IBANforge privacy & data

IBANs submitted for validation

Email address (free key signup)

Request metadata (path, status, latency, timestamp, pseudonymised IP, user-agent, key prefix)

Payment data Processing card or USDC payments

For sales and support, IBANforge keeps a lightweight record of business contacts: name, role, professional email address, company

Validation and enrichment (performance of the service)

Producing the annotated report you order (performance of the service)

Issuing your key, quota notifications, service messages, and at most one note from the founder asking whether the key is useful.

Abuse prevention, capacity planning, the public status page

For sales and support, IBANforge keeps a lightweight record of business contacts

Processed in memory, never written to storage.

It is kept 2 hours if unpaid and 24 hours after payment , then automatically deleted.

Yes, 12 months maximum , then automatically deleted.

Yes, 7 days , then deleted by Railway.

backups that still hold it age out within 90 days.

which keeps 30 days of copies

we keep it for ten years, as Swiss accounting law requires.

Correspondence is kept for the duration of the business relationship

The API and its databases run on Railway infrastructure in the Amsterdam, Netherlands region (EU)

The website and the dashboard run on a virtual server in Infomaniak's public cloud in Switzerland

for US processors certified under them, the EU-US and Swiss-US Data Privacy Framework

standard contractual clauses maintained by the processor

Section 3 lists the processors and where they operate

this policy and the DPA apply regardless of where you are

Write to support@ibanforge.com — we answer within 30 days.

Under the FADP/GDPR you can request access, rectification, deletion, restriction, or a copy of your data, and object to processing.

If you are in the EU/EEA you may lodge a complaint with your supervisory authority; in Switzerland, with the FDPIC.