Privacy Policy

1. Overview

Verifence is a pre-send decision API for SMS verification. This policy explains what we collect, why, and how we handle it. Privacy is built into the product: by design we store as little as possible, and nothing personal in the clear.

2. Data you send to the API

When you call /v1/check you send an end user's phone number and IP address. We use these only to make the allow/deny decision, and we do not retain them in the clear:

• Phone numbers are hashed before they are ever used as a counter key. A dump of our store yields no phone numbers.
• IP addresses are truncated to a network (a /24 or /48) for the reputation signal and used transiently for velocity limiting. Full addresses are not stored.
• We store no message content — we never see the verification code or the message body.

You are the controller of the end-user data you submit and are responsible for having a lawful basis to submit it. Optional logging features, where you enable them, are tenant-isolated and subject to the retention you configure.

3. Account data

To run your account we store your name, email, hashed password, team and membership records, API key hashes (never the raw keys), your configured settings, and aggregate usage counters. Payment details are handled by our payment processor — we never see or store card numbers.

4. Cookies

We use strictly necessary cookies for authentication and session security (including CSRF protection). A local preference (such as light/dark theme) may be stored in your browser. We do not use advertising cookies.

5. Processors we rely on

• Stripe — subscription billing and payment processing.
• Hosting & infrastructure — the servers and cache that run the service.

These processors handle data on our behalf under their own security and privacy commitments.

6. Retention

Hashed counters and network reputation records expire automatically after a rolling idle window. Aggregate stats are kept for reporting. Account records are kept for the life of your account and deleted on request, subject to legal retention requirements.

7. Your rights

Depending on your jurisdiction you may have rights to access, correct, export, or delete your personal data. Contact us using your account contact address and we will respond within the timeframes required by applicable law.

8. Changes

We may update this policy from time to time. Material changes will be communicated through the service or by email.

9. Contact

Privacy questions can be sent to your account contact address on file.