Privacy notice

Last updated 11 November 2026 · Version 2.0

Last updated:

1. Controller

Giacomo Sibilia
Via Rosmini 15
28041 Arona (NO)
Italy
Email: giacomo.sibilia@aether-layer.com

You can also reach us through the contact form on this website.

2. Website, hosting and server logs

The website and the API are hosted by Vercel Inc. (USA). For each request Vercel processes the technically necessary logs: date and time, the address requested, browser and operating system, and the IP address. They are used to provide the website, keep it stable and secure, and investigate faults (Art. 6(1)(f) GDPR, legitimate interest in secure operation).

On the Vercel plan in use, runtime logs remain available to us for 1 hour. Vercel may keep log data longer for the security of its platform, under its own privacy notice.

Static pages are served from Vercel's delivery network, from the location closest to the visitor.

3. Contact form

We process what you submit through the form to review your request and reply:

• required: name, email address, company or product, product or documentation URL;
• optional: role, subject and notes;
• in addition: the page language and the fact that the request came through the form.

An invisible field deters automated submissions; if it is filled in, the submission is not stored.

To limit submissions (at most 8 per hour per sender) we compute a SHA-256 hash of the IP address with a secret server value. The raw IP is not stored. The hash is stored only in the abuse counter, not in the request. The counter expires 48 hours after the last submission and the daily clean-up job deletes it within the following 25 hours, so the hash is kept for at most 73 hours (longer only if the clean-up is behind, see section 6). Requests stored before this update also contained the hash: we delete it with a one-off migration right after the update.

Where: Google Cloud Firestore (Firebase), (default) database in the European multi-region location eur3. The data is stored in the EU. The form does not send the data by email.

How long: 12 months after submission, then deleted automatically (see section 6). If you become a customer, the data needed for the contract moves into contract and accounting records, kept as the law requires.

Historical archive being decommissioned: requests sent up to and including 10 November 2026 were stored in a private Vercel Blob store, aether-layer-quotes, in region iad1 (Washington, D.C., USA). The store may also contain technical data from the previous version of the API: abuse counters with the IP hash, per-key usage counters and key records (hashes only). It receives no new data and will be closed.

Legal bases: Art. 6(1)(b) GDPR for steps taken at your request before a contract, otherwise Art. 6(1)(f) (legitimate interest in handling enquiries and preventing abuse).

4. Email

If you write to giacomo.sibilia@aether-layer.com, the message is delivered through the forwarding service of Porkbun LLC (USA). Replies and other outbound email may be sent through Resend, which processes them in region eu-west-1 (Ireland) with Amazon Web Services as a sub-processor.

Legal bases: Art. 6(1)(b) GDPR where the correspondence relates to a contract, otherwise Art. 6(1)(f) (traceable business correspondence). Retention depends on the purpose of the message and on statutory duties.

5. EU VAT API (/api/v0/keys, /api/v0/validate, /vies-status, /api/v0/receipts, /api/mcp; /api/v0/rank, /api/v0/route, /api/v0/outcome only if re-enabled)

We do not create user accounts. The API uses anonymous API keys: we do not ask for a name or an email.

