Privacy

The service is built so there is very little to protect: there are no accounts, no profiles and no marketing.

What is stored

• The VAT identification numbers submitted, and your own VAT number as the requester. These are business identifiers.
• The answers VIES returned: validity, consultation number, timestamp, and any registered trader name and address the member state published.
• Order and payment references, amounts and refunds, for accounting.
• A salted hash of the submitting IP address, used only for rate limiting and abuse prevention. The address itself is never stored.

What is not stored

No card details (Stripe holds those), no email address in this service's own database, no cookies for tracking, no analytics and no third-party scripts. The order URL is the only credential; anyone holding it can read that order, so treat it as confidential.

Retention

Order records and results are erased 90 days after the order is placed, at which point the results stop being retrievable. Financial ledger entries are kept without identifying data for statutory accounting periods.

Processors

• Stripe — payment processing.
• Vercel — hosting.
• Neon — database hosting.
• The European Commission (VIES) — the VAT numbers submitted are sent there to be checked. That is the service.

Your rights and contact

For access, correction or erasure ahead of the retention window, write to privacy@nyttolabs.com with the order URL.

The controller is Nytto Labs, Sweden, which operates Vatidence at vatidence.nyttolabs.com. Data-protection requests reach a person fastest at the address above; anything else can go to hello@nyttolabs.com.