Privacy Policy

Last updated: 10 October 2026

1. What this covers

This Privacy Policy explains what data Validitool collects when you use our website, the free checkers on it, your dashboard, or our developer API, and how that data is handled.

Validitool is a registered enterprise in India, founded and led by Biswadip Barman, who is responsible for your personal data as its controller under data protection law. You can reach us about anything in this policy at privacy@validitool.com.

2. Data we collect

• Account data: your email address and authentication details if you create an account, and the email addresses of any teammates you invite. If you sign in with Google, Microsoft or GitHub, that service confirms your email address to us and also shares your name and profile picture, which we don't use; we never receive your password for that service.
• Data you submit for checks: depending on the check, VAT numbers (and, where you provide them, your own country and VAT number for VIES consultation numbers), EORI numbers, company names, email addresses and domains, IBANs, and the countries and VAT numbers used in reverse-charge checks.
• Check results and audit log: for each check, what was checked, the result, the time and the outcome, including details such as registered names and addresses returned by the registries, potential sanctions-list matches and email domain signals. This record is what your certificates and usage history are built from.
• Monitoring and integrations: VAT numbers you add to your watchlist and the company names you give them, their latest sanctions screening results and the alerts sent about them, and webhook URLs you configure (with the signing secrets we generate for them).
• How you found us: when you create an account, the campaign tag on the link you first arrived from (if any), the website that referred you and the first page you visited. Your browser remembers these until then; we use them only to see which channels bring customers.
• Payment data: we do not process or store your card details ourselves. Payment information is collected and processed directly by Paddle.com Market Ltd, our payment provider and Merchant of Record. See Paddle's Privacy Policy for how they handle that data.
• Technical data: standard request metadata (such as IP address and user agent) processed by our hosting provider for security and reliability. With each check we record the country your connection comes from (as determined by Cloudflare), not your IP address. To limit how often the free website checkers can be used, we store a keyed one-way hash of your IP address (never the address itself) together with a per-minute counter and, when you are not signed in, a count of today's checks; these entries are deleted within two days.
• Website usage: we count visits to our website. For each page view we add one to a daily count for that page and your country, and we may use Cloudflare Web Analytics for the referring site, browser and device type. Neither uses cookies, stores your IP address, tracks you across sites or builds a profile of you.

Checks you make with the free tools on our website while signed in are saved to your account, like API checks, so they appear in your history and can have a certificate. Checks made without signing in are logged the same way, but are not linked to an account or to your IP address.

3. Data you submit about other people

Much of what you check is about your customers and suppliers, and some of it (such as a contact's email address, a sole trader's name or an individual's IBAN) can be personal data. When you submit it, you decide what is checked and why; we process it on your behalf to perform the check and keep the record of it. You are responsible for having a lawful basis to do so. If your organisation needs a data processing agreement, contact us.

4. How we use this data

We use the data above to:

• perform the checks you request, including caching registry results;
• produce certificates, usage history, monitoring alerts and webhook deliveries;
• authenticate API requests and enforce plan limits and rate limits;
• investigate abuse, fraud, or violations of our Terms of Service;
• respond to support requests;
• meet our own legal and tax obligations.

We do not sell your personal data, and we do not use it for advertising.

Our lawful bases for this processing, under the UK GDPR and the GDPR (Article 6(1)):

• Contract: your account, the checks you request, certificates, history, monitoring, alerts, webhooks, billing and support are needed to provide the Service you signed up for.
• Legitimate interests: keeping the Service secure (including monitoring for breaches and abuse), preventing fraud, enforcing our Terms, counting website visits without cookies, and recording which page led you to sign up. We have weighed these against your interests; you can object at any time (Section 8).
• Legal obligation: keeping billing records and responding to lawful requests from authorities.

For data you submit about other people (Section 3), you are the controller and choose the lawful basis; we process it on your instructions.

5. Who receives data

Service providers we use, each acting under their own privacy terms:

• Supabase: database hosting and authentication.
• Cloudflare: application hosting, edge infrastructure and cookie-free website analytics.
• Paddle.com Market Ltd: payment processing and billing, as Merchant of Record.
• Resend: sending our emails (monitoring alerts, and sign-in and password-reset emails), so it receives your email address and the message.
• Zoho Mail: our mailboxes, so it stores the emails you send to our support, privacy and billing addresses.

