Privacy Policy
What we collect, why, who sees it, and how to have it deleted.
Last updated: November 5, 2026
We collect what we need to run checks, bill for them and keep the service secure, and nothing to sell. We never sell personal information or show anyone a risk score. Customers can close their account at any time, and anyone whose contact details were checked can ask us to delete what we hold.
1. Who we are and what this covers
ContactValidate is operated by The Big Fat Dad LLC, a Delaware limited liability company (“ContactValidate,” “we,” “us”). This Privacy Policy explains what personal information we collect, why, who we share it with, and the choices you have.
It applies to:
- our website at contactvalidate.com;
- the ContactValidate web app at app.contactvalidate.com;
- the ContactValidate API and our MCP connector for AI assistants such as Claude and ChatGPT.
It does not apply to any third-party website or service we link to, each of which has its own privacy practices.
2. Important: ContactValidate is not a consumer reporting agency
ContactValidate is not a consumer reporting agency, and a check result is not a consumer report or an investigative consumer report under the federal Fair Credit Reporting Act (FCRA), 15 U.S.C. §1681 et seq., or any equivalent state law.
We validate contact details only. We do not collect or provide criminal records, credit history, employment history, rental history or education records, and we do not score or evaluate anyone.
You may not use ContactValidate, in whole or in part, as a factor in deciding a person’s eligibility for employment, housing, credit or insurance, or for any other purpose regulated by the FCRA. Doing so violates our Terms of Use and may violate federal law.
3. The two groups of people this policy covers
Customers
People and businesses who create a ContactValidate account, use the API, or connect an AI assistant. You give us your information directly and control it through your account.
People whose contact details are checked
People whose name, email address, phone number or mailing address a customer submits for validation. If that is you, you did not give us your information directly, so we describe separately, in Section 6 and Section 9, what we hold and how to have it deleted.
4. Information we collect
Information customers give us
- Account information: your email address, your name if you provide one, and an authentication identifier. Sign-in is handled by Google Firebase Authentication. If you sign in with Google, we receive your email address and basic profile from Google; we never receive your Google password.
- Contact details submitted for checks: the names, email addresses, phone numbers and mailing addresses you send us to validate.
- Credentials and connections: the API keys you create and the AI assistants you connect. Keys and connection tokens are stored only as one-way hashes.
- Billing information: your credit balance and a ledger of charges, refunds and credits added. If you buy credits, payment is processed by Stripe; card numbers are entered directly with Stripe and never reach our servers.
- Messages you send us: the contents of any email or support request.
Information we generate
- Check results: the verdicts, standardized values and first and last seen dates produced for each check, and the record of each check you ran.
- Provider responses: the full response our identity data provider returns for each check (see Section 6), stored with one-way hashes of the submitted values so it can be found and deleted on request.
- Usage records: request counts used for rate limits, and timestamps.
Information collected automatically
- Device and log data: IP address, browser and device type, and the requests made to our servers.
- Abuse prevention: the web app uses Google reCAPTCHA Enterprise, through Firebase App Check, which evaluates browser and device signals to tell people from automated traffic.
The marketing website at contactvalidate.com sets no cookies and runs no analytics.
5. How we use information
| Purpose | What this means in practice |
|---|---|
| Provide the service | Run checks, return results, keep your history, and manage your keys and connections. |
| Credits and billing | Charge and refund credits, process purchases through Stripe, and keep the ledger. |
| Support and service messages | Answer your questions and send account email: verification links, security notices and notices of changes to these policies. |
| Security and abuse prevention | Enforce rate limits, detect misuse, and keep an audit record of what each check returned and cost. |
| Aggregate statistics | Produce de-identified, aggregated figures, for example how quickly contact lists go out of date, that never identify a person or a customer. |
| Legal | Comply with law, enforce our terms, and establish or defend legal claims. |
We do not use contact details submitted for checks to build marketing profiles, and we do not sell them.
6. The identity data behind a check
ContactValidate does not maintain its own database of the general public. To run a check, we pass the submitted details to a third-party identity data provider, which matches them against identity data built from online activity and returns, value by value, which identity each one belongs to and when that identity was first and last seen.
The provider’s response also contains signals we do not use in the product, such as risk indicators. We store them with the rest of the response on our own servers, where only a small number of authorized staff can access them. We never show them to customers, and we never use them to score or make decisions about anyone.
If a check concerned you, you can ask us to delete what we hold about it; see Section 9. Deleting our copy does not remove your information from the provider’s own data, which we do not control; on request we will tell you how to contact the provider.
