IBAN Analyzer Logo IBAN Analyzer

Terms of Service

Version 2026-11-04 · in force from 4 November 2026. Published in English; the English text is the authoritative one.

These terms govern your use of IBAN Analyzer - the website, the API, the browser extension and the Google Sheets add-on - which is operated by Arvital Soft d.o.o., Ulica Brune Bušića 20, Zagreb, Croatia ("we", "us", "our"). "You" is the person or company using the service.

1. Agreeing to these terms

You agree to these terms when you tick the box at sign-up, when you start or renew a paid plan, or by using the service. We record which version you accepted and when, so that both of us can tell later what was agreed.

2. What the service does

You give us an account number in IBAN form. We check its structure and its check digits arithmetically, read the country and bank code out of it, and return the reference details we hold for that bank - its name, BIC, and where published, its address. Where we hold nothing for a code, we say so.

3. Your account and your API key

Your API key identifies your account and everything done with it is treated as done by you. Keep it secret, do not embed it in a public website or app, and tell us at once if it is exposed so we can issue a new one. One account is for one business; sharing a key across organisations is not permitted.

4. Plans, payment and renewal

Paid plans are sold through Paddle, which acts as the merchant of record and as our authorised reseller. Your contract for the payment itself is therefore with Paddle, and their terms apply to it; these terms govern the service. Prices and allowances are those shown on our pricing page at the time you subscribe. Subscriptions renew automatically each month until cancelled, and you can cancel at any time from your billing page, with access running to the end of the period you have paid for.

5. Refunds

We offer a 14-day refund: if the service is not what you needed, write to [email protected] within 14 days of payment. The full policy is on the refund page. We do not refund where we have ended your access for a breach of section 9.

6. The data, and what we do not promise

We compile the bank reference data ourselves, from national bank registers, the SWIFT BIC directory and institutions' own published details. Every record is checked against one of those sources before it is published, we correct what we find wrong, and where a value cannot be confirmed we leave the record out rather than guess. That is the standard we hold ourselves to and we work hard at it.

We do not guarantee that the data is accurate, complete or up to date. Registers fall behind, banks merge, rename, move and are wound up, and a code that was right last month can be wrong today. The service and all data in it are provided "as is" and "as available", without warranty of any kind, whether express or implied, including any implied warranty of accuracy, completeness, merchantability, fitness for a particular purpose, or non-infringement. We do not promise that the service will be uninterrupted or error-free.

Do not use our answer as the only check before you send money. Confirm bank details against your own records, with the payee, or with your bank before making a payment. Deciding to pay is your decision, taken with whatever care your own business requires.

We take no responsibility, and accept no liability, for any loss arising from data that turns out to be inaccurate, incomplete or out of date - including a payment sent to the wrong bank or account, a payment delayed or returned, fees charged to you, or any claim made against you by someone else. This is subject only to section 11, which sets out the few liabilities that cannot lawfully be excluded.

We would rather hear about a wrong record than not: tell us at [email protected] and we will check it against the register and correct it.

7. What the service is not

The service tells you about a bank, derived from the bank code inside an account number. It does not confirm that an account exists, who holds it, whether they are who they say they are, or whether a payment will arrive.

It is not an identity verification, account ownership, confirmation of payee, sanctions screening, fraud prevention or anti-money-laundering service, and it must not be used as a control for any of those purposes. Nothing we return is legal, financial, tax or compliance advice. Where your own business is regulated, meeting those obligations remains yours alone, and nothing in these terms transfers any part of them to us.

8. How you may use the data

The bank reference data returned by the service - institution names, BICs, addresses and the codes they are keyed on - is a database compiled, verified and maintained by us. We assert the database right in it under Directive 96/9/EC and its implementations, together with any applicable copyright.

You may use the data to validate accounts, look up banks and process your own payments, including inside your own products. You may not:

  • extract or re-utilise a substantial part of the database, whether in one go or by repeated and systematic requests for smaller parts;
  • crawl, scrape or harvest the website, the API or the bank pages by any automated means other than the API under a current plan;
  • re-sell, redistribute, publish or sublicense the data, or make it available as a dataset, feed, lookup service or download to anyone else;
  • use the data, or any derivative of it, to build or improve a product that competes with this one, or to train a model on it;
  • store results beyond what your own use requires, or strip the attribution from data that carries it.

Caching the answers to your own lookups for your own operational use is fine and expected. Assembling them into a copy of our database is not.

9. Acceptable use, and what you promise us

You must not use the service to commit or assist fraud, money laundering, or any other crime, and you must not use it in a way that breaks the law that applies to you. By using it you promise us that:

  • you will use it only for lawful purposes;
  • your own business holds whatever licence, registration or authorisation it requires, in every country where it operates;
  • you have a lawful basis for any personal data you send us, and where it concerns other people, you have told them what they are entitled to be told;
  • neither you, nor anyone who controls you, nor anyone you are acting for, is subject to sanctions imposed by the European Union, the United Nations, the United Kingdom or the United States;
  • you will not attempt to overload, probe or circumvent the service, its rate limits or its quotas.

These promises are continuing: if one of them stops being true, you must stop using the service and tell us.

10. Indemnity

You will indemnify us against any claim, demand, loss, fine or penalty, and the reasonable legal costs of dealing with it, that arises from your breach of section 8 or section 9, from your use of the service, or from a claim by someone else about data you sent us or a payment you made.

