Our Core Privacy Commitments at a Glance
- Zero Resale of Customer Data: We never monetize, sell, broker, or train AI models on customer contact lists.
- Application-Layer Encryption: Uploaded CSVs, preflight plans, and verification results are encrypted using AES-256-GCM before storage.
- Cryptographic Blind Hashing: Cache lookups use HMAC-SHA256 nonces—plaintext phone numbers are never stored in index keys.
- Strict 90-Day Maximum Retention Cap: Verification cache entries and raw upload artifacts are permanently purged on a strict rolling schedule.
1. Overview & Data Controller Status
This Privacy Policy ("Policy") governs the processing of personal data by phoneveriflo Ltd.("phoneveriflo", "we", "us", or "our"), a company registered in the United Kingdom under Company Number 14892184, with registered office at 128 City Road, London, EC1V 2NX, United Kingdom.
In the context of European Data Protection Legislation (including Regulation (EU) 2016/679 ("GDPR") and the UK Data Protection Act 2018 ("UK GDPR")):
- Data Controller: phoneveriflo acts as the Data Controller for direct customer account information, billing records, administrative contact telemetry, and website visitor analytics.
- Data Processor: When customers upload contact lists, phone numbers, email addresses, or API verification payloads ("Customer Verification Data"), the customer remains the Data Controller and phoneveriflo processes such data strictly as a Data Processor pursuant to our Data Processing Agreement (DPA).
2. Information We Collect
We process three primary categories of information depending on your interaction with the platform:
2.1 Account & Identity Information
- Profile Details: Full name, work email address, company name, and encrypted password hash (bcrypt).
- Organization Metadata: Organization name, billing addresses, VAT identification numbers, and contact preferences.
- Authentication Records: Opaque random session tokens (stored only as SHA-256 hashes in our database), multi-factor authentication (TOTP) credentials, and high-entropy API key prefixes.
2.2 Billing & Payment Telemetry
- Credit Ledger Records: Integer USD micro balances (1 USD = 1,000,000 micros), timestamped double-entry transaction hashes, and invoice metadata.
- Cryptocurrency Payment Metadata: When paying via NOWPayments or BTCPay, we store public transaction IDs, currency codes (e.g. BTC, ETH, USDT, USDC), deposit addresses, and payment confirmation statuses. We never have access to private keys or custodial funds.
2.3 Customer Verification Inputs & Job Payloads
- Submitted Contact Identifiers: E.164-normalized telephone numbers, email addresses, and supplementary matrix fields uploaded via batch CSV/TSV or submitted to REST API endpoints.
- Verification Enriched Signals: Carrier routing identifiers, line types (mobile, landline, VOIP), reachability states, validation flags, and provider-neutral canonical result summaries.
3. Lawful Bases for Processing
Under GDPR Article 6, we only process personal data when an authorized legal basis exists:
| Processing Activity | Data Category | Lawful Basis (GDPR Art. 6) |
|---|---|---|
| Account creation & login | Name, email, password hash | Contract Performance (Art. 6(1)(b)) |
| Executing verification jobs & API requests | Submitted phone numbers & emails | Contract Performance & Processor Instructions (Art. 28) |
| Ledger balance accounting & invoicing | Transactions, USD micros, payments | Legal Obligation & Tax Compliance (Art. 6(1)(c)) |
| Platform security & rate limit enforcement | IP addresses, audit logs, API headers | Legitimate Interests (Art. 6(1)(f)) |
| Marketing newsletters & product updates | Opt-in email subscriptions | Consent (Art. 6(1)(a)) |
4. Processing of Customer Contact Data
Our processing pipeline adheres to strict white-label and data protection standards:
- Local Deterministic Normalization: Input parsing, Unicode sanitization, delimiter identification, and E.164 formatting are performed in local application memory without external provider transmission.
- Deterministic Preflight Deduplication: Exact duplicate rows are detected locally. No billing is applied to exact duplicate rows unless explicitly configured.
- Zero Plaintext Logging: Sensitive personal data, contact identifiers, and raw API responses are strictly filtered out of system log sinks (stdout/stderr, DataDog, Sentry).
5. Encryption & Tenant Isolation
phoneveriflo enforces multi-layered cryptographic isolation across all customer environments:
- Encrypted at Rest: All stored datasets, cache results, preflight plans, and raw upload artifacts are encrypted using AES-256-GCM with customer-isolated initialization vectors.
