Privacy policy
Last updated 6 November 2026
This is a draft. A lawyer has not reviewed it yet, and it names no legal entity or governing law.
1. What we collect
Your account: your email address, and either a password, which we store only as a hash, or a link to your Google sign-in.
Your use: for each check, the time, the kind of check, the verdict and the credits used. We keep a keyed hash of what you sent, not the phone number, email address or IP address itself.
Emails: we email you about your account (confirmation and sign-in links), your finished lists and your billing. In your first week we may also send one short email on getting started, with a link that stops those.
Your billing: your plan, your credit balance and a ledger of every change to it. Stripe holds your card details. We keep a customer ID and what you bought.
Your files: the lists you upload and the result files we make from them, until they are deleted (see retention below).
The free tools: if you check a number or an address without an account, we count your checks for the day under a keyed hash of your IP address, not the address itself, and delete the counts after a week. The check itself is recorded like any other: a keyed hash of the input and the result.
Visits: Vercel Web Analytics counts page views without cookies. It receives the page address with only its campaign tags (such as utm_source) and none of the rest of the query.
Our own visit cookie: so we can see which pages lead people to sign up and buy, the site sets one first-party cookie, nl_vid. It holds a random ID and nothing else, and it lasts 90 days from your first visit. With it we record the first page you landed on (without its query), the name of the site that sent you (not the full address), any campaign tags, and whether you used a free tool, opened the sign-up page, signed up or opened checkout. It is never shared, sold or used for advertising.
We do not set that cookie if you visit from the European Union, the European Economic Area, the United Kingdom or Switzerland, or if your browser sends a Global Privacy Control signal. You can also block or delete it in your browser; the site works the same without it.
2. What we never store: the numbers and addresses you check are not logged
We do not write the phone numbers, email addresses or IP addresses you check to our logs, our error reports or any analytics. The record of a check holds a keyed hash of the input and the result, not the input.
The numbers in a list you upload are in your file and the result files, and nowhere else we keep. The lookup cache stores a keyed hash of each number with what the carrier data source said about it, not the number. We never store card numbers.
4. Retention: how long files and caches are kept
Uploaded files and result files are deleted automatically 30 days after a list finishes. Cached carrier answers are removed after 30 days. Visit records with no account are deleted 90 days after the first visit; once you sign up, they are kept with your account.
Records of checks and the credit ledger are kept while your account exists, and payment records for as long as accounting rules require. Your account is kept until you ask us to delete it.
5. Your rights
You can ask what we hold about you, ask us to correct it, and ask us to delete your account. Write from the address on the account and we will reply as soon as we can and within the time the law sets. Deleting an account removes your sign-in, your keys and your files. We keep payment records as the law requires.
6. Contact
Write to support@numberlookup.io.