11. Limitation of liability

Our total liability to you for all claims arising out of or relating to the service, in any twelve-month period, is limited to the fees you paid us in that period. On the free tier, where you have paid us nothing, that figure is nothing.

We are not liable for loss of profit, loss of revenue, loss of business or contracts, loss of goodwill, loss or corruption of data, or for any indirect or consequential loss, however it arises, even if we were told it was possible.

Nothing in these terms limits or excludes liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for anything else that the law does not allow to be limited or excluded. If you are using the service as a consumer rather than for your business, you keep the mandatory protections of the law of the country where you live, and nothing here takes them away.

12. Suspension and termination

You may stop using the service, and cancel a subscription, at any time. We may suspend or end your access immediately if you breach section 8 or section 9, if we have good reason to think the service is being used unlawfully, or if your use threatens the stability of the service for others. Where it is safe and lawful to do so we will tell you why and give you a chance to put it right. We may also withdraw the service itself on 30 days' notice, refunding the unused part of anything you have paid.

13. Personal data

How we handle personal data is described in our Privacy Policy. For the account you hold with us we are the controller. For the account numbers you send through the API, the extension or the add-on we act as your processor, and Annex A below is the data processing agreement required by Article 28 of the GDPR. You do not need to sign a separate one; it forms part of these terms.

14. Changes to these terms

We may change these terms. Each version carries a version number and a date, and the current one is always published here. When a change is material we will ask you to accept the new version the next time you sign in, and tell you by email where we can. Continuing to use the service after that counts as acceptance. A change never applies backwards to something that has already happened.

15. Governing law and disputes

These terms are governed by the law of the Republic of Croatia, and the courts of Zagreb have exclusive jurisdiction over any dispute - except that if you are a consumer, you may bring proceedings in the courts of the country where you live, and the mandatory law of that country continues to apply to you. If any part of these terms turns out to be unenforceable, the rest stays in force.

16. Contact

Arvital Soft d.o.o., Ulica Brune Bušića 20, Zagreb, Croatia · [email protected]

Annex A - Data Processing Agreement

This annex applies where you send us personal data - in practice, account numbers that belong to identifiable people - and it has effect as the agreement required by Article 28(3) of Regulation (EU) 2016/679 ("GDPR"). It forms part of the terms above and needs no separate signature.

A1. Roles

You are the controller of the data you send us and we are your processor for it. For the data in your own account - your name, email address, billing details and usage counts - we are the controller, and the Privacy Policy explains what we do with it.

A2. What we process, and why

  • Subject matter and purpose: resolving the account numbers you submit into bank reference details, and returning the answer to you.
  • Duration: the length of a single request. We do not retain the account numbers afterwards (A5).
  • Categories of data: the account numbers you submit, and nothing else. We do not ask for, and have no use for, names, addresses, amounts or anything about a payment.
  • Categories of data subject: whoever those accounts belong to - typically your customers, suppliers or employees.
  • Special categories: none. Do not send us any.

A3. What we undertake

  • to process the data only to provide the service and on your instructions, which your use of the service constitutes, unless the law requires otherwise - in which case we will tell you first, where we are allowed to;
  • to keep it confidential, and to bind anyone with access to the same;
  • to keep the security measures described in A6;
  • to help you answer requests from data subjects, and to help you with impact assessments and consultations with your regulator, so far as the nature of the processing makes that possible;
  • to tell you without undue delay if there is a personal data breach affecting your data, with what we know about it;
  • to make available the information you need to show that this annex is being kept to, and to allow an audit of it, on reasonable notice and no more than once a year unless a regulator requires otherwise.

A4. Sub-processors

You give general authorisation for the sub-processors below. We will announce a change on this page at least 30 days before it takes effect; if you object on reasonable data protection grounds you may terminate and be refunded the unused part of your plan.

  • Supabase - authentication and database hosting, EU region. Holds your account, not the account numbers you look up.
  • Paddle - payments and invoicing, as merchant of record.
  • Sentry - error reporting, EU region. Account numbers are stripped from an error before it is sent: only the two-letter country and the length go, which is enough to reproduce a parsing bug and identifies no account.
  • Google Analytics - website usage, and only where you have accepted analytics cookies. Not used by the API.
  • Cloudflare - delivers and protects the website and API.

A5. Retention, and what we never store

An account number you send is held in memory for as long as it takes to answer the request, and is then gone. It is not written to our database, not written to our logs, and not sent to a third party. What we do keep is a count of requests against your account, for billing, and - when we cannot name a bank for a code - the country and the bank code portion alone, so we know which register to add next. Neither can be traced back to an account or a person.

A6. Security

All traffic is encrypted in transit with TLS; we accept no unencrypted connection. Account data is held in a managed PostgreSQL database in the European Union, encrypted at rest, with row-level security restricting each account to its own records. Administrative credentials are held server-side only and are never exposed to a browser, the extension or the add-on. Access is limited to the people who operate the service.

A7. Transfers outside the EEA

The database and error reporting are hosted in the European Union. Where a sub-processor processes data outside the EEA, it does so under the European Commission's standard contractual clauses or an adequacy decision.

A8. Your side of it

You decide what to send us and you are responsible for having a lawful basis for it, for telling the people concerned what they are entitled to know, and for not sending us more than the service needs - which is the account number and nothing else.

A9. End of the agreement

Because we do not retain the account numbers, there is nothing to return or delete at the end other than your account itself, which we delete on request and in any event within 30 days, keeping only what tax law requires us to keep about payments.

Version 2026-11-04 · 4 November 2026. Questions about anything on this page: [email protected].