Privacy Policy

1. Who we are and what this policy covers

Phone Validator LLC ("Phone Validator", "we", "us") is a California company at 69 Santa Felicia Dr, Goleta, CA 93117, United States. We provide phone number validation to businesses through phonevalidator.com, our API, batch processing and integrations (the "Service").

We handle personal information in two different roles:

• For our own purposes for information about visitors to our website, our customers' account users and contacts, and people who contact us. We decide how that information is used, and this policy describes those practices.
• As a service provider (processor) for the phone numbers and files our customers submit through their accounts, batches, the API, integrations and our free lookup, and the results we return for them ("Customer Data"). A free lookup is run for the business that submits it, its result is shown only to that visitor, and we keep it 7 days. We process Customer Data only on our customers' instructions, under our Terms of Service and Data Processing Addendum. The customer's own privacy policy governs how it collects and uses that data. Section 8 explains what we do with Customer Data and how people whose numbers are submitted can reach us.

The Service is for businesses. It is not for personal, family or household use, and not directed to children, and we do not knowingly collect personal information from children under 16.

2. Information we collect

Category	Examples	Source
Account and contact information	Name, business email, company name, sign-in methods (passkey public keys, authenticator settings), marketing preference	You
Billing and transaction information	Billing contact, purchase amounts, balance, invoices, payment status. Saved cards are stored by Stripe; we display their brand and last four digits from Stripe	You and Stripe, our payment processor (we never receive full card numbers)
Phone numbers and files you submit	Numbers entered in a lookup, uploaded batch files, numbers sent to the API, and their results	You or your integrations
Device and network information	IP address, browser type, pages visited, referring page, timestamps, request and error logs	Your browser, our systems and our hosting provider's firewall and content delivery network (Amazon Web Services), automatically
Fraud and security information	Risk signals derived from your IP address (country, whether it is a proxy, VPN or hosting provider), firewall rule matches, bot-check results, a keyed digest of your network	Our systems, Amazon Web Services' firewall, MaxMind and Cloudflare Turnstile
Communications	Messages you send us, privacy requests, feedback about results	You
Campaign information	Campaign labels in the link you followed to our site	The link you used

Apart from sign-in credentials, we don't ask for sensitive personal information, such as government identifiers, financial account details, precise geolocation, or health or biometric data. We use your sign-in credentials (emailed codes and passkeys) only to sign you in; passkeys stay on your device and we store only their public keys. If a customer uploads a whole spreadsheet instead of its phone column, we keep only the phone column and delete the original once the batch is checked. Results about the numbers you submit come from public numbering data and our telecommunications data provider.

3. How we use information

• To provide the Service: run lookups and batches, return results, operate accounts and API keys, and provide support.
• To bill and keep records: process payments, maintain balances and the ledger, prevent payment fraud and meet accounting, tax and legal obligations.
• To secure the Service and prevent abuse: enforce rate limits and our Acceptable Use Policy, detect fraud, scanning and automated misuse, and investigate incidents.
• To communicate with you: send sign-in codes, receipts, balance alerts, service and policy notices, and replies to your messages.
• To send marketing about our products to business contacts, as described in Section 6.
• To improve the Service: using aggregated or de-identified usage statistics, such as request volumes, error rates and response times. We review individual free lookups only when a visitor reports a wrong result, or for quality checks while we keep them. We may test new versions of the Service with Customer Data, as service-provider rules allow, but never to build profiles or databases or to serve anyone else.
• To comply with law and to establish, exercise or defend legal claims.

We do not make decisions about individuals that produce legal or similarly significant effects based solely on automated processing, and we do not profile the people whose numbers are checked.

4. How we share information

We share personal information only with:

• Service providers that process it on our behalf to provide their services to us. They are listed in Section 5.
• Our telecommunications data provider, which receives the phone numbers being checked, and only those, so it can return carrier and line-type information.
• Stripe, which processes payments as our service provider and also as an independent business under its own privacy policy, for example to prevent fraud.
• Platforms you connect, such as HubSpot, Zapier, Make, Zoho or GoHighLevel, when you direct us to return results there.
• Authorities and others when required by law, or when we believe in good faith that disclosure is necessary to protect the rights, property or safety of Phone Validator, our customers or others, or to investigate fraud or abuse. We disclose Customer Data only as Section 5.6 of our Terms describes: when legally required, and after telling the customer where permitted.
• A successor business if Phone Validator is involved in a merger, acquisition, financing, reorganization or sale of assets, subject to this policy and the DPA.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We don't sell, rent or license lists or databases of phone numbers or of people, and we don't compile them. We answer each customer's queries about numbers that customer already has, on that customer's behalf. We don't compile or combine those queries, and we keep them only as Section 9 describes.

