Privacy Policy

Privacy Policy for vatcheckapi.com

Last updated: 18 October 2026

This policy explains which personal data Everapi GmbH processes when you use vatcheckapi.com: this website, its free tools, the dashboard at app.vatcheckapi.com and the API.

You can print this policy at any time by using your browser’s print feature.

Data Controller and Owner

Everapi GmbH
Getreidegasse 22
A-2284 Untersiebenbrunn, Austria
Commercial register: FN569823a
Managing director: Dominik Kukacka
Email: office@everapi.com

What Data We Collect

We may collect the following types of personal data, either directly or via third parties:

• First name, last name and email address (your account and the contact form)
• Company and billing details (paid plans)
• API usage data: the requests made with your API key, including the request URL, the IP address they came from and the user agent
• Usage data of this website: pages visited, browser, device type and approximate location, collected without cookies
• VAT numbers you check, and the registration status, company name and address returned for them
• IBANs you check with the free IBAN tool

Each category of data collected is described in detail in the appropriate section of this privacy policy or where specifically explained before data is gathered.

Users may voluntarily provide this data, while usage data is typically collected automatically when interacting with the site.

Unless otherwise noted, all requested data is necessary for proper functionality. If users fail to provide such data, we may not be able to offer our services effectively.

Where optional data is indicated, users can choose not to provide it without affecting service quality.

If unsure about what information is required, users are encouraged to contact the Owner directly.

This website does not use cookies for analytics or advertising. The free tools set one cookie that is strictly necessary for them (see “Free tools” below). The dashboard uses cookies to keep you signed in and for analytics.

Users are solely responsible for any third-party personal data shared through this Application.

How and Where Data Is Processed

Processing Methods

We implement suitable technical and organizational measures to prevent unauthorized access, alteration, disclosure, or destruction of personal data.

Data is processed using IT systems according to procedures closely aligned with stated purposes. Authorized personnel (such as staff in administration, marketing, legal, system operations) or the service providers listed below may access data when needed. They process personal data on our behalf.

Processing Location

Our servers are in Germany. Requests reach them through Cloudflare, and some of the service providers listed below are based in the United States, so data can be transferred outside the EU. See the relevant section of this document for more.

Data Retention

Unless otherwise stated, data is retained only as long as required for the purpose it was collected. We may keep it longer if required by law or with user consent.

Why We Process Data

We collect personal data for the following reasons:

• To deliver and maintain our VAT number validation API
• To comply with legal obligations
• To respond to legal or regulatory requests
• To defend our rights and those of our users or third parties
• To detect and prevent misuse or fraud
• To improve our VAT validation and service quality
• To understand how this website is used, with cookieless analytics

Examples of Processing

1. Contacting Users

When you send the contact form, we receive the data you entered, such as your name, email address, company and message, and use it to answer your inquiry. Cloudflare checks the form for bots (Turnstile) and delivers it to us by email.

2. Hosting, Infrastructure and Service Providers

We use these service providers to host and deliver this Application and its features, to understand how it is used and to take payments. They process personal data on our behalf.

Cloudflare, Inc.
Hosting of this website, its documentation and the free tools (Cloudflare Workers). DNS, network proxy and encryption (TLS) for the API and the dashboard, so every request to them passes through Cloudflare. Bot protection for the contact form and the free tools (Cloudflare Turnstile), delivery of contact form messages by email, and file storage.
Location: United States, global network – Refer to their Privacy Policy for details.

Hetzner Online GmbH
Servers for the API, the dashboard and our databases.
Location: Germany – Refer to their Privacy Policy for details.

PostHog Inc.
Cookieless analytics for this website: which pages are visited, clicks, the referring page, browser, device type, approximate location and page performance. PostHog sets no cookies and stores nothing in your browser. To count unique visitors, it derives a hash from your IP address and browser that changes every day. Email addresses, phone and VAT numbers and IP addresses are removed from page addresses and clicked text before an event is sent. In the dashboard (app.vatcheckapi.com), PostHog also links events to your account and records sessions.
Location: EU – Refer to their Privacy Policy for details.

Stripe
Payments and invoices for paid plans. Stripe receives your billing details and payment information; we do not store card numbers.
Location: Ireland, United States – Refer to their Privacy Policy for details.

Functional Software, Inc. (Sentry)
Error tracking. Details of a request that caused an error can reach Sentry, which can include a checked VAT number.
Location: United States – Refer to their Privacy Policy for details.

Postmark (ActiveCampaign, LLC)
Sending account emails. Postmark receives your email address and the content of the email.
Location: United States – Refer to their Privacy Policy for details.

European Commission (VIES)
Registration check of EU VAT numbers. VIES passes the number to the tax authority of the member state that issued it.
Location: EU – See ec.europa.eu/taxation_customs/vies.

A third-party VAT data service
Registration check of UK (GB) VAT numbers.