- HMAC-SHA256 Cache Indexing: Cached verification lookups never store phone numbers or email addresses as plain database keys. Cache lookup keys are computed as:
KEY = HMAC-SHA256(CACHE_PEPPER, "tenant_id/service_id/normalized_value") - Strict Tenant Scope: By default, cache hits are isolated strictly to your organization. Cross-tenant cache reuse is disabled to guarantee total data segregation.
- Transit Encryption: All public, customer, and API communications require TLS 1.3 encryption with strict HTTP Strict Transport Security (HSTS) preloading.
6. Sub-processors & Disclosures
We do not sell personal data to data brokers or advertisers. We engage a limited set of verified technical sub-processors under binding Data Processing Agreements:
- Cloud Infrastructure: Amazon Web Services (AWS) & DigitalOcean (EU/UK availability zones) for encrypted compute, database replication, and object storage.
- Payment Gateways: NOWPayments & BTCPay Server for non-custodial crypto payment resolution and invoice generation.
- Transactional Email: SendGrid / Postmark for password resets, email verifications, and critical security notifications.
- Telecommunication Routing Nodes: Verified upstream carrier networks accessed server-side to resolve live routing registers. Upstream responses are canonicalized and never exposed in raw vendor format.
7. International Data Transfers
When data is transferred outside the United Kingdom or European Economic Area (EEA), phoneveriflo ensures appropriate safeguards under GDPR Chapter V, including:
- UK International Data Transfer Addendum (IDTA);
- European Commission Standard Contractual Clauses (SCCs, Commission Implementing Decision (EU) 2021/914);
- Supplementary technical measures including customer-controlled encryption keys and ephemeral memory processing.
8. Data Retention & Automated Purging
We adhere to strict data minimization and rolling retention schedules:
| Data Type | Retention Window | Purge Mechanism |
|---|---|---|
| Raw Batch Uploads (CSV/TSV) | 30 Days | Automated daily cron shredding |
| Encrypted Verification Cache | Min(Service TTL, 90 Days) | Rolling HMAC expiry index |
| Customer Download Artifacts | 60 Days | Cryptographic key revocation |
| Financial & Invoicing Ledger | 7 Years | Statutory UK tax compliance requirement |
| Account Deletion Requests | Within 48 Hours | Cascading permanent DB wipe |
9. Technical & Physical Security Measures
phoneveriflo implements enterprise-grade technical and organizational security controls:
- Role-Based Access Control (RBAC) with least-privilege administrative partitioning.
- Mandatory multi-factor authentication (MFA) for all engineering and administrative staff.
- Automated dependency vulnerability monitoring and continuous static analysis leak gates.
- Immutable append-only audit logging for all administrative events, ledger adjustments, and API key provisioning.
10. Your Rights Under GDPR, UK GDPR & CCPA/CPRA
Subject to applicable statutory exceptions, you have the following enforceable privacy rights:
- Right to Access (GDPR Art. 15): Request a copy of the personal data we hold about you.
- Right to Rectification (GDPR Art. 16): Correct inaccurate or incomplete account data directly in your workspace settings.
- Right to Erasure / "Right to be Forgotten" (GDPR Art. 17): Request the permanent deletion of your organization and all associated verification records.
- Right to Restrict Processing (GDPR Art. 18): Restrict data processing during pending disputes.
- Right to Data Portability (GDPR Art. 20): Export your transaction history, account details, and results in structured JSON or CSV format.
- Right to Object (GDPR Art. 21): Object at any time to direct marketing communications.
- California Privacy Rights (CCPA / CPRA): California residents have the right to opt out of the sale or sharing of personal information. We do not sell personal information.
To exercise any of these rights, submit a request via our Privacy Settings Portal or email our Data Protection Officer at [email protected]. We respond to verified requests within 30 days without charge.
12. Amendments & Policy Updates
We may revise this Privacy Policy periodically to reflect changes in regulatory standards, security enhancements, or platform capabilities. Material updates will be communicated via email notice to registered account administrators or via an in-app notice at least 14 days before taking effect.
13. Contact & Data Protection Officer (DPO)
If you have questions, concerns, or complaints regarding our data protection practices, contact our Data Protection Team: