Privacy Policy

This policy explains how MobileValidate LLC, a limited liability company registered in the United States (operating office: 5th floor, Minkara Building, Clemenceau Street, Beirut, Lebanon) ("we", "us") handles personal data in connection with MobileValidate: data about our business customers and their users, people who ask for access, website and chat visitors, and the phone numbers and e-mail addresses that customers submit for checking.

Who is responsible for which data?

The data-subject notice explains what this means for people whose number or e-mail address is checked. The Data Processing Agreement sets out our processor terms with customers.

What data do we collect, and why?

We store API keys only as keyed hashes; they are shown once, when created. Logs never contain full phone numbers or e-mail addresses. Numbers are masked, for example +44770*****01, and so are e-mail addresses, for example re•••@example.com.

On what legal bases do we rely?

For data where we are the controller, we rely on:

• Contract: to set up and run accounts, bill for use and give support (Art. 6(1)(b) GDPR).
• Legitimate interests (Art. 6(1)(f) GDPR): security, fraud and abuse prevention, sanctions screening beyond what the law strictly requires, improving the service, measuring the website, answering enquiries and chats, sending service and onboarding e-mails to business contacts, defending legal claims, and operating our spam-reputation dataset and suppression list to protect people and businesses from spam and fraud. We have weighed these interests against your rights and keep the data minimal, masked and short-lived. You can object at any time (see below).
• For Platform Rights Center requests, our legitimate interests in handling rights claims about our service, keeping a record of them and defending legal claims.
• Legal obligation (Art. 6(1)(c) GDPR): accounting and tax records, sanctions compliance, and responding to lawful requests from authorities.

For data that customers submit for checking, the customer is responsible for having a legal basis; we process it only on the customer's instructions.

How do we measure the website?

We count visits with our own small script. No third-party analytics or advertising service is involved, and nothing is shared with anyone.

• Session ID: when you open the site, your browser tab gets a random ID in its session storage. It is not a cookie. It is deleted when you close the tab, and a new tab gets a new ID. We don't link it to your IP address or your device.
• What is sent: the page path (without any query string), the time, and which of these you clicked: "Get a test key", "Request access", links to pricing, the copy button on code samples, and the submit buttons of our forms. On the first page of a visit we also record the referring website's domain (for example www.google.com, not the full address) and any utm_ campaign tags in the link.
• What is never recorded with these events: your IP address, browser or device details, screen size, precise location, form contents, or anything that could fingerprint your browser. Campaign tags that look like an e-mail address or a phone number are dropped.
• When you ask for a test key or for access: the form sends the tab's session ID with your request, so we can see which page and which kind of source (search, AI assistant, social, another website, direct) led to it. We store that page, source, referring domain and campaign tags with the request, and use them only as totals, for example "test keys per landing page". The ID is never required, and it is not sent when your browser signals Do Not Track or Global Privacy Control.
• Do Not Track and Global Privacy Control: if your browser sends either signal, the script sends nothing at all, and our server discards any event that arrives with one of these signals.
• Retention: individual events, and the page and source stored with a test key or access request, are deleted after 90 days. We keep only daily totals.

How does the website chat work?

When the chat is switched on, a chat button appears on the website and in the customer dashboard. It is labelled MobileValidate Assistant (AI): the first answers come from an AI model, and a person from our team can read the conversation and take it over at any time.

• What is stored: your messages and the replies, encrypted, together with the page you opened the chat on. On the website a random chat ID is kept in your browser's local storage (not a cookie) so the conversation survives a page change, a new tab or a return visit; it is removed after 14 days without activity or when the chat is gone, and you can delete it by clearing site data. We keep a keyed hash of your network address (not the address itself) to limit abuse, and a human check (Cloudflare Turnstile) runs before the first message.
• Who sees it: our staff, and the AI model provider that writes the draft replies. Before a message reaches the model we remove things that look like keys or passwords and shorten phone numbers and e-mail addresses. On the website the assistant has no access to any customer account. In the dashboard it can read only your own organisation's balance, recent API errors and jobs.
• Support e-mail: we may also use AI tools, under our staff's supervision, to sort and draft replies to messages sent to our mailboxes.
• No automated decisions: we do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
• Please don't share passwords, API keys or personal data about other people in the chat.

How long do we keep it?

Who receives it?