• API keys (POST /api/v0/keys, free): the key is shown once. We store only:
  • an HMAC-SHA256 of the key with a server secret;
  • a key identifier, the daily quota, the creation date and the status;
  • a technical label for the key type (self-serve-free for free keys) and a flag that marks internal test keys. The record is kept while the key is active. Whoever holds the key can be identified only through it.
• IP address: used for abuse limits and key issuance (at most 3 keys per day per address, 20 with an optional proof-of-work).
  • IPv6 addresses are first reduced to their /64 prefix.
  • A SHA-256 hash is then computed with a secret server value. The raw IP is not stored.
  • Per-minute counters are deleted after 48 hours, daily counters after 35 days.
• VAT number – check (/api/v0/validate, MCP tool validate_vat): normalised in transit and sent to VIES (European Commission) for the check. We send VIES only the country code and the VAT number, with a User-Agent identifying the service: never the API key, the IP, a name, an address or other caller data.
  • The outcome row in Firestore keeps only an HMAC-SHA256 with a server-side secret (pepper), not the VAT number. Without the secret the hash cannot be recomputed or reversed by trying combinations. We still treat it as pseudonymised data.
  • Name and address registered in VIES: we do not return them, and we neither store nor log them. Function memory keeps, per instance, only a keyed hash (HMAC) of their normalised form, for at most 24 hours and 5,000 entries, for the comparison below. These hashes are not stored in Firestore.
  • Shared cache of VIES results (vies_cache, Firestore eur3): so that VIES is not queried several times a day for the same number, for each checked VAT number we store a document with a pseudonymous key (HMAC-SHA256 of the country code and number with the server secret, never the number), the result (valid, invalid, or unverified with the VIES error code), the time of the check and the date reported by VIES. No name, address, API key or IP. A valid or invalid result is reused for 24 hours, an unverified result for 10 minutes; after that it is no longer used and the daily job deletes the document within 49 hours of the check.
  • Optional comparison: if the caller sends its own name and/or address (request body only), the comparison with the VIES record is done locally; we return only yes/no (name_match, address_match). The caller's name and address are not sent to VIES, not stored and not logged.
  • The outcome row also stores: tool, the status (vat_status), the member-state prefix, the technical category of the VIES outcome, the number of attempts, the optional client field and the channel measure (channel, via_proxy, ua_family, from closed lists). User-Agent, Referer and IP are not stored.
• VAT number – ranking (/route, /outcome, only if re-enabled): normalised in transit; Firestore keeps only its SHA-256 hash.
  • The hash uses no secret. Anyone who knows a VAT number can check its hash.
  • Italian VAT numbers have 11 digits with a check digit, so the hash can be reversed by trying every combination. We therefore treat it as pseudonymised data, not anonymous data.
  • For sole traders a VAT number can be personal data.
• Outcomes and reports: for each call we store an outcome row with:
  • key identifier, endpoint, timestamp, latency, technical result;
  • VAT-number hash, the provider named, and the optional client field (integration name and version).

Reports sent to /outcome also store:

• the reported validity bit and the source;
• any consultation_number (VIES consultation number sent by the caller);
• two yes/no flags saying whether a name and an address were present;
• after the comparison with the register, two yes/no flags saying whether name and address matched.

Measurements store numeric similarity scores between the reported and the registered name and address. The registered name and address are never stored as text: they are used only in memory for the comparison. Receipts, measurements and the per-key quarantine state follow the same period.

• Payments (x402): beyond the free daily quota the API answers HTTP 402 with a payment request in the x402 format. Today no payment is collected. If payments are switched on, this notice will be updated first.
• Operational logs: for unrecognised keys we log an 8-character prefix of the key hash and the IP hash, never the key or the IP. For each check the function log receives one vies_check line with member state, outcome, source (live/cache), attempts and latency: never the VAT number, its hash, the name or the address.
• Official sources: for validate_vat, VIES (European Commission) is queried live, unless a result for the same number was obtained less than 24 hours ago (valid or invalid) or less than 10 minutes ago (unverified), a pacing or concurrency limit applies, or the service is switched off in an emergency. The answer states the time of the original VIES check (checked_at) and the age of a cached answer (cache_age_s). For the ranking (if re-enabled) VIES and national registers are queried only if official verification is enabled.
• VIES status (/vies-status, public): daily aggregates per member state (vies_status: number of attempts per outcome and latency buckets). No VAT numbers, no hashes, no keys.

Legal bases:

• Art. 6(1)(b) GDPR to provide the service to key holders;
• Art. 6(1)(f) for security, limits, quotas, aggregated provider-quality measurement and proper use of VIES (result cache);
• Art. 6(1)(c) for any legal obligations.

6. Retention and deletion

Data with a limited retention period gets an expiry date (expires_at), computed from the server clock at write time. Each new write to the same document moves it forward. Only active API keys, per-provider aggregates and reference data without caller data have no expiry (see the table). Documents written before 11 November 2026 were given an expiry date on 11 November 2026 by a one-off update.

Deletion is automatic. A daily job starts between 03:00 and 03:59 Italian time (between 04:00 and 04:59 during summer time); Vercel chooses the exact minute within that hour. It deletes expired documents, at most 5,000 per day. A document normally disappears within about a day of its expiry; with a backlog it can take longer.

