Privacy

This page describes what actually happens, not what is legally minimal to disclose. If something here is wrong, it is a bug.

What is never stored

• The invoice you drop into the invoice checker. That file is opened and read inside your browser and is never uploaded — not to this server, not anywhere. Only the identifiers you confirm on screen are submitted, exactly as if you had typed them in.

• The email you paste into the supplier email check. Read in your browser and never uploaded. Two lookups do leave your machine — the sending domain’s published key and its registration date — and both carry only a domain name. Only the verdict is saved, and only if you create a shareable link.

• Your IBAN in full, for an ordinary check. The checksum is computed in memory and discarded. If you create a shareable link, only the country code, check digits and last four characters are kept — for example DE89••••••••••••••3000.

  The one exception is a watch you ask for. Watching a Polish supplier for white-list delisting means re-asking the Ministry of Finance whether that exact account is listed, which cannot be done without the number. So for those watches — and only those — the account is stored, used for nothing else, and deleted the moment you stop watching or delete your account.

• Your IP address. Not in a database, and not in a log file. The web server does keep an access log — which page was requested, what status came back, and the browser or crawler that asked — because a search engine failing to fetch the site is otherwise invisible. It is configured to discard the client address before writing the line, so the log cannot say who made a request.

• Any account. There is no signup, so there is nothing to associate a check with a person.

• Advertising, tracking or analytics cookies. None, ever. The only cookie this site can set is the Supplier Watch sign-in cookie described below, and it is set only if you sign in.

If you use Supplier Watch

An account exists only to remember what you asked to be told about. It stores:

• Your email address, so alerts have somewhere to go. There is no password, because there is nothing to sign in to beyond the list itself.
• The identifiers you watch — a VAT number, a domain, a company name, and for a Polish white-list watch the bank account, as described above.
• The last result for each, so a re-check can tell what changed. Alerts are sent on change, never on state, which is what that stored copy is for.

The one cookie on this site

Signing in sets a single cookie. It holds a random session identifier and nothing else — no email address, no name, nothing about what you watch, and nothing that can be read out of it. It is HttpOnly (unreadable to JavaScript), SameSite=Lax, sent only over HTTPS, and it expires after 30 days. Signing out or deleting your account removes it immediately.

There is no cookie banner, and that is deliberate rather than an omission. Consent is required for cookies that are not strictly necessary — advertising, tracking, analytics, anything measuring behaviour. A cookie whose only job is to keep you signed in to a service you explicitly asked for is exempt under the same rules, and this is the only cookie the site is capable of setting. Nothing is stored on your device unless you sign in. Analytics here are cookieless, as described below.

Sign-in links are single-use and expire in fifteen minutes, and only a hash of each is kept — the link itself is never stored. Deleting your account deletes all of it immediately: the address, every watch, every stored result and every alert, in one operation, from the page itself. Nothing is retained afterwards and nothing needs to be requested from us.

What is stored, and for how long

Only if a check produces a shareable link. That link holds the result as displayed: the VAT number and registry response, the masked IBAN, the sanctions outcome, the company register result and the domain records. It is deleted automatically after 90 days.

Result links are unlisted, not secret. Anyone with the link can read it — that is the point of being able to forward it to whoever approves the payment. They are excluded from search engines and from the sitemap, but treat the link itself as the access control.

If you ask to be notified

Result pages offer to email you when something changes that affects these checks. That is the only thing on this site that asks for anything about you, and it is optional — everything works without it.

If you fill it in, what is stored is your email address, the date, and which kind of page the form was on. That is the whole record. No name, no company, and no link to the check you ran — not the vendor, not the VAT number, not the result link. The two are never written down together, so the list cannot be used to work out who was looking into which supplier.

Your IP address is not stored with it either. Some services keep one as proof of consent; that would contradict the line above about IP addresses, so this does not.