5. Service providers

We store data, and run the systems that process it, in the United States. Requests are received at content delivery network locations in North America, Europe and Israel and forwarded encrypted to our servers in the United States, and some providers, such as Cloudflare and Google, may process data elsewhere as part of their global networks.

Provider	Purpose	Data
Amazon Web Services	Hosting, storage, backups, email delivery	All data described in this policy
Telecommunications data provider	Carrier and line-type lookups	The phone numbers being checked
Stripe	Payments and invoices	Billing contact, payment details, amounts
Cloudflare (Turnstile)	Bot checks on public forms	Challenge result, IP address, browser signals
MaxMind	Signup fraud checks	IP address at signup
Sentry	Error and uptime monitoring	Error details with request data, cookies and user details removed
Fathom Analytics	Cookieless website analytics	Page paths, referring sites, campaign labels, purchase amounts, IP address (not stored by Fathom)
Google Workspace	Our email	Messages you send us

The providers that process our customers' data are also listed in our Data Processing Addendum.

6. Email and marketing

We send account emails that you can't opt out of while you have an account, because they are part of the Service: sign-in codes, receipts, balance and security alerts, and notices about the Service and our terms. We may also send business contacts occasional emails about our products, features and offers. Every marketing email includes an unsubscribe link and our postal address, and you can change your preference in your account settings at any time. We never send marketing to phone numbers checked through the Service, and we don't use Customer Data for marketing.

7. Cookies and analytics

We use only first-party cookies needed to run the site: keeping you signed in, remembering a free lookup's result, a random visitor ID kept up to 1 year to apply free-lookup limits, protecting forms and batch orders, remembering for up to 90 days that you declined to set up a passkey, holding a HubSpot app installation while you sign in, and remembering campaign labels for up to 30 days. We don't use advertising cookies or cross-site tracking. Fathom Analytics measures site usage without cookies. Account pages other than sign-up, sign-in and passkey setup load no analytics. Because we don't sell or share personal information, there is nothing for a Global Privacy Control or Do Not Track signal to opt you out of. If that changes, we will honor Global Privacy Control signals as opt-out requests.

8. Phone numbers our customers check

If a business checked your phone number with our Service, that business decides why and how it uses the result, and its privacy policy applies. We process the number only to provide our Service to that business, as our Data Processing Addendum allows. We don't know or receive your name, we don't add your number to any list or database of phone numbers or people, and we keep a record of the lookup only as briefly as Section 9 describes. Checking a number doesn't contact it: we don't call, text or message it, and nothing is sent to the phone. We only consult numbering records and our data provider's databases.

Stop lookups of your number. You can ask us to stop processing your phone number with our privacy request form. We add the number to a suppression list, which holds a keyed one-way code of the number rather than the number itself. Once we complete your request, lookups of that number through our website, accounts, batches, the API and our integrations return no carrier data, and we keep no record of them except in our copy of the customer's batch file, which we delete on the usual schedule (Section 9). Results for a suppressed number may read "no record" or "invalid". We honor these requests from anyone, including people covered by New Jersey's Daniel's Law and similar laws and their authorized agents, whether or not those laws apply to our Service, and we don't need to verify your identity to suppress a number. We aim to act within 10 business days of receiving a request, which you can also email to info@phonevalidator.com. Requests sent to any of our addresses are handled the same way.