• Contact-form requests (quotes, no IP hash): 12 months after submission
• Contact-form abuse counter (IP hash): expires 48 hours after the last submission, deleted within 73 hours
• API per-minute limits (IP hash, key identifier): 48 hours
• Daily usage per key, key issuance per IP hash, budget counters: 35 days
• Outcomes, reports, receipts, measurements, per-key quarantine state: 400 days after the last write
• API keys (hash, identifier, quota, date, status, label): while the key is active
• Cache of VIES results (vies_cache: pseudonymous key of the VAT number, result, time of the check): 24 hours (valid/invalid) or 10 minutes (unverified), deleted within 49 hours
• Daily VIES aggregates per member state (vies_status, no caller data): 35 days
• Per-provider aggregates and reference data (hashes only, no caller data): no expiry, overwritten
• Historical Vercel Blob archive (iad1): until it is closed

Function memory, never disk, also holds:

• per-IP limiters with 60-second windows;
• a key cache: 60 seconds for keys found, 5 seconds for unknown ones;
• a list of hashes of keys already known to be valid, for at most 24 hours;
• the proof-of-work anti-replay set, for 300 seconds;
• validate_vat VIES answers: validity, date and keyed hashes of the normalised name/address (never the text), 24 hours (10 minutes for unverified results), at most 5,000 entries;
• the VIES limiters (per-minute/day pacing, requests in flight per member state and in total, 1.5-second waiting queue) and the /vies-status response cache (120 seconds).

All of it resets when the instance restarts.

7. Recipients and transfers outside the EEA

• Vercel Inc. (USA): website hosting, API execution, server logs.
  • Since 11 November 2026 the API functions run in region fra1 (Frankfurt, Germany); before that they ran in iad1 (Washington, D.C., USA).
  • Vercel participates in the EU-U.S. Data Privacy Framework; Standard Contractual Clauses are used in addition where needed.
• Google (Firebase / Cloud Firestore): database for contact-form requests, API keys, counters with IP hashes, outcomes and reports.
  • Location eur3 (Europe): the data is stored in the EU.
  • Google LLC, a company of the group, participates in the EU-U.S. Data Privacy Framework. Google's data processing terms apply to Firebase and include Standard Contractual Clauses for any access from outside the EU.
• Vercel Blob (USA, iad1): only the historical archive being decommissioned, aether-layer-quotes (section 3).
• Porkbun LLC (USA): forwarding of inbound email.
• Resend (eu-west-1, Ireland; sub-processor Amazon Web Services): sending outbound email.
• VIES (European Commission, DG TAXUD, on behalf of the member-state tax authorities): receives the country code and VAT number for the check and forwards them to the competent member-state system. According to the VIES privacy statement, the competent member-state tax authorities are the controllers and the Commission acts as processor, without retaining the data transmitted. VIES privacy statement: https://taxation-customs.ec.europa.eu/document/download/a6cea373-9e05-45b8-9edb-e122ef35423a_en.
• VAT validation providers (ranking only, if re-enabled): the API names them; it does not contact them on the caller's behalf and does not pass callers' data to them.

Where a provider processes data in the USA, the transfer relies on the EU-U.S. Data Privacy Framework if the provider participates in it, or on Standard Contractual Clauses.

8. Cookies and analytics

This website does not use cookies, analytics, advertising or tracking services.

9. Your rights

You have the right to:

• access, rectification, erasure, restriction and portability (Arts. 15–20 GDPR);
• object to processing based on legitimate interest (Art. 21).

To exercise them, write to giacomo.sibilia@aether-layer.com or use the contact form. For the API we store only hashes, so we may ask for the key identifier or the VAT number you used. We will use it only for that check.

You may lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular the Garante per la protezione dei dati personali (Italy), where the controller is established. You may also contact the authority of the place where you usually live or work or where the alleged infringement took place.

10. Automated decisions

We make no decisions based solely on automated processing that produce legal effects concerning a person or similarly significantly affect them (Art. 22 GDPR). The ranking concerns providers, not people. A validate_vat result reports the VIES answer and public format rules; an invalid result should not be used on its own to refuse a transaction: in Italy and Spain an active number can be missing from VIES.

11. Official notice (EU VAT API)

Automated check: local format/checksum rules plus a live query of VIES (European Commission). Not a tax attestation and not legal advice; VIES data come from the member states' databases. Keep your own record of the VIES consultation.

Ranking (if re-enabled): Aether measures how often each provider agrees with the official registers (VIES, SIRENE). It does not replace consulting the register and is not a tax attestation.