Privacy Notice

Vatline — EU VAT number validation API. Last updated: 7 September 2026.

Controller

Veltis IT, sole trader registered in France under SIRET 104 079 207 00015, 7 rue Michel Ange, 94370 Sucy-en-Brie, France.

What we process, and why

Vatline processes the VAT numbers you submit, together with the technical metadata of the request (source IP address, timestamp, response status). VAT numbers identify businesses, not individuals, and are published in a public register maintained by the member states.

One exception deserves to be stated plainly: for a sole trader whose business name is their own name, a VAT record can contain personal data. We therefore treat all cached records with the same discipline — short retention, no enrichment, no sharing.

The legal basis is the performance of the contract you enter into when you subscribe, and our legitimate interest in operating the service reliably and preventing abuse.

Retention

Validation results: cached up to 24 hours when valid, 15 minutes when invalid, for the sole purpose of reducing load on the upstream VIES service. Nothing is retained beyond that window.
Technical logs: kept short-term for security, abuse prevention and diagnostics.
We do not build profiles, we do not enrich the data with any other source, and we do not sell or share it.

Recipients

Your queries are forwarded to VIES, operated by the European Commission, which is the source of the validation. Subscription, billing and identity are handled by RapidAPI under their own privacy policy — we never receive your payment details. Hosting is on a server located in France.

Your rights

Under the GDPR you may request access to, rectification of, or erasure of personal data concerning you, object to processing, or lodge a complaint with the CNIL, the French supervisory authority. Given the retention periods above, most data will already have been deleted by the time a request reaches us. Contact us through the support channel on the RapidAPI listing.

Cookies

This site sets no cookies and runs no analytics or tracking scripts.