Privacy policy

Last updated: 29 October 2026

1. Who we are

This policy explains how DILENS LTD, a private limited company registered in England and Wales under company number 17406070, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("we", "us"), processes personal data in connection with SignupVet and signupvet.com. Contact for all privacy matters: support@signupvet.com.

2. Two different roles

• Controller for the data of our customers and website visitors (sections 3 and 4).
• Processor for the data our customers send to the API to check their own signups (section 5). For that data, our customer is the controller and our Data Processing Addendum applies.

3. Website visitors

• We do not use analytics, advertising or tracking cookies.
• We count page views of our home page and blog per day, page and campaign label (the ref= part of a link we shared, for example ?ref=newsletter). This count does not use cookies and stores no IP address or other identifier, so it cannot be linked to you.
• The live demo processes the email, phone number and IP address you enter only to show the result. They are not stored. Your own IP address is held in memory for a short time to limit how often the demo can be used.
• Our hosting provider processes technical connection data (such as IP addresses) to deliver the website and keep it secure.
• If you open our address without "www" (signupvet.com), the redirect service redirect.pizza forwards you to www.signupvet.com. It processes technical connection data (such as your IP address) for this. We have switched off its visitor tracking.

4. Customers (account holders)

When you create an account and use SignupVet we process:

• Account data: email address, a one-way hash of your password and, if you signed up through one of our campaign links, its label (for example newsletter), so we know which channels work.
• Sessions: a strictly necessary login cookie. Sessions expire after 30 days.
• API keys: stored only as a one-way hash; the full key is shown to you once.
• Billing data: payments are handled by Stripe. We store your Stripe customer reference, plan, subscription status and purchased check packs. We never see or store full card numbers.
• Usage data: the number of checks per billing period, and the check logs described in section 5.
• Emails you send us and our replies.
• Emails we send you: account emails (for example email confirmation, password reset and a warning when 80% of your monthly checks are used) and up to three onboarding tips in your first two weeks, which you can stop with the unsubscribe link in each tip. We record which tips were sent.

Legal bases (UK GDPR / EU GDPR): performance of our contract with you (Art. 6(1)(b)), compliance with legal obligations such as bookkeeping (Art. 6(1)(c)), and our legitimate interest in running a secure, abuse-free service (Art. 6(1)(f)).

Retention: account data for as long as your account exists, and deleted after you ask us to close it. Invoices and payment records are kept as long as accounting law requires (in the UK generally six years).

5. Data checked through the API (on behalf of customers)

Customers send us the email address, phone number and/or IP address of people signing up to their products. We use this data only to compute a risk score and return it to that customer.

• Full email addresses, phone numbers and IP addresses are not stored in clear text. Logs keep masked values (e.g. m***@gmail.com, 178.197.224.x) and keyed one-way fingerprints, used to detect waves of fake signups within the same customer's account.
• Check logs are deleted automatically after 90 days.
• Customers on paid plans can keep their own block and allow lists. Email domains are stored as entered; email addresses, phone numbers and IP addresses only as masked values and keyed fingerprints. These entries stay until the customer removes them or closes the account.
• If a customer sets up a webhook, we send the result of blocked (and optionally reviewed) checks to the customer's own server or Slack channel, with email address, phone number and IP address masked.
• To check an email address we look up its domain in the public DNS. Checks run on our own servers and data sets; no paid third-party lookup service is currently used.
• Results are probabilities, not facts. Customers decide what to do with a score; we do not make decisions about the people being checked.

If you signed up to one of our customers' products and have questions about your data, please contact that company first. We will support them, and you can also write to us.

6. Service providers (subprocessors)

We use these providers, each bound by a data processing agreement:

7. International transfers

Some providers are located outside the UK, the EU or Switzerland, in particular in the United States. Where required, transfers are protected by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or rely on an adequacy decision (such as the UK-US data bridge or the EU-US Data Privacy Framework where the provider is certified).

8. Security

All connections use HTTPS. Passwords, API keys and session tokens are stored only as hashes. Data from checks is masked and fingerprinted as described above, and access to production systems is restricted.

9. Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on it. Write to support@signupvet.com. You can also complain to a supervisory authority, in the UK the Information Commissioner's Office (ico.org.uk), or the authority where you live or work.

10. Changes

We update this policy when our processing changes, for example before adding a new provider. The date at the top shows the latest version.