Privacy policy

What LookValid collects, why, and who else sees it.

This policy is about the LookValid website, API, MCP server, dashboard and free tools, run by LookValid ("we"), reachable at hello@lookvalid.com. It is written to match what the service does today.

1. What we collect

Account data

When you sign up we hold an account name and an account id. Sign-in (your email address and credentials) is handled by our authentication provider, Google Firebase Authentication. We store a hash and a short prefix of each API key, never the key itself.

Billing data

Card payments are processed by Stripe. We never see or store card numbers. We keep an append-only ledger of credit grants and charges for your account, with the product, amount and time.

Request logs

For every lookup request we write a log row with:

• the request id, your account id and the public id of the API key used;
• the product, how many credits were charged and the outcome (found, not found, invalid input, unavailable or an error);
• whether the result came from the cache, how long the request took and when it happened.

The log does not contain the phone number, email domain, IP address or URL you looked up. The same applies to lookups made through the MCP server. Operational logs of the servers (for example authentication failures and errors) are also kept for running and securing the service.

Cached results

So that repeats are free, we store the result of each completed lookup for your account for 7 days. A stored result is filed under a hash of your normalized input, and it can contain details that came from your input, for example a number in several formats or a domain. Another account never receives your stored result. After 7 days it is no longer served.

Uploaded lists

When you run a bulk job, we store the list you upload and its results so you can download them. Only your account can open them.

Website visitors and free tools

Like any website, our servers receive your IP address and browser details when you visit. We may use them to apply usage limits to the free tools and to block abuse. We have not added advertising or cross-site tracking.

Browser storage

We set no advertising cookies and run no analytics, pixels or tag managers. Your browser keeps only what the site needs: your light or dark choice, the storage that keeps you signed in, and the email address you typed until you open your sign-in link. If you choose Continue with Google, Google's own sign-in page sets its own cookies. A few free tools, such as the domain registration, DOT number and Bluesky profile tools, contact a public source straight from your browser, and that source sees the request and your IP address.

2. How we use it

• To run lookups, apply success billing and keep your balance correct.
• To show you usage in the dashboard and to answer support requests.
• To enforce rate limits, prevent abuse and keep the service secure.
• To meet legal, tax and accounting duties.

We do not sell personal data and we do not use your lookup requests to build marketing lists.

3. Data about other people

Lookups are about phone numbers, email domains, IP addresses and websites, which can relate to people. Results come from open datasets, public registries and public web pages, not from private accounts. Phone complaint counts come from U.S. government open data and are unverified reports. You are responsible for your reason to run each lookup and for following the acceptable use policy. If you are the subject of a result and want to raise a concern, write to hello@lookvalid.com.

4. Who we share it with

• Stripe, to take payments.
• Google Firebase, for sign-in.
• Hosting and infrastructure providers that run the website and API for us.
• Public sources contacted to answer a lookup, such as a domain registry's RDAP service or the website you asked us to read. These see the request our servers make, not your account.
• Authorities, where the law requires it.

5. Data sources and attribution

IP geolocation uses DB-IP Lite data (IP geolocation by DB-IP), licensed CC BY 4.0. Other results use the Tor Project exit list, public cloud provider IP ranges, community lists of disposable and free email domains, and FCC and FTC open data. Each result names its sources.

6. How long we keep it

• Cached results are served for 7 days and then removed by a regular cleanup.
• Uploaded lists and their results are deleted 30 days after a bulk job finishes, and 2 days after one is cancelled or fails.
• Account records and request logs are kept while your account exists, because billing and abuse checks need them, and are deleted when your account is deleted.
• The credit ledger and invoice records are kept after your account is deleted, without your name or email address, because they are our payment and tax records. The ledger is append-only by design.
• Server operational logs are kept for running and securing the service.

7. Your rights and how to use them

Whoever you are and wherever you live, you can ask us for:

• access to the personal data we hold about you;
• correction of anything that is wrong;
• deletion of your data; and
• a portable copy of your data.

California

If you live in California you have the right to know what personal information we collect and use, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of. We will not treat you differently for using any of these rights. An authorized agent can make a request for you; we may ask for proof that you gave them permission.

European Economic Area and United Kingdom

If you are in the EEA or the UK you have the rights of access, rectification, erasure, restriction of processing, portability, and objection. You can also complain to your local supervisory authority; in the UK that is the Information Commissioner's Office (ICO).

How to make a request

• Email hello@lookvalid.com from the address on your account. To delete your account, you can also use Request account deletion in Settings in the dashboard, which writes that email for you. You can revoke API keys yourself in the dashboard at any time.
• We confirm it is you by replying to that address, and we ask for no more than we need to do that.
• We answer within one month. California requests are answered within 45 days, and we can extend that where the law allows; if we do, we tell you why.
• A limited set of records has to stay: payment and tax records (the credit ledger and invoices) and security logs of the servers. We tell you which ones when we answer.

8. Security

API keys are stored only as hashes. Traffic to the API and the website uses HTTPS. No system is perfectly secure, so keep your own keys safe and tell us at once if one leaks.

9. Children

The service is for businesses and developers and is not directed to children under 16.

10. The Contact Finder Chrome extension

The LookValid Contact Finder extension finds the email addresses and phone numbers on a page you are viewing. It works only on the tab where you click its toolbar button, and it has no standing access to any site.

• What it reads. After you click the button, it reads that tab's visible text, links and contact attributes in your browser to build the list. The page text and the page address are never sent to us.
• Where results stay. The list for each tab is kept in your browser's memory only, and it is cleared when you navigate, close the tab or restart the browser. Copying a value and downloading the CSV happen on your device.
• Your API key. If you add one, it is stored in chrome.storage.local on your device, is never synced, and is sent only to LookValid as the credential for your own checks. After you save it, the popup shows only its last four characters.
• What it sends. Nothing is sent automatically. A single value goes to LookValid only when you press Check on it (or Check all, which sends the values one at a time). Scan site sends the site's hostname. There is no analytics and no advertising.
• What we do with it. We use the value to return the result you asked for and to apply usage limits and bill keyed checks. It is handled like any other lookup under this policy, and we do not sell it.

11. Changes

We will update this policy as the service changes and will announce material changes on this site and by email to account holders. The terms of service explain how the service is billed and used.