Last updated: November 1, 2026
This Privacy Policy (hereinafter referred to as the “Policy”) defines the procedure for collecting, using, storing, protecting, and disclosing personal information of users of the FitmentApi service (hereinafter referred to as the “Service”, “we”, “us”, or “our”), available on the website fitment-api.com.
We respect your privacy and comply with the applicable laws of Ukraine, in particular the Law of Ukraine “On Personal Data Protection”, as well as the EU General Data Protection Regulation (GDPR — General Data Protection Regulation 2016/679).
1. General Provisions
1.1. By using our website, registering an account, ordering access to automotive databases, or generating API keys to access the REST API, you confirm that you have read this Policy, agree to its terms, and provide voluntary consent to the processing of your personal data.
1.2. If you do not agree with the terms of this Policy, please stop using the website and our API.
1.3. The Service is intended for adult users (aged 18 and older). We do not knowingly collect or process data from minors.
2. What Personal Data We Collect
We collect and process data necessary to provide our services, which are divided into the following categories:
- Account Data: email address, first and last name, username, contact phone number, company name (for corporate clients).
- Authorization Data via Google (Google OAuth): if you register or log in via a Google account, we receive your public Google Identifier (UID), name, and verified email address. We do not receive or store your Google account password.
- Payment and Billing Details: country, city, street, postal code, tax identification number (TIN, USREOU, or VAT ID for legal entities).
Important: we do not store bank card numbers, expiration dates, or CVV/CVC codes on our servers. All financial transactions are processed by the licensed payment provider WayForPay in accordance with the highest data security standards of the payment card industry (PCI DSS Level 1). - Technical Information and API Usage Logs: personal API keys (API tokens), client IP address, endpoints to which requests are made, date and time of requests, volume of transferred data, server response codes, and client User-Agent.
- Navigation Data and Cookies: cookies, browser type and version, operating system, language settings, referrer (the page from which you arrived).
3. Purposes and Legal Bases for Data Processing
We use your data solely for the following purposes:
- Provision of Services: registration and administration of the account, generation and validation of API keys, providing access to documentation and downloading databases;
- Processing of Orders and Payments: connecting paid tariff plans, activating subscriptions, issuing invoices and certificates;
- Technical Support and Communication: sending system notifications (registration confirmation, password reset, subscription expiration), responding to your requests;
- Security and Monitoring: fraud prevention, protection against DDoS attacks, control of request limits (rate limiting), maintaining system integrity;
- Compliance with Legal Obligations: keeping accounting and tax records.
4. Use of Cookies
Cookies — are small text files stored on your device when visiting the website. We use:
- Strictly Necessary (technical) Cookies: required to support your authorized session, security, and saving language selection;
- Analytical Cookies: used to analyze website traffic via Google Analytics 4 and Google Tag Manager services for the purpose of optimizing operation speed and the interface.
You can change your cookie settings or disable them completely in your web browser settings at any time, however, this may affect the proper functioning of the personal account panel.
5. Data Disclosure to Third Parties
We do not sell, rent, or transfer your personal data to third parties for commercial or advertising purposes. Transfer is possible only to trusted service providers to ensure website operation:
- WayForPay Payment System — for secure order payment processing;
- Google LLC (Google OAuth / Analytics) — for convenient authorization and anonymized statistics;
- Email Services (SMTP Providers) — solely for the delivery of service notifications to you;
- State Authorities — solely upon official request on lawful grounds in accordance with the legislation of Ukraine.
6. Data Protection and Security
To protect your personal data, we have implemented a comprehensive set of technical and organizational measures:
- Encryption of all traffic using modern cryptographic SSL/TLS (HTTPS) protocols with HSTS policy implementation;
- Password hashing using the cryptographically secure bcrypt algorithm with salt;
- Restricting employee and administrator access to confidential data;
- Regular database backups and systematic monitoring of suspicious activity.