Privacy Policy
Effective October 16, 2026
This policy explains how ValidationCheck ("ValidationCheck", "we") handles personal data. We play two roles:
- Controller for data about our customers and visitors: your account, billing, and website use.
- Processor for the data our customers send us to check (email addresses, phone numbers, IP addresses, domains). We handle it only on their instructions, under our Data Processing Addendum. If someone checked your details with us, contact that company first; we'll help them answer you.
What we collect
| Data | Why | How long |
|---|---|---|
| Account: name, email, password hash, team, role, 2FA settings | Provide and secure your account | Until you delete your account |
| Billing: plan, invoices, payment status (card details stay with Stripe) | Charge for plans and top-ups; tax and accounting | As long as the law requires (typically 7 years) |
| Lookups: what you checked and the answer | Return results, free repeats within 7 days, your History page | 30 days, then deleted. Turn History off in Settings for 0-day retention. |
| Usage counts: lookups and credits per hour, key, and check | Billing, your usage charts, abuse prevention | Aggregates kept while your account exists |
| Security logs: sign-ins, IP address, key, and billing changes | Protect accounts, investigate abuse | Up to 1 year |
| Support emails | Answer you | Up to 2 years |
What we don't do
- We don't sell personal data or share it for advertising.
- We don't use the data you check to build our own lists or to enrich other customers' results.
- We don't use advertising pixels or third-party tracking cookies. The dashboard uses one essential sign-in cookie.
Who we share it with
Only the service providers that run the Service, listed on our Subprocessors page, under contracts that limit their use to providing their service. For example, to check whether a mailbox exists we send the address to our email-verification provider. We may also disclose data if the law requires it, to protect rights and safety, or as part of a business transfer (with notice to you).
Where it's processed
The Service runs on Cloudflare's global network and some providers are in the United States. Where data leaves the EEA, UK, or Switzerland we rely on the EU Standard Contractual Clauses (and the UK addendum) or an adequacy decision.
Legal bases (EEA and UK)
Contract (to provide your account and the Service), legitimate interests (security, abuse prevention, improving the Service), legal obligation (tax and accounting), and consent where we ask for it.
Your rights
Depending on where you live, you can ask to access, correct, delete, or export your personal data, object to or restrict processing, and complain to your data protection authority. California residents have the rights in the CCPA/CPRA; we don't sell or share personal information as those laws define it. Most account data can be changed or deleted in Settings. For anything else email support@validationcheck.net; we answer within 30 days.
Security
Data is encrypted in transit (TLS) and at rest. API keys are stored only as hashes; provider keys are encrypted. Two-factor authentication is available for every account, and access to customer data inside our team is limited and logged.
Children
The Service is for businesses and isn't directed at anyone under 16.
Changes
We'll post updates here and, for material changes, email account owners before they take effect.
Contact
ValidationCheck, 915 N 550 W, Mapleton, UT 84664, United States. Email support@validationcheck.net.