How do I validate an IBAN via API?

Send a POST request to /api/analyze with your IBAN in the JSON body and your API key in the x-api-key header. The response includes validation status, bank name, SWIFT code, and country.

Which countries does the IBAN Analyzer API support?

The API supports IBAN validation and bank lookup for over 90 countries, including all SEPA member states and many countries across the Middle East, Africa, and Latin America.

Is the IBAN Analyzer API free to use?

Yes, a free tier is available with generous request limits. Paid plans offer higher quotas for production workloads. See the pricing page for details.

Privacy Policy

This policy covers the IBAN Analyzer website, API, browser extension and Google Sheets add-on, operated by Arvital Soft d.o.o., Ulica Brune Bušića 20, Zagreb, Croatia.

1. Information We Collect

We collect personal data you provide directly during signup: your name, email address, and billing information. We also collect usage data for analytics and security, such as request counts and error reports.

When you look up an IBAN, the IBAN itself is sent to our servers so we can resolve the bank behind it. Looking up an IBAN on the website or in the browser extension requires no account, and we do not attach those lookups to an identity.

2. How We Use Your Information

We use your data to provide and maintain the service, process payments, improve performance, and communicate with you. We do not sell your personal data to third parties.

3. Cookies and Analytics

We use cookies and analytics tools to understand user behaviour, diagnose issues, and improve the experience. You may disable cookies in your browser settings.

4. Data Sharing

We share data with a small number of processors only where necessary to run the service: Supabase (authentication and database hosting, EU region), Paddle (payments and invoicing), Google Analytics (website usage), and Sentry (error reporting). Payment card details are handled entirely by Paddle and never reach our servers. We do not sell or rent personal data, and we do not share it for advertising.

5. How We Protect Your Data

In transit. All traffic to our website, API, browser extension and Sheets add-on is encrypted with TLS (HTTPS). We do not accept unencrypted connections, and the Sheets add-on and extension communicate with our API over HTTPS only.

At rest. Account data, API keys and subscription records are stored in a managed PostgreSQL database hosted by Supabase in the European Union, encrypted at rest by the platform. Backups are encrypted by the same platform.

Access control. Row-level security restricts each account to its own records. Administrative credentials are held server-side only, are never exposed to the browser, the extension or the add-on, and are limited to the people who operate the service. API keys are transmitted only over HTTPS; in the Sheets add-on your key is held in Apps Script user properties, which are private to your Google account and are not readable by anyone you share the spreadsheet with.

Minimisation. The only content that leaves your device for a lookup is the IBAN being checked. We do not transmit or store the surrounding document, page, spreadsheet or email.

6. Google User Data

The IBAN Analyzer Google Sheets add-on requests three scopes: spreadsheets.currentonly, which grants access only to the single spreadsheet the add-on is open in and never to any other file in your Google Drive; script.external_request, to send the IBANs you select to our API; and script.container.ui, to display the add-on's sidebar.

Spreadsheet content is read in order to find the IBANs you have selected, and the results are written back into the sheet. Spreadsheet content is not stored on our servers, not logged, and not retained after the request completes. Only the IBAN strings themselves are transmitted, and they are processed to return bank reference data.

Limited Use. IBAN Analyzer's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models. We do not transfer Google user data to any third party for that purpose, and we do not sell Google user data.

7. Data Retention and Deletion

Account data is retained for as long as the account exists, and billing records for as long as tax law requires us to keep them. Spreadsheet and page content is not retained at all. IBAN lookups are cached briefly to avoid repeating identical requests, and are not linked to an identity.

You may delete your account and its associated data at any time by writing to [email protected]. We action deletion requests within 30 days.

8. Your Rights

Under the GDPR you have the right to access, correct, or delete your personal data, to object to certain processing, and to request data portability. You also have the right to complain to your national data protection authority.

9. Contact

For privacy questions or data requests, contact [email protected].

Last updated: 31 August 2026