3. Free Tools

The free tools on this website send what you enter to our API through our Cloudflare Worker, which uses our own API key:

• Before the first lookup, an invisible Cloudflare Turnstile check makes sure you are not a bot. When it passes, the tools set a cookie that is valid for two hours and only proves that the check passed
• Your IP address is used to limit how many lookups a visitor can make
• Cloudflare caches each lookup, together with its result, for up to one day, so repeated lookups do not reach the API
• Cloudflare keeps logs of a sample of requests to this website, including tool lookups, for up to 7 days

4. VAT Validation Service

• We process the VAT numbers you send to check their format and whether they are registered
• To check the registration of an EU VAT number, we send the country code and the VAT number to the VAT Information Exchange System (VIES) of the European Commission, which asks the tax authority of that member state. VIES returns whether the number is valid and, where the member state provides them, the registered name and address of the business
• For UK (GB) VAT numbers, which VIES does not cover, we send the VAT number to a third-party VAT data service, which returns the same information
• We store each checked VAT number with its registration status, name, address and the date of the check in our database, and keep earlier versions, so we can answer repeated checks and show changes. Batch checks and their results are kept in your account
• Every VAT number in this database, including numbers checked through our service, has a public company page on this website (vatcheckapi.com/companies/) that shows the registry’s answer: company name, address, registration status and the date of the last check. The page shows the VAT number partly masked and in full after a reCAPTCHA check. These pages are listed in our sitemaps for search engines
• Requests made with an API key are logged with the request URL, which can contain the VAT number, the IP address the request came from and its user agent. We use the log to count requests against your plan, show your usage in the dashboard and prevent abuse. It deletes the request URL, IP address and user agent after 90 days
• If a request fails, its details, which can include the VAT number you checked, can go to our error tracker, Sentry (United States)
• EORI numbers: we send UK (GB) EORI numbers to HMRC and EU and Northern Ireland (XI) EORI numbers to the European Commission’s EORI validation service (EOS). We keep each answer in a cache on our servers for up to 1 hour (registered numbers) or 10 minutes (numbers that are not registered); we do not store EORI numbers in our database. Cloudflare caches checks made with the free EORI checker for up to 1 hour. EORI numbers are removed from the error reports we send to Sentry
• IBANs: the bank data for an IBAN is looked up in bank directories stored on our own servers; the IBAN is not sent to a third party for this. We do not store IBANs in our database, and the free IBAN checker’s checks are not cached. IBANs are removed from the error reports we send to Sentry. As with any API request, the request log described above can keep an IBAN sent in the request URL for 90 days
• E-invoices: invoice files are validated on our own servers in Germany and are not stored: we do not write them to our database, our logs or file storage. The free e-invoice validator on this website does not cache them. Invoice contents are removed from the error reports we send to Sentry
• We do not sell the VAT numbers you check. We send them only to VIES and, for UK numbers, to the VAT data service described above, and to service providers that process data on our behalf, such as Cloudflare

Legal Basis for Processing

We may process personal data when:

• Users have given explicit consent
• Data is required for a contract or pre-contractual arrangements
• Legal obligations demand it
• It serves the public interest or official authority
• We have legitimate business interests that don’t override user rights, such as cookieless analytics of this website and protecting it from bots and abuse

For help determining the legal basis, please contact the Owner.

More on Data Retention

• Data linked to contracts is kept until the agreement is fulfilled
• Data processed under legitimate interest is stored as long as necessary
• If consent was given, data is kept until consent is withdrawn
• Legal obligations may require longer retention
• Checked VAT numbers and the registration data returned for them are kept in our database to answer repeated checks
• The request log deletes request URLs, IP addresses and user agents after 90 days
• Free tool checks are cached at Cloudflare for up to 1 day (VAT numbers) or 1 hour (EORI numbers)
• E-invoice files are not stored

Once the retention period ends, data is deleted and access/portability rights no longer apply.

GDPR Rights for Users

Under the GDPR, users have the right to:

• Withdraw previously given consent
• Object to data processing for specific reasons
• Request access to their data
• Verify or correct their data
• Restrict processing
• Have data deleted
• Receive data and transfer it to another provider
• File complaints with a data protection authority

Users can also inquire about how data is protected when transferred abroad.

Objecting to Data Processing

If we process data under public interest or legitimate interest, users may object by explaining their specific situation.

Users may always object to direct marketing use without giving a reason. If objected, data will no longer be used for that purpose.

How to Use These Rights

To exercise these rights, users can contact the Owner using the contact details above. Requests are free and will be processed within a month.

If personal data has been shared with others, the Owner will attempt to notify them of any corrections or deletions, unless it’s impossible or overly difficult.

Additional Info

Legal Use

We may use personal data in legal proceedings or in preparation for legal action related to misuse of our Application or services.

Extra Information

Additional details about specific services or data handling may be provided on request.

System Logs and Maintenance

For maintenance and operational purposes, we or third parties may log interactions and collect information such as IP addresses.

Unlisted Information

Users can request further details about data practices by contacting the Owner.

Privacy Policy Updates

We may revise this privacy policy at any time. Users will be informed on this page or elsewhere in the Application. We may also notify users by email if possible.

Users should check this page regularly for updates. If consent is required for any changes, we will request it again as needed.

Legal Note

Unless otherwise mentioned, this privacy policy applies solely to this Application.

Definitions

• Personal Data: Information identifying a natural person, directly or indirectly.
• Usage Data: Automatically collected info like IP addresses, browser details, and time spent on pages.
• User: The person using this site.
• Data Subject: The individual to whom personal data refers.
• Data Processor: Entity processing data on behalf of the Data Controller.
• Data Controller: The party that determines how and why data is processed — in this case, the Owner.
• Service: The services provided via this Application.
• EU: References in this policy to the “EU” include both EU and EEA member states.