The address is used to send that notification and nothing else. It is not sold, shared, or used to build a profile, and there is no tracking pixel in anything sent. To be removed, email privacy@vetthisvendor.com — outbound mail will also carry a one-click unsubscribe link.

Rate limiting

Checks are limited to 20 per hour per IP address, to stop the tool being used to hammer the registries it depends on. Enforcing that requires counting requests per address, so a counter keyed by your IP exists in memory for up to an hour and then expires. It is never written to disk and is not associated with what you checked.

Who else sees your input

Running a check necessarily contacts third parties:

• VAT number → the EU VIES service. It sees the number and this server’s IP address, not yours. GB numbers are not sent anywhere — the format and the check digit are verified locally, which is arithmetic and needs no network.

• VAT number, some countries → the national tax authority or business register, for the ten countries where one publishes usable data. Two shapes, and the difference matters:

  • Nothing about your check leaves this server for Slovenia, Estonia and Latvia. Their registers are published as bulk files, downloaded here on a schedule and searched locally, so the lookup never contacts them.
  • A live lookup is made to Poland, Romania, Czechia, Finland, France, Greece and Bulgaria. Each sees the number and this server’s IP address, not yours.

• IBAN → nobody, in almost every case. The checksum is arithmetic and is computed here and sent nowhere.

  Poland is the exception, and it is the one case where an account number leaves this server. The Polish Ministry of Finance publishes whether a given account belongs to a given taxpayer, and the only way to ask is to send it the pair: the NIP and the account number, in the national NRB form. That request carries this server’s IP address, not yours. It is made only when you have supplied both a Polish VAT number and an account, because that is the only case in which there is a question to ask.

  This is a change from how the check used to work, and the reason is worth stating: the earlier version fetched the supplier’s whole declared account list and compared locally, which sent less — but it spent one of only 100 daily requests per server to do it, so roughly fifty checks a day exhausted the allowance for every visitor. The direct question is metered fifty times more generously.

  Nothing about the account is written down. The answer is cached for the rest of the day under a key derived from the pair, in memory rather than in the results table, and the full account number is never stored in a saved result — see the masking rule above.

  When the Ministry’s daily published register is mirrored on this server, an account can sometimes be checked without contacting them at all. That file contains one-way hashes rather than account numbers, so the check is arithmetic done here. Where it answers, the result says so, because it carries no Ministry reference number and speaks about the day the file was published rather than about this moment.

• Company name → the UK company register operated by Companies House, for a UK supplier, or the French register recherche-entreprises for a French one. Whichever is used sees the name and this server’s IP address, not yours. For a supplier from any other country the name is sent to neither, because neither register covers them. Sanctions screening is separate and sends the name nowhere: it runs against a copy of the EU list held on this server.

• Domain → DNS lookups, resolved from this server. The domain’s own nameservers see the query.

• Domain → an RDAP registry lookup for the registration age, where one is available.

Analytics

Page views are counted with a self-hosted, cookieless analytics install running on the same machine. It records the path visited, the referring site and a coarse device type. It does not store IP addresses, and visitors are identified by a rotating server-side hash rather than anything persistent. Query strings are stripped before a view is recorded, because they can contain a VAT number or a domain.

A few events are also recorded so it is possible to tell whether the tool actually works for people: that a check was started, that it finished, that it failed, that a guide was read, that a shared result was opened. These carry only shapes — which fields were filled in, and which statuses came back (for example “valid”, “service unavailable”, “no match”).

They never carry anything you typed. No VAT number, no IBAN — not even the masked form — no domain, no company name. Result links are recorded as /result with the identifier removed, so the analytics data cannot be used to open anyone’s saved check.

Where this runs

On a single server in Helsinki, Finland, inside the EU. Nothing is on a third-party cloud platform, and the database is on the same machine as the application.

Removing a result

Results expire on their own after 90 days. If you need one gone sooner, send the link to privacy@vetthisvendor.com and it will be deleted. The link is all that is needed — there is no account to identify, and nothing is stored that could be used to find your result without it.