Privacy Policy
Last updated: 4 November 2026.
This policy covers the IBAN Analyzer website, API, browser extension and Google Sheets add-on, operated by Arvital Soft d.o.o., Ulica Brune Bušića 20, Zagreb, Croatia.
1. Information we collect
We collect personal data you provide directly during signup: your name, email address, and billing information. We also collect usage data for analytics and security, such as request counts and error reports.
When you look up an IBAN, the IBAN itself is sent to our servers so we can resolve the bank behind it. Looking up an IBAN on the website or in the browser extension requires no account, and we do not attach those lookups to an identity.
When you accept our Terms of Service, we record which version you accepted, when, and the IP address and browser the acceptance came from. We keep that record for as long as you hold an account and for as long afterwards as a claim could be brought, because its whole purpose is to show what was agreed.
2. How we use your information
We use your data to provide and maintain the service, process payments, improve performance, and communicate with you. We do not sell your personal data to third parties.
3. Cookies and analytics
We use cookies and analytics tools to understand user behaviour, diagnose issues, and improve the experience. You may disable cookies in your browser settings, and the cookie policy says what each one is for.
4. Who else processes it
We share data with a small number of processors only where necessary to run the service: Supabase (authentication and database hosting, EU region), Paddle (payments and invoicing), Cloudflare (delivering and protecting the site), Google Analytics (website usage), and Sentry (error reporting, EU region). Payment card details are handled entirely by Paddle and never reach our servers. We do not sell or rent personal data, and we do not share it for advertising.
5. How we protect your data
In transit. All traffic to our website, API, browser extension and Sheets add-on is encrypted with TLS (HTTPS). We do not accept unencrypted connections, and the Sheets add-on and extension communicate with our API over HTTPS only.
At rest. Account data, API keys and subscription records are stored in a managed PostgreSQL database hosted by Supabase in the European Union, encrypted at rest by the platform. Backups are encrypted by the same platform.
Access control. Row-level security restricts each account to its own records. Administrative credentials are held server-side only, are never exposed to the browser, the extension or the add-on, and are limited to the people who operate the service. API keys are transmitted only over HTTPS; in the Sheets add-on your key is held in Apps Script user properties, which are private to your Google account and are not readable by anyone you share the spreadsheet with.
Minimisation. The only content that leaves your device for a lookup is the IBAN being checked. We do not transmit or store the surrounding document, page, spreadsheet or email. An account number is held in memory only for as long as it takes to answer the request: it is not written to our database and not written to our logs. Before an error report is sent to Sentry the account number is removed from it, leaving the two-letter country code and the length - enough to reproduce a parsing bug, and not enough to identify an account.
6. Google user data
The IBAN Analyzer Google Sheets add-on requests three scopes:
spreadsheets.currentonly, which grants access only to the single
spreadsheet the add-on is open in and never to any other file in your Google Drive;
script.external_request, to send the IBANs you select to our API; and
script.container.ui, to display the add-on's sidebar.
Spreadsheet content is read in order to find the IBANs you have selected, and the results are written back into the sheet. Spreadsheet content is not stored on our servers, not logged, and not retained after the request completes. Only the IBAN strings themselves are transmitted, and they are processed to return bank reference data.
Limited Use. IBAN Analyzer's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models. We do not transfer Google user data to any third party for that purpose, and we do not sell Google user data.
7. Retention and deletion
Account data is retained for as long as the account exists, and billing records for as long as tax law requires us to keep them. Spreadsheet and page content is not retained at all, and neither are the account numbers you look up. What we keep about usage is a count of requests against your account, and - when we cannot name a bank for a code - the country and bank code portion on its own, so we know which register to add next; neither can be traced back to a person.
You may delete your account and its associated data at any time by writing to [email protected]. We action deletion requests within 30 days.
8. Controller, processor, and business customers
For your own account data we are the controller. For the account numbers you send through the API, the extension or the add-on we act as your processor, and the data processing agreement required by Article 28 of the GDPR is Annex A of our Terms. You do not need to sign a separate one.
9. Your rights
Under the GDPR you have the right to access, correct, or delete your personal data, to object to certain processing, and to request data portability. You also have the right to complain to your national data protection authority.
10. Contact
For privacy questions or data requests, contact [email protected].