Public services that receive only what is needed to answer a check:

• European Commission VIES receives the VAT numbers you check (and your own VAT number if you request a consultation number).
• European Commission EORI service receives the EORI numbers you check.
• HMRC (UK tax authority) receives the UK (GB) EORI numbers you check.
• National company registers receive the numbers you look up there: the Swiss UID register (Federal Statistical Office), the Norwegian Register of Legal Entities (Brønnøysund) and UK Companies House.
• GLEIF, the global LEI register, receives the LEIs you look up.
• The Peppol network receives the Peppol identifier derived from a VAT number (through Cloudflare's public DNS resolver, the company's Peppol service provider and the Peppol Directory).
• DNS and domain registries (Cloudflare's public DNS resolver, and the RDAP service of the registry responsible for the domain) receive only the domain part of an email address, never the full address.

Sanctions screening and IBAN checks are performed entirely on our own systems: company names and IBANs are not sent to any third party. The sanctions lists are downloaded from their official publishers (the European Commission, the UN, the UK government and the US Treasury) and compared locally.

6. Data retention

Cached VAT and EORI registry results are used for 24 hours, then kept for up to 30 days only so they can answer during registry outages on plans that use that option, and deleted after that. Rate-limit counters are deleted within two days. Lists you upload for a bulk check, and their results, are deleted after 90 days, or earlier if you delete them from your dashboard. Records of sanctions alerts are kept for a year, and security monitoring records for two years. Emails you send us are kept for up to three years after the conversation ends. Audit log entries (your check history) are kept while your account exists.

You can delete your account at any time from your dashboard. This immediately and permanently deletes your login, API keys, check history, monitoring and webhook settings, bulk uploads and team membership. If you own a team account, its shared data is deleted and your team members lose access; if you are a member of someone else's team, only your own login and membership are deleted. Any subscription is cancelled. Paddle keeps its own records of your payments as the seller of record, and deleted data can remain in our database provider's backups for a short period until they expire.

7. Cookies

We use essential cookies to keep you signed in to your dashboard (via Supabase Authentication). We do not use analytics, advertising or tracking cookies (our website analytics are cookie-free, see Section 2). When you are signed in, the pricing page loads Paddle's checkout script, which may set its own cookies, covered by Paddle's privacy policy.

8. Your rights

If you are located in the EU/EEA or UK, you have rights under the GDPR/UK GDPR, including the right to access, correct, delete, or export your personal data, to object to certain processing, and to complain to your data protection authority. You can download a copy of your data (Download my data) and delete your account (see Section 6) yourself from your dashboard, and change your login email and password there. To exercise any of these rights, contact us at privacy@validitool.com. We will respond within one month.

9. International transfers

Validitool is operated from India. Using the Service may involve transferring your data to, and processing it in, countries outside your own, including where our infrastructure providers operate (including the EU, US, and elsewhere). We rely on our providers' own safeguards (such as standard contractual clauses, where applicable) for these transfers.

Our database (Supabase) is hosted in Frankfurt, Germany. The website and API run on Cloudflare's network, which handles each request at a data centre near the person making it. Alert emails are sent through Resend, whose mail servers are in the United States, and emails you send us are stored by Zoho Mail in the United States.

10. Security

API keys are stored as one-way cryptographic hashes; the plaintext key is shown to you only once, at creation. Webhook deliveries are signed so you can verify they came from us. Account data is protected with row-level database security, so users can only see their own data, and registry caches and audit logs are only accessible to our servers. All data is encrypted in transit (HTTPS) and at rest by our database provider.

If a security incident affects your personal data, we will notify the relevant data protection authority within 72 hours of becoming aware of it where the law requires, and tell affected users without undue delay. To report a security issue, email support@validitool.com.

11. Children

The Service is intended for business use and is not directed at children under 16.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

13. Contact

Questions about this Policy or your data can be sent to privacy@validitool.com.