bounded batches and may take more than one cycle to remove all expired records. These beta retention periods may be adjusted as the service, operational needs and applicable requirements evolve. Vehicle cache rows are not automatically removed solely because of age.

Security

Haki Auto uses reasonable application safeguards, including restricted Admin access, limited monitoring fields and server-held provider credentials. No system or transmission method can be guaranteed perfectly secure.

Rate limiting and cost protection. To prevent abuse and to protect the cost of paid data services, some features limit how often one connection can make requests: Better Deals searches and invitation-code redemption, Ask Haki, creating, opening and stopping shared results, and some vehicle-research lookups such as market-value research. For this, the server computes a temporary, pseudonymous code from the connecting network address and a secret salt that is generated anew each time the server starts. The code is kept only in the server's memory for short counting windows of about a minute, is cleared periodically and whenever the server restarts, is not written to the database, application logs or analytics, and is not used to identify you or to build a profile. These features do not store the network address itself. This rate limiting is built into those features and is separate from the optional security monitoring described under “Website analytics and security monitoring”. Hosting, content-delivery, network and security providers handle network addresses as described under “Operational monitoring”.

Privacy questions and data requests

You may request access, correction or deletion where applicable. For a VIN-related request, providing the relevant VIN allows the operator to locate vehicle-cache and search-history records. For a request about a shared result, include its link. Do not include unrelated personal or sensitive information.

Haki Auto does not maintain shopper accounts or collect names or email addresses with its analytics. As a result, it may not be reasonably possible to locate a particular session or feedback record unless sufficient non-sensitive context is available. Haki Auto will not collect additional identity information merely to locate such records. Records that carry only a pseudonymous code (see “Website analytics and security monitoring”) are keyed to a code that is replaced every day or every seven days, so it may not be possible to tell which of them, if any, relate to a particular person.

A returning-visitor record is keyed to a hash of an identifier that exists only in your browser, so Haki Auto cannot tell which record, if any, is yours. Clearing the site data that your browser keeps for Haki Auto removes the identifier, after which the stored record can no longer be matched to your browser; the record itself is removed automatically after the retention period above.

Children

Haki Auto is a vehicle-research service and does not intentionally collect information from children. No minimum age is stated in this draft pending qualified legal review.

Sale and cross-context advertising

Haki Auto currently does not sell shopper information or use it for cross-context behavioral advertising. It does not currently operate active insurance, financing or vehicle-history referral integrations. This policy will be updated if those practices change.

Policy changes and legal review

This policy may change as Haki Auto evolves. Material updates will be posted with a revised date. Final wording, VIN treatment, retention periods, session-storage analytics, shared results, website analytics and security monitoring, AI-assisted answers, provider disclosures, children-related language, jurisdiction-specific requirements and future referral practices remain subject to qualified legal review. This draft is not legal advice.