Privacy Policy
[OPERATOR_LEGAL_NAME] and [OPERATOR_ADDRESS] on this page
must be replaced with the operating company's real details before launch.Last updated: 2026-08-06
1. Controller
[OPERATOR_LEGAL_NAME], [OPERATOR_ADDRESS] is the controller for personal data processed through vatwarden.com and the VATWarden API. Contact: support@vatwarden.com.
2. What we process, and why
| Data | Purpose | Retention |
|---|---|---|
| Account data: email address, password (stored as a scrypt hash, never in plain text), optional company name and requester VAT number | Operating your account; authentication; account email such as address confirmation and password reset | Life of the account |
| VAT numbers you submit and the registries' validation results (including registered trader names/addresses as returned by VIES/HMRC, and consultation IDs) | Providing the service: validation, monitoring, and your audit-evidence archive | 7 years from each check (the archive is the product) |
| Free-checker submissions (VAT number checked, result) | Providing the free check; abuse prevention | Stored like other validation records, not linked to any account |
| Billing data: plan, subscription status, invoices | Billing. Card details go directly to Stripe; we never see or store card numbers | As required by tax and accounting law |
| Server logs: IP address, request path, timestamp, status | Security, debugging, rate limiting | 30 days |
VAT numbers of your counterparties are business identifiers; where they relate to sole traders they can constitute personal data, which we process on your documented instructions as part of providing the Service.
3. What we do not do
No analytics scripts, no advertising trackers, no third-party cookies, no sale of data. We set two strictly necessary cookies and no others: the session cookie that keeps you logged in, and a short-lived random form-security cookie that protects the login, signup and free-checker forms against cross-site submissions.
4. Subprocessors
| Provider | Purpose |
|---|---|
| Stripe, Inc. | Payment processing and subscription billing |
| DigitalOcean, LLC | Hosting infrastructure (servers and backups) |
| Resend, Inc. | Delivery of account email (address confirmation, password reset) |
Validation queries are additionally sent to the official registries required to answer them: the European Commission (VIES) and, for UK numbers, HM Revenue & Customs.
5. Legal bases
Performance of a contract (providing the Service you signed up for), legitimate interest (security, abuse prevention, the free checker), and legal obligation (billing records).
6. Your rights
Subject to applicable law (including the GDPR where it applies), you can request access to, correction of, or deletion of your personal data, object to or restrict processing, and request portability. Email support@vatwarden.com. Note that validation evidence is retained for its 7-year term as an integral, append-only part of the Service and of our customers' record-keeping; account deletion removes account data while evidence records are retained only as long as legally justified. You may also lodge a complaint with your supervisory authority.
7. Changes
We will post changes on this page with an updated date; material changes will be flagged in the dashboard.