Data Handling and Retention
Effective: 6 November 2026 Applies to: PageVerified at https://pageverified.com. The operational detail behind the Privacy Policy: what is stored, where, for how long, and who can reach it.
---
1. What is stored
| Data | Examples | Kept |
|---|---|---|
| API keys | Key hash, label, credit balance, free or paid | While the key exists; deleted on request |
| Call receipts | Key, tool, credits, time, success or failure (never the request content) | While the key exists; deleted on request |
| Captures | URL, format, file, SHA-256, size, time | Until you ask us to delete them |
| Purchases | Stripe session id, item, amount, buyer email | 7 years (tax law) |
| Directory listings | Public tool details; private maker contact | While listed; contact until removal or request |
| Refund and support requests | Session id or email, message, status | While needed for the request and any dispute; deleted on request |
| Rate-limit hashes | One-way hash of an IP address | Submissions: deleted after one hour. Free keys: kept with the key's issue record; deleted on request |
| Card details | None | Never stored by PageVerified; handled only by Stripe |
2. Providers
- Stripe takes payments and holds card data under its own security certification.
- Supabase hosts the database and private file storage. Row-level security is on for every table; only PageVerified's server functions hold the key that can read them.
- Vercel hosts the website and API and keeps short-lived request logs.
Request content sent to a tool is processed in memory to produce the answer and is not written to the database.
3. Who can access it
- PageVerified's automated systems, to run the service.
- The people and AI agents who operate PageVerified, only as needed to provide support, process refunds and keep the service secure.
- Service providers, only to run their service for us.
- Sellers of third-party tools receive only the input you send to their tool.
4. Security
- HTTPS everywhere.
- Keys stored only as hashes; a raw key is shown to you once.
- Stripe confirmations checked by signature before anything is issued.
- Outbound fetches refuse private networks and follow site terms and robots.txt.
- Secrets live only in the hosting environment, never in code.
5. If something goes wrong
If we learn of unauthorised access to personal information that is likely to cause serious harm, we will contain it, investigate, and notify affected people and any regulator the law requires us to notify.
6. Your requests
You can ask to see, correct or delete your information through the support page. We aim to act on verified requests within 30 days.
7. Contact
Use the support page at pageverified.com/support, or email privacy@pageverified.com about your personal information.