1. Data we process

Calculations and validation: inputs are sent to our server to perform calculations or contact VIES. We log operation type, timestamp, and network information used for rate limiting and abuse prevention. Quick-check results are not saved as user records.

Evidence Pack: we store the Stripe checkout-session reference, receipt email, payment state, whether the pack has been used, and the structured VIES response used to restore the same report after an interrupted request. PDF and CSV files are generated in your browser rather than stored as files on our server. Your browser temporarily stores the draft list, requester VAT ID, and receipt email in local storage, plus a pending checkout reference in per-tab session storage, so checkout can be resumed.

Payments: Stripe processes card details. We do not receive or store full card numbers.

Analytics: Plausible Analytics provides aggregate, cookie-free page and feature statistics.

2. Why we process it

We process data to provide the requested service, confirm payment, prevent reuse or abuse, secure the site, and understand aggregate product usage. Payment records are retained as required for accounting and legal obligations.

3. Cookies and browser storage

We do not use advertising or cross-site tracking cookies. Legacy customers may have an HTTP-only access cookie. Evidence Pack drafts use local storage on your device and are removed after successful generation; you can remove them at any time through browser settings.

4. Service providers and transfers

We use Stripe for payments, Plausible for aggregate analytics, Cloudflare for delivery and protection, EU-hosted infrastructure for the application, and European Commission VIES to perform VAT checks. VIES forwards queries to the relevant national VAT database.

5. Your rights

Where the GDPR applies, you may request access, correction, deletion, restriction, objection, or portability of personal data, subject to legal retention duties. Contact [email protected].

6. Security and changes

Traffic is encrypted using HTTPS and access is restricted. No internet service is risk-free. We may update this policy as the product changes and will publish the revised date here.