Privacy Policy

Last updated: 18 October 2026

This policy explains what the VatPulse API and website process and why. It's short because we collect little.

What we process

Data	Why	What is stored, and for how long
VAT numbers you submit	To check them with VIES/HMRC and cache the answer	The normalized VAT number with the answer (valid/invalid, registered name and address if the authority returns them, check time, consultation number). We keep a fresh copy for 24 hours (1 hour for invalid results) and a "last known good" copy for 30 days, which is used during upstream outages.
IBANs you submit	To validate them and make repeat checks within 24 hours free	We do not store IBANs. Validation happens in memory. The only thing stored is a keyed hash (HMAC-SHA256) of the IBAN, used as a cache marker for 24 hours, with no account or bank details attached.
Usage counts	Rate limits, quotas and billing	Per API key or RapidAPI user: monthly request and billable-validation counts, plus a per-minute counter. Monthly totals are kept as billing records.
RapidAPI subscriber info	Authentication and metering	RapidAPI sends your RapidAPI username and plan tier with each request; we use the username as the metering identifier.
Email (direct keys only)	Issuing and managing a direct API key	If we issue you a direct key, we store your email with the key's plan and status. Keys themselves are stored only as SHA-256 hashes. Self-serve signup on this site is closed.
Request metadata	Running and securing the Service	Our host, Cloudflare, processes connection data such as IP address, URL and timestamps. Our Worker logs are kept for a few days. We do not log request bodies.

Who else processes data

Cloudflare hosts and runs the Service (Workers, KV, Durable Objects) as our processor.
RapidAPI runs the gateway and handles subscriptions, API keys and billing for RapidAPI customers, under its own privacy policy.
The European Commission (VIES), national tax administrations and HMRC receive the VAT numbers you ask us to check. That is how the check works.
The interactive API reference page loads its viewer from a public CDN (jsDelivr).

What we don't do

We do not sell or rent data, use it for advertising, or build profiles. The website sets no cookies and uses no analytics trackers.

Your choices

Caches expire automatically as described above. To ask about, correct or delete data linked to a direct key, or for any privacy question, contact us through the VatPulse page on RapidAPI. RapidAPI manages RapidAPI account data.