9. How long we keep information

Data	Kept
API lookups, including through Zapier, Make, Zoho, GoHighLevel and other platforms that call our API (HubSpot app below)	The number and result are not stored. A billing and usage record (time, API key, products, cost and status) is kept 30 days, and the charge itself stays in the ledger.
Account web lookups	7 days, or until you delete them from your lookup history. Lookups under billing review or correction are kept until resolved; the number and result are then deleted 7 days after resolution, keeping only the billing record.
Batch files and results	7 days after the batch completes, or until you delete them sooner. Unpaid batches: 7 days after upload. Temporary uploads: 1 day. Batches ordered before October 5, 2026 keep the 30 days they were ordered with. Batches with a payment hold or failed processing are kept until resolved.
HubSpot app results	We don't store the number. The results are held only until HubSpot accepts them, and at most 3 days, so a failed write-back can be retried without a new charge. A record of each HubSpot notification (HubSpot's record and event IDs, no number) is kept 30 days so we don't charge twice.
Free lookups without an account	7 days
Feedback about a result	7 days
Privacy requests	The request, including the numbers and contact details in it, encrypted: 3 years after we complete it, as a record that we did
Account, sign-in methods and fraud signals	While your account is open. When you close your account we delete your name, company, email address, sign-in methods, saved lookups and batches, HubSpot connection details and signup risk signals, and revoke your API keys (we keep each revoked key's name and a one-way code with your billing records). We keep billing and agreement records as described below. Stripe keeps its own payment records, under its privacy policy.
Agreement records	The version of our terms each account accepted, when, and a keyed code derived from the network used: kept as long as billing records
Suppressed numbers	A keyed one-way code of each suppressed number, kept as long as the suppression applies
Expired sign-in codes, links and sessions	30 days after they expire
Billing records and the ledger	As long as needed for accounting, tax and legal purposes (generally at least 7 years). These contain amounts, products and times. To prevent charging twice for the same dashboard lookup, a charge may include a one-way code derived from the number with a secret key; it isn't the number, and we don't use it to identify the number.
Application and firewall logs	90 days. Phone numbers, emails and form contents are filtered out of application logs.
Network access logs	365 days, for security. These include IP addresses and paths, not query strings or form contents.
Cloud audit logs	For security: administrative actions 3 years, and access to batch files 1 year. Both include IP addresses.
Encrypted backups	Daily database backups are kept 35 days, with a separate protected copy kept 1 year. Deleted data remains in backups until they expire, and we don't restore it except to recover the Service or to test recovery in an isolated environment that we delete afterwards.
Emails you send us	As long as needed to respond and keep business records

These periods cover our own systems. Results we return to a customer become part of its records: values we write into its CRM or other connected platform, files it downloads and results it copies are the customer's to keep or delete under its own policies, and we don't change or delete them later.

10. Security

We protect information with encryption in transit and at rest, application-level encryption of stored phone numbers and contact details, passwordless sign-in, access controls with security-key multi-factor authentication for our staff, monitoring and regular vulnerability scanning. Our security page has the details. No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.

11. Your privacy rights

Depending on where you live, including California, Colorado, Connecticut, Oregon, Texas, Virginia and other states, and to the extent those laws apply to us, you may have the right to:

• know what personal information we have collected about you, including its categories, sources, purposes and recipients, and get a copy of it;
• correct inaccurate personal information;
• delete personal information;
• opt out of the sale or sharing of personal information, targeted advertising and certain profiling (we don't do these); and
• appeal our decision on your request.

To make a request, email info@phonevalidator.com with the subject "Privacy request". To stop lookups of a phone number, use our privacy request form (Section 8). Account holders can also delete lookups and batches and close their account in their account settings. We will verify your request, usually by confirming control of the email address on the account, and respond within the time the law requires (generally 45 days). You may use an authorized agent, who must show us your signed permission. If we deny your request, you may appeal by replying to our decision, and we will respond within 45 days. If we deny your appeal, you may contact your state attorney general. We won't discriminate against you for exercising your rights.

Where we process data only as a service provider for a customer, we may refer your request to that customer and help it respond. Free lookups are run for businesses we can't identify and aren't tied to your identity, so we may be unable to find information about them or refer your request; we delete them after 7 days. We can still suppress your number as Section 8 describes.

California disclosures. To the extent the CCPA applies to us: in the past 12 months we collected identifiers (name, email address, IP address and phone numbers submitted for lookup); customer records and commercial information; internet or network activity; geolocation data (country from IP address, not precise location); professional information (company name); sensitive personal information (sign-in credentials); and inferences limited to fraud risk. We used them for the business purposes in Section 3. We disclosed identifiers, network activity and geolocation data to our hosting, security, analytics and error-monitoring providers; identifiers and commercial information to our payment processor; phone numbers to our telecommunications data provider; and identifiers and messages to our email provider, all for those purposes. We have not sold or shared personal information, and we have no actual knowledge of selling or sharing that of consumers under 16. We use sensitive personal information only to sign you in. California residents may also request information about disclosures to third parties for direct marketing ("Shine the Light"); we make none.

12. International users

We are based in the United States and store data there, as Section 5 describes. The Service is designed for businesses in the United States and Canada and is not directed to people in the European Economic Area, the United Kingdom or Switzerland. If you are elsewhere, your information will be processed in the United States, where privacy laws may differ from yours.

13. Changes to this policy

We will post any changes here with a new effective date. If we make a material change, we will tell account holders by email or in their account before it takes effect.

14. Contact us

Phone Validator LLC, 69 Santa Felicia Dr, Goleta, CA 93117, United States. Email info@phonevalidator.com or use our privacy request form.