# Privacy

Source: https://veriport.io/legal/privacy (published 2026-10-24)

Janolab Studio LLC operates the service and is the controller of the personal data below. We collect the minimum an API with keys needs, keep it in the European Union, use no advertising trackers and no cookies on the public site, and answer requests at hello@veriport.io. Last updated 2026-10-24.

## What we process

- **Sign-up and key:** your e-mail address, the time of sign-up and confirmation, a salted hash of the network address used (abuse control), and where you came from (referrer host and landing page, no identifiers). Unconfirmed sign-ups are deleted after 7 days. Keys are stored as hashes.
- **Usage:** per key and per day, the number of calls by endpoint; kept 400 days for the dashboard and the quotas. For calls without a key: the same counts per salted address hash and day.
- **VAT numbers you validate:** sent to the European Commission’s VIES; the number and VIES’s answer (validity, name, address, date) are cached for up to 30 days to answer when VIES is down. A VAT number of a natural person (sole trader) is personal data; unless you ask for a record, the cache is the only place we keep it and it expires.
- **Validation records, only when you ask for one (`record=true`):** the number, VIES's answer (validity, name, address, date, consultation number), your requester number and the time, stored on your account for 10 years or until you delete the record through the API. You decide which numbers you keep and answer for that choice towards the people concerned.
- **IBANs you validate:** processed in memory to answer; not stored, not logged.
- **French companies you look up:** the identifier goes to the French registries (recherche-entreprises.api.gouv.fr, and the INSEE Sirene API when configured); the normalised answer, which can include officers’ names, birth years and nationalities as the public INPI register publishes them, is cached for up to 30 days (served fresh for 7) and then deleted. Sole traders are natural persons: the cache is the only place we keep their data and it expires.
- **OSS sales rows you send:** processed in memory to build the return; the rows and the file are not stored or logged. **ZIP codes:** answered from a table; not stored.
- **Purchases:** Stripe, the merchant of record, collects your payment details and billing address; we receive your e-mail, the product bought and the amount, and keep the order and the payment events for accounting.
- **Waitlist:** your e-mail and the tier you are interested in, until checkout opens and the one message is sent, or until you ask.

## Where and with whom

Functions and database run in Paris, France (EU) (Vercel, Supabase). Outgoing e-mail goes through Resend (United States) with only your address and the message. Payments go through Stripe (United States / Ireland) under its own privacy policy. VAT numbers go to the European Commission (VIES) and French SIREN/SIRET numbers to the French administration’s registries (DINUM’s Recherche d’entreprises API, INSEE) by design of the service. No data is sold or used for advertising.

## Legal bases and rights

Performance of the contract (keys, quotas, purchases), legitimate interest (abuse control, the VIES cache that keeps the service usable, aggregate statistics) and, for the waitlist, your request. You may ask for access, correction, deletion or export of your data, and object to processing based on legitimate interest, by writing to hello@veriport.io. Deleting your e-mail revokes your key. EU residents may complain to their supervisory authority.

## Cookies and tracking

None on the public site: no analytics script, no cookie, no fingerprinting. The server logs standard request metadata for a short period for security. The operator’s own admin console, on a separate host, uses one strictly necessary session cookie for its staff and keeps an audit log of their sign-ins and actions; no visitor or customer ever receives it.

## Read next

- [Terms of service](https://veriport.io/legal/terms)
- [Legal notice](https://veriport.io/legal/notice)