TOYROLLCODE

Privacy notice

What we collect

We collect account and business details, email verification and account access information, request records, payment status, VIN and tool data, uploaded photos, and support messages needed to operate the service.

Device security

We use essential sign-in and device cookies to recognize approved browsers. We record a browser and device label, approval and recent activity times, and the latest approximate country, region and city supplied by the connection network for account security and support. Location observations have their own recorded time; older country-only records may have no known location time. These are network estimates, may reflect a mobile network or VPN, and do not use precise GPS or a street address. Device changes and unusual account activity may trigger an email and an account notice. You can review and remove approved browsers in My devices. Authorized administrators can review existing account activity, device observations, purchases, token use and request history to operate and support the service. Device activity may include background requests and does not establish that you are currently online.

Successful sign-ins

For account security and service reporting, we save completed sign-ins with your account reference, authentication method, time and an opaque reference that prevents duplicates. This required login record is separate from optional analytics, survives sign-out and is retained for 30 days. It adds no password, verification code, reusable session token, IP address or device fingerprint. Earlier login history may be incomplete.

Request device and network observations

For new submitted requests, we may record a snapshot of the reported browser and device type and the approximate network country, region and city. Snapshots stop appearing in reports after 30 days; expired snapshots are deleted in batches as new requests are processed. Authorized administrators can see this snapshot with the request for support and service reliability. It does not identify a precise job address. We do not read photo GPS metadata, request precise GPS, store raw IP addresses in these snapshots, or use device fingerprinting. These snapshots honor Do Not Track and Global Privacy Control signals. Older requests do not have a reconstructed location.

How we use it

We use this information to verify email addresses, manage account access, process requests, deliver status and code notifications, prevent abuse, support customers, and keep required business records. We do not sell customer information.

Improving photo reading

We sample a limited number of uploaded photos to test and improve automatic VIN and tool-data reading. A separate, access-restricted evaluation service compares readings with the details submitted for the associated job. These copies may contain VINs and other information visible in your photo. Upload only the relevant tool screen or VIN area, without unrelated personal information.

Evaluation copies of photos and linked job data expire after seven days and are automatically deleted by scheduled cleanup. Storage deletion can take additional time if the storage provider is delayed. We also collect limited diagnostic observations about photo upload failures, missing or corrected field names, validation problems and submission outcomes. These observations use an opaque attempt reference and fixed error categories rather than passwords, payment details, customer names, field values or full error messages. They expire after seven days. Failed readings may be included in the same limited private photo sample. Browser reporting is best effort and may be incomplete. Evaluation does not change your submitted job or delivered result. We use Cloudflare storage and AI processing for this testing; access is restricted to authorized service operators. We do not sell these photos or use them for advertising. Contact support@toyrollcode.com to request deletion of an evaluation copy.

Website visitor measurements

We measure page views, estimated daily visitors, approximate country, region and city, and device type to understand use of the website. This measurement uses no analytics cookies, precise GPS, or third-party advertising tracker. Our server uses the connection IP address and browser information to create a protected identifier that changes each day. The visitor measurement records do not store the IP address, full browser information, account details, VINs, codes, photos, or page queries.

Reports cover the most recent 30 calendar days. Older measurement records are excluded from reports and removed in limited batches as website visits continue; deletion can take longer when the site is idle. These temporary records are excluded from our account backups. Location is approximate and may reflect a mobile network or VPN. When location data is unavailable, the visit can still be counted with an unknown location. Shared connections and changing devices can affect visitor estimates. This measurement skips requests that send Do Not Track or Global Privacy Control signals. Essential account, security and payment processing remain separate.

Signed-in price activity

We record limited first-party observations of signed-in sessions and visible openings of the purchase chooser. These records include the account name and email, a browser or device label, event and recording times, and the standalone prices available to that account. Coupon text, passwords, VINs, photos, payment details and activity on other websites are not part of these observations. The owner can review this activity alongside separately observed public market prices; nearby timestamps do not establish that someone copied or shared information.

These optional measurements respect Do Not Track and Global Privacy Control signals. Reports cover 30 days, and collection can be incomplete. Essential sign-in, security and payment records remain separate.

Partner referrals

If you create an account through a partner link or code, we associate that partner with your new account so qualifying future purchases can earn them a 15% commission at no extra cost to you. This association is separate from anonymous website visitor measurements. We retain the referral with the account and purchase records for commission accounting; refunds and payment adjustments affect commission calculations.

You may choose to remember a referral on this browser for up to 30 days before creating an account. This optional first-party cookie contains a signed partner reference and expiration time, not your name, email, location or payment information. You can uncheck the remember option before signup to remove it. Creating the account saves the referral to the account, so later purchases can remain associated even when you change devices or delete the cookie. Authorized administrators can review attribution and commission records. An authorized partner viewer can sign in to see that partner’s referral count, credited purchase dates, products and amounts, refunds and commission. This view excludes customer names, email addresses, VINs, delivered codes, locations and payment-provider identifiers, and gives the partner no access to customer accounts or other partners’ records.

Payments

PayPal processes PayPal, card and supported digital-wallet payments. Card numbers and security codes are entered in PayPal-hosted fields and are not stored by ToyRollCode. We receive payment status and transaction references to issue tokens, handle support and maintain accounting records. See PayPal’s privacy statement for how PayPal handles payment information.

Retention and access

Request and payment records may be retained for support, accounting, security, and legal obligations. Contact us to ask about your information or a correction.

Contact

Privacy questions: support@toyrollcode.com.

Last updated October 27, 2026.