Privacy

This page describes what actually happens, not what is legally minimal to disclose. If something here is wrong, it is a bug.

What is never stored

• Your IBAN in full. The checksum is computed in memory and discarded. If you create a shareable link, only the country code, check digits and last four characters are kept — for example DE89••••••••••••••3000. The account portion is never written anywhere.
• Your IP address. Not in a database, and not in a log file. The web server does keep an access log — which page was requested, what status came back, and the browser or crawler that asked — because a search engine failing to fetch the site is otherwise invisible. It is configured to discard the client address before writing the line, so the log cannot say who made a request.
• Any account. There is no signup, so there is nothing to associate a check with a person.
• Cookies. The site sets none, which is why there is no cookie banner.

What is stored, and for how long

Only if a check produces a shareable link. That link holds the result as displayed: the VAT number and registry response, the masked IBAN, the sanctions outcome, and the domain records. It is deleted automatically after 90 days.

Result links are unlisted, not secret. Anyone with the link can read it — that is the point of being able to forward it to whoever approves the payment. They are excluded from search engines and from the sitemap, but treat the link itself as the access control.

If you ask to be notified

Result pages offer to email you when something changes that affects these checks. That is the only thing on this site that asks for anything about you, and it is optional — everything works without it.

If you fill it in, what is stored is your email address, the date, and which kind of page the form was on (a result page, or the version shown when a UK VAT number could not be checked). That is the whole record. No name, no company, andno link to the check you ran — not the vendor, not the VAT number, not the result link. The two are never written down together, so the list cannot be used to work out who was looking into which supplier.

Your IP address is not stored with it either. Some services keep one as proof of consent; that would contradict the line above about IP addresses, so this does not.

The address is used to send that notification and nothing else. It is not sold, shared, or used to build a profile, and there is no tracking pixel in anything sent. To be removed, email privacy@vetthisvendor.com — outbound mail will also carry a one-click unsubscribe link.

Rate limiting

Checks are limited to 20 per hour per IP address, to stop the tool being used to hammer the registries it depends on. Enforcing that requires counting requests per address, so a counter keyed by your IP exists in memory for up to an hour and then expires. It is never written to disk and is not associated with what you checked.

Who else sees your input

Running a check necessarily contacts third parties:

• VAT number → the EU VIES service. It sees the number and this server's IP address, not yours. GB numbers are not sent anywhere — the format and the check digit are verified locally, which is arithmetic and needs no network.
• Domain → DNS lookups, resolved from this server. The domain's own nameservers see the query.
• Domain → an RDAP registry lookup for the registration age, where one is available.
• IBAN → nobody. The checksum is arithmetic and is computed here. It is never sent anywhere.
• Company name → the UK company register, operated by Companies House. It sees the name and this server's IP address, not yours. Sanctions screening is separate and sends the name nowhere: it runs against a copy of the EU list held on this server.

Analytics

Page views are counted with a self-hosted, cookieless analytics install running on the same machine. It records the path visited, the referring site and a coarse device type. It does not store IP addresses, and visitors are identified by a rotating server-side hash rather than anything persistent. Query strings are stripped before a view is recorded, because they can contain a VAT number or a domain.

A few events are also recorded so it is possible to tell whether the tool actually works for people: that a check was started, that it finished, that it failed, that a guide was read, that a shared result was opened. These carry only shapes — which fields were filled in, and which statuses came back (for example "valid", "service unavailable", "no match").

They never carry anything you typed. No VAT number, no IBAN — not even the masked form — no domain, no company name. Result links are recorded as/result with the identifier removed, so the analytics data cannot be used to open anyone's saved check.

Where this runs

On a single server in Helsinki, Finland, inside the EU. Nothing is on a third-party cloud platform, and the database is on the same machine as the application.

Removing a result

Results expire on their own after 90 days. If you need one gone sooner, send the link toprivacy@vetthisvendor.com and it will be deleted. The link is all that is needed — there is no account to identify, and nothing is stored that could be used to find your result without it.