7. Who we share information with
We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act. We disclose information only to the service providers below, each bound by contract to use it solely to provide services to us:
| Provider | What it handles |
|---|---|
| Google Cloud and Firebase | Hosting, database, data warehouse, authentication, logging, and reCAPTCHA Enterprise |
| Our identity data provider | Matching submitted contact details to identities |
| Stripe | Payment processing, when you buy credits |
| Microsoft 365 | Email we send and receive |
AI assistants you connect. If you connect an assistant such as Claude or ChatGPT, the results of checks you run through it are returned to that assistant, and its provider handles them under your agreement with that provider.
We may also disclose information:
- when required by law, subpoena or other valid legal process, or to protect the rights, safety or property of ContactValidate, our customers or the public;
- in connection with a merger, acquisition, financing or sale of assets, in which case we will notify you before your information becomes subject to a different privacy policy;
- at your direction or with your consent.
8. Cookies and similar technologies
The marketing website sets no cookies. The web app uses only what it needs to work: browser storage that keeps you signed in, and the cookies and device signals reCAPTCHA Enterprise uses to block automated abuse. We do not use advertising cookies or third-party analytics.
Global Privacy Control. Because we do not sell personal information or use it for targeted advertising, there is nothing for a Global Privacy Control signal to opt you out of; we honor it all the same if we ever add analytics. Browsers also send a legacy Do Not Track signal that has no agreed standard.
9. Your choices and how to opt out
Email from us
Any product or marketing email we send will contain an unsubscribe link, and you can also email support@contactvalidate.com with the subject line UNSUBSCRIBE. Account email, such as verification links, security notices and notices of changes to these policies, is part of the service; to stop it, close your account.
Closing your account
Email support@contactvalidate.com from the address on your account. We will delete your account, your check history and stored results, your keys and your connections. We keep the billing ledger for as long as tax and accounting law requires.
If your contact details were checked
Email privacy@contactvalidate.com with the subject line DELETE MY DATA and include the email address or phone number concerned. We will:
- verify that you control that email address or phone number, so that one person cannot delete another person’s records;
- delete stored check results and provider responses that contain it;
- tell you how to contact our identity data provider about the records it holds, which we do not control.
We respond within 45 days and charge nothing. More on the opt-out page.
10. Your privacy rights
Depending on where you live, you may have some or all of the following rights: to know what personal information we hold and how we use it; to access a copy of it; to correct inaccurate information; to delete it; to opt out of sale, sharing or targeted advertising (we do none of these); to limit the use of sensitive personal information; to portability; and to non-discrimination for exercising any of them.
California residents hold these rights under the CCPA as amended by the CPRA. Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws hold substantially similar rights, including the right to appeal a denied request. Residents of the EEA, UK and Switzerland hold rights under the GDPR, including the right to object to processing, to withdraw consent, and to lodge a complaint with a supervisory authority.
Where the GDPR applies, our legal bases for processing are contract (providing the service), legitimate interests (security, abuse prevention and record keeping), consent (marketing email, where required) and legal obligation.
To exercise any right, email privacy@contactvalidate.com. We will verify your identity before acting, usually by confirming control of the email address or phone number concerned, and respond within 45 days, extendable once where the law allows. You may use an authorized agent where the law permits.
11. How long we keep information
- Account information: while your account is open, then deleted when you close it.
- Check results and history: until you close your account, or until the person concerned has them deleted.
- Provider responses: kept without a fixed expiry, as the record of what each check returned and cost, until the person concerned asks us to delete them.
- Billing ledger: as long as tax and accounting law requires, typically seven years, even after the account is closed.
- Server logs: 30 days. Logs record request identifiers, never the contact details you submit.
- Rate-limit records: expire within two days.
We may keep information longer where necessary to comply with a legal obligation, resolve a dispute or enforce our agreements.
12. Security
We encrypt data in transit with TLS and at rest. Access to production systems is restricted and authenticated, and stored provider responses are readable only by project owners. API keys and connection tokens are stored only as SHA-256 hashes: we cannot recover a key after it is issued, which is why a new key is shown exactly once. Card numbers never touch our infrastructure.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by law.
13. Children
ContactValidate is a business service and is not directed to children. You must be at least 18 years old to create an account. We do not knowingly collect personal information from anyone under 18 through our website or web app. If you believe a child has provided us information, email privacy@contactvalidate.com and we will delete it.
14. International users
We operate in the United States, and our service providers process data there. If you use ContactValidate from outside the United States, your information will be transferred to, stored in and processed in the United States, where privacy laws may differ from those in your country. Where required for transfers out of the EEA, UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses.
15. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. If the changes are material, we will give customers notice by email or through the service before they take effect.
16. Contact us
For any privacy question, request or complaint, including deletion requests:
The Big Fat Dad LLC
Privacy: privacy@contactvalidate.com
Support: support@contactvalidate.com
The Big Fat Dad LLC is the data controller for the purposes of the GDPR.