This page is the engineering summary of how we handle the data you give us. The legal version lives in the Privacy Notice. If anything below conflicts with the legal version, the legal version wins.
What we commit to
- We don't sell your data. Not to advertisers, not to data brokers, not to anyone.
- We don't train models on it. Your phone numbers do not become training data.
- One sub-processor for validation. Phone numbers are sent to our validation sub-processor only to get the answer back, then their copy is cleared per their retention policy.
- Data is encrypted in transit and at rest. TLS everywhere; AES-256 on object storage; disk encryption on the database.
- You can delete everything. Account > Danger zone > Delete account. 30-day reversal window, then a hard purge that scrubs PII.
- You can export everything. Account > Export my data. Returns a single JSON of every row tied to your account.
What's where, for how long
| Data | Stored in | Retention | Encryption | Who can see |
|---|---|---|---|---|
| Account (email, hashed password, name) | Postgres | Until you close the account, then 30 days for reversal | TLS in transit; managed disk encryption at rest | You, our admins (audit-logged) |
| Uploaded CSVs | Object storage (S3-compatible, private bucket) | Deleted when the batch is deleted | TLS in transit; AES-256 at rest | You only, served via short-lived signed URLs |
| Cleaned result CSVs | Object storage (S3-compatible, private bucket) | Until you delete the batch or 90 days, whichever first | TLS in transit; AES-256 at rest | You only, served via short-lived signed URLs |
| Phone-number lookup cache | Postgres | 24 hours from last access (lets repeat lookups be free) | TLS in transit; managed disk encryption at rest | Aggregated across customers, no cross-customer disclosure |
| Validation request logs | Postgres | 90 days; phone numbers masked (first 4 + last 2 digits) | TLS in transit; managed disk encryption at rest | Our admins, masked-only |
| Billing records (Stripe customer, purchases, ledger) | Postgres + Stripe | 7 years (financial-record obligation) | TLS in transit; Stripe-side PCI; managed disk encryption | You, our admins (Stripe side: Stripe staff per their policy) |
| API + webhook secrets | Postgres | Until you revoke or the key expires | Stored only as SHA-256 hashes, we never see the plaintext | Nobody, even admins only ever see the prefix (first 8 chars) |
| Admin event audit log | Postgres | 1 year | TLS in transit; managed disk encryption at rest | Our admins (the log is for them, it's the trail) |
What we don't claim
Realism beats marketing copy:
- No SOC 2 / ISO 27001 yet. We follow the principle of least privilege internally and use mainstream encryption, but we haven't paid for the audit yet. We'll update this page when we do.
- No 100% uptime. We target 99.5% but make no SLA in v1. Watch our status page for live availability.
- No region pinning yet. We process in the United States and the United Kingdom. We'll add an EU-only region when a customer asks and signs a meaningful contract.
Sub-processors
We use the following sub-processors to deliver the service. The current list is also available on request:
- Stripe, payment processing. Sees billing data.
- Cloud hosting + object storage, sees encrypted data at rest and TLS-terminated traffic.
- Phone-validation sub-processor, receives normalized phone numbers to validate, returns line type + carrier. Identity available on request.
- Transactional email sub-processor, sees your email address and the subject + body of mail we send you (e.g. batch-completed notices).
When we add or change a sub-processor we update this page and (if you're on a paid plan) we email you.
Reporting a security issue
Email hello@phonelistcleaner.com with a clear description and (if you have it) a proof-of-concept. We acknowledge within 2 business days and aim to ship a fix or mitigation within 14 days. We don't run a public bounty programme, but we do credit responsible disclosure here on this page.