Legal Draft
Privacy policy
Version 2026-10-29 ยท Effective
This policy covers the personal data vies.fyi controls: the data about you as the person who holds an Account. The VAT numbers, References and registered names and addresses you monitor are a different matter. For those we act only as your processor, under the Data Processing Agreement attached to the Terms of service.
The controller is the operator of vies.fyi (legal name and address to be named before launch). You can reach us about this policy at (contact email address to be named before launch).
Your email address
We use your email address to sign you in, to send you messages about your Account (for example a security notice or a change in a monitored number) and to answer you. The legal basis is the performance of our contract with you (GDPR Article 6(1)(b)).
Retention. We keep it for the life of your Account. When you erase your Account it is deleted at once. A Lapsed Account, with its email address, is deleted 90 days after it lapses.
Sign-in data
To keep your Account secure we store your password as a one-way hash, a record of each signed-in session with its IP address and browser, and, if you turn on two-factor authentication, its secret (encrypted) and your recovery codes (hashed). The legal basis is the performance of our contract with you and our legitimate interest in keeping Accounts secure (Article 6(1)(b) and (f)).
Retention. A session is deleted when you sign out. The rest is kept for the life of your Account, and the two-factor secret and recovery codes until you turn two-factor authentication off. All of it is deleted at once when you erase your Account.
Billing data
Payments are handled by Stripe. Your card details go to Stripe, never to us. We keep the references to your Stripe customer and subscription, and the payment and subscription events Stripe sends us, which include your billing name, email, address and VAT number. Stripe keeps your billing details and invoices. The legal basis is the performance of our contract with you and our legal obligation to keep tax records (Article 6(1)(b) and (c)).
Your own VAT number, which you give when you sign up, is stored with your Account and with each check made from it. We send it to Stripe for your invoices, and to VIES as the requester of each check. The legal basis is the performance of our contract with you and our legal obligation to keep tax records (Article 6(1)(b) and (c)).
Retention. Our references, the stored Stripe events and your VAT number are deleted when you erase your Account. Stripe's customer and invoice records are kept for as long as tax law requires us to keep them as the seller's records.
Server logs
Our servers log each request, with its IP address and the time, so we can run the service, find faults and stop abuse. VAT numbers, References and the names and addresses VIES returns are filtered out before anything is written. The legal basis is our legitimate interest in running a secure, working service (Article 6(1)(f)).
Retention. Logs are deleted after up to 14 days. Backups are encrypted and deleted after 30 days.
Who receives your data
The service providers that handle data for us are listed, with what each receives and where, on the Sub-processors page. We do not sell your data.
Your rights
You can ask for access to, correction of, or deletion of your data, ask us to restrict or stop processing it, and ask for a copy you can take elsewhere. You can erase your Account yourself in the app at any time. You also have the right to complain to a data protection supervisory authority, for example the one where you live.