We do not sell personal data and do not use it for advertising. We share it only with:

• Service providers that act for us under written agreements, in these categories: hosting and infrastructure (including network security), storage and backups, e-mail delivery and filtering, payments, the AI model provider for the chat, and data-verification partners that carry out the checks customers request. Depending on the arrangement and the applicable law, these providers act as our processors or sub-processors, or, where they decide the purposes of their own processing, as independent controllers. We publish the categories. We give the identities, roles, processing locations and changes of these providers to customers, authorities and other persons where the law or the Data Processing Agreement requires it, under confidentiality where permitted. Partners that carry out checks receive only what a check needs (the identifier and the type of check), never account details.
• Our affiliates (companies under common ownership or control with us) that help us operate the service, under the same safeguards.
• Authorities, courts and advisers, where the law requires it or to establish, exercise or defend legal claims, and parties affected by abuse of the service, as described in the Acceptable Use Policy.
• Platforms and their representatives that make a request through our Platform Rights Center, only to the extent needed to answer the request and as the law allows. We do not tell a platform which customers checked an identifier unless the law or a binding legal process requires it, or where it is needed to stop abuse as the Acceptable Use Policy describes.
• A buyer or successor in a merger, acquisition or sale of assets, under confidentiality.

How is data transferred internationally?

Our main servers are in the European Union. We, our affiliates and some service providers operate from or are located in other countries, including the United States and Lebanon, which may not offer the same level of protection as your own country. Where personal data protected by EU, UK or Swiss law is transferred to a country without an adequacy decision, we use:

• the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 2 (controller to processor) or Module 3 (processor to processor) as applicable, and Module 1 where we transfer data as a controller to another controller;
• for the UK, the International Data Transfer Addendum issued by the Information Commissioner under section 119A of the Data Protection Act 2018;
• for Switzerland, the same clauses with the amendments required by the Swiss Federal Act on Data Protection (FADP);
• or an adequacy decision, or another mechanism the law allows.

We add supplementary measures where needed, in particular encryption in transit and at rest, sealing of identifiers and masking. You can ask for a copy of the relevant safeguards through the contact below.

How do we protect it?

Identifiers are sealed (encrypted) as soon as they are stored and matched through keyed hashes, logs hold masked identifiers only, API keys are stored as keyed hashes, traffic is encrypted with TLS, staff access requires strong authentication and is audited, and data is deleted on short default schedules. The Trust page describes these controls. No system is perfectly secure; if a breach affects you, we will notify you and the authorities where the law requires.

What are your rights?

Depending on where you live, you may have the right to:

• access your personal data and get a copy;
• have it corrected or deleted;
• restrict its use or object to it, including at any time to processing based on legitimate interests and to direct marketing;
• receive it in a portable format;
• withdraw consent, where we rely on consent;
• complain to a data-protection supervisory authority, in particular in the country where you live or work or where an alleged infringement took place.

How to exercise them: e-mail support@mobilevalidate.com with "Privacy" in the subject line, or, if your phone number or e-mail address was checked, use the opt-out form. We answer within one month (extendable by two months for complex requests, as the GDPR allows), or within the period your local law sets. We may ask for information to confirm your identity or that you control the number or address concerned. Where we process the data as a processor, we will pass your request to the customer concerned and help them answer it.

US state privacy rights. Residents of California and other US states with privacy laws may request to know, access, correct or delete personal information, and may appeal a refusal by replying to our decision. You may use an authorised agent. We will not discriminate against you for exercising these rights. We do not sell or share personal information of customers, account users or website visitors, as "sell" and "share" are defined in the California Consumer Privacy Act, and we do not use or disclose sensitive personal information for purposes that would give a right to limit it. For data customers submit for checking, we act as their service provider: we process it only to perform the services, do not sell or share it, do not retain, use or disclose it outside our direct business relationship with the customer, and do not combine it with other data except as the law permits.

Lebanon. Where Lebanese Law No. 81 of 2018 on Electronic Transactions and Personal Data applies, you have the rights it grants, including to be informed, to access, to correct and to have data deleted or to object.

United Arab Emirates. Where the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies, you have the rights it grants, including access, correction, erasure, restriction, objection and portability.

Representative and data protection officer

Requests intended for a representative under Article 27 of the GDPR or the UK GDPR can be sent to the privacy contact above; where we are required to designate a representative, we give its details on request through the same address. We have not designated a data protection officer; the privacy contact above handles all data-protection matters.

Children

The service is for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 16 through the website, forms or chat. If you believe we have, contact us and we will delete it.

Changes and contact

We will update this policy when our practices change and show the date at the top. For significant changes we will also notify customers by e-mail or in the dashboard.

Controller: MobileValidate LLC, a limited liability company registered in the United States (operating office: 5th floor, Minkara Building, Clemenceau Street, Beirut, Lebanon). Privacy contact: support@mobilevalidate.com (subject "Privacy"). Security reports: security@mobilevalidate.com.