Privacy Policy

Last updated: September 27, 2026

AUTO411 provides vehicle identity and specification lookup through 411specs.com, the Chrome extension, embedded website integrations, APIs, Model Context Protocol (MCP), ChatGPT and other AI-agent integrations, and supported machine-payment endpoints. This policy describes the information AUTO411 processes and how it is used.

Information we process

• Vehicle queries. Inputs such as a VIN, year, make, model, configuration identifier, trim, engine, or drivetrain that are needed to resolve a vehicle and return requested facts.
• Account and authentication information. Email address, AUTO411 account identifier, plan or entitlement status, API-key association, Auth0 user identifier, OAuth scopes, and token-validation results needed to authenticate and authorize access.
• Subscription and billing linkage. Stripe customer and subscription identifiers, plan, payment status, and entitlement dates. AUTO411 does not store full payment-card numbers.
• API and MCP usage records. Account identifier, plan, tool or endpoint, request identifier, timestamp, success state, resolution or error outcome, latency, and entitlement outcome used for metering, reliability, support, and abuse prevention.
• Technical request metadata. Information normally processed by hosting and security infrastructure, such as IP address, user agent, request headers, Cloudflare request identifiers, timestamps, and security signals.
• Support communications. Messages and information you choose to provide when requesting help.

MCP, ChatGPT, and AI-agent integrations

When you connect AUTO411 to ChatGPT or another AI agent, that provider sends the vehicle details and tool arguments needed for the requested lookup. AUTO411 returns the applicable structured result to that provider. AUTO411 does not receive your entire conversation unless information from it is included in a tool request.

OAuth access is provided through Auth0. AUTO411 validates signed bearer tokens, issuer, audience, expiry, and required scopes and links the authenticated subject to an AUTO411 account. Access tokens and API-key secrets are not included in normal usage logs. The AI provider and Auth0 process information under their own privacy practices.

Chrome extension

The AUTO411 GOLD Chrome extension runs in the browser side panel. It processes the VIN or vehicle details you enter to display AUTO411 results. It does not read your browsing history, track you across unrelated websites, or sell lookup inputs to advertisers or data brokers.

Machine payments

When an x402-enabled resource is used, AUTO411 processes the offered resource, price, anonymous request or offer identifier, payment stage, response status, resolution status, and latency. Coinbase CDP or another configured x402 facilitator may verify and settle the payment. Base network wallet addresses, token transfers, and transaction hashes are public blockchain data. AUTO411 never requires or stores a wallet seed phrase or private key.

The current x402 application telemetry is designed not to record request bodies, VINs, API credentials, private keys, or full payment signatures.

How we use information

• Provide vehicle resolution and return policy-cleared vehicle information.
• Authenticate users and clients, link accounts, enforce entitlements, and support credential revocation.
• Operate subscriptions, payment access, free allowances, usage metering, and rate limits.
• Diagnose failures, monitor latency and availability, respond to support requests, and improve reliability.
• Prevent fraud, credential abuse, unauthorized bulk extraction, and other misuse.
• Comply with applicable legal obligations and source-licensing restrictions.

Service providers and data sources

AUTO411 uses service providers only where needed to operate the product:

• Cloudflare for website and Worker hosting, networking, security controls, storage, and operational logs.
• Auth0 for OAuth authentication and account identity.
• Stripe for checkout, subscriptions, and billing events.
• OpenAI when you choose to connect AUTO411 through ChatGPT or Codex.
• Coinbase CDP, x402 facilitators, and Base for supported machine-payment verification and settlement.
• Official public agencies and licensed vehicle-data providers that supply or validate vehicle information. Vehicle identifiers may be sent to an official source service when needed to resolve a request.
• Google Fonts for website typography, which may cause browser request metadata to be processed by Google.

These providers process information under their own terms and privacy policies. AUTO411 does not provide lookup inputs to advertisers or data brokers.

Cookies and local storage

AUTO411 and its authentication, hosting, and payment providers may use cookies or local storage that are necessary for sign-in, checkout, security, and session continuity. AUTO411 does not use vehicle lookup inputs for third-party advertising.

Retention

Vehicle inputs and technical records are retained only as needed to provide the service, investigate errors, prevent misuse, and meet applicable obligations. The current MCP metering events and counters written to AUTO411’s Cloudflare KV configuration expire after approximately 95 days. Cloudflare observability and security logs follow the retention configured for the AUTO411 Cloudflare account.

Account, credential, entitlement, subscription, webhook, and support records are retained while needed to provide access, maintain security and revocation, support billing, resolve disputes, and satisfy applicable recordkeeping requirements. Public blockchain transactions cannot be deleted by AUTO411.

Security

AUTO411 uses access controls, secret bindings, signed-token validation, credential hashing or encryption where implemented, rate limits, and restricted logging to protect the service. No system can guarantee absolute security. Contact AUTO411 promptly if you believe an account or credential has been compromised.

What we do not do

• We do not sell personal information.
• We do not share vehicle lookup inputs with advertisers.
• We do not store full payment-card numbers.
• We do not intentionally log bearer tokens, API-key secrets, wallet private keys, or seed phrases.
• We do not collect precise geolocation through the AUTO411 website or Chrome extension.

Your choices

You may stop using AUTO411, revoke an OAuth connection through the relevant provider, request credential revocation, or request subscription help through AUTO411 Support. Depending on applicable law, you may also have rights to request access, correction, or deletion of personal information, subject to security, billing, legal, and public-blockchain limitations.

Changes to this policy

AUTO411 may update this policy as its services or data practices change. The current effective date appears at the top of this page.

Contact

Questions or privacy requests may be sent to simon@411specs.com.