Privacy Policy

1. Our approach

IBANEX has no user accounts. You do not register, you do not give us your name, your email or a password, and we do not build a profile of you.

We designed the service so that the least possible amount of data is stored, and so that what is stored cannot be traced back to you.

2. What we process

The IBAN you check: it is sent to our servers and, when needed, to our bank data provider in order to identify the issuing bank. We do not store it in readable form — we keep only an irreversible cryptographic hash, which lets us count and cache checks without being able to reconstruct the number.

An anonymous device key: a random identifier generated on your device the first time you open the app. It is not your Apple ID, your phone number or your device serial. It exists so that your purchased credits are linked to something, and it is the only reason your balance survives.

Purchase records: which pack you bought and when, as reported by the app store. We never receive your card details.

Basic technical logs of the web server (IP address, date, requested page), kept for security and to detect abuse.

3. Why we process it, and on what legal basis

To provide the service you asked for — checking an IBAN and identifying its bank — which is the performance of our contract with you (Art. 6.1.b GDPR).

To keep track of the credits you have purchased and prevent them being spent twice, also contractual performance.

To keep the service secure and prevent abuse, on the basis of our legitimate interest (Art. 6.1.f GDPR).

To comply with our tax and accounting obligations regarding purchases (Art. 6.1.c GDPR).

4. Who else sees this data

ibanapi.com (United States), our bank data provider: receives the IBAN in order to return the issuing bank and its BIC/SWIFT. This is unavoidable — it is the query itself.

Apple Inc. (United States): processes your purchase and tells us that it happened. Apple never gives us your payment details.

RevenueCat, Inc. (United States): validates purchase receipts on our behalf and notifies our server so your credits are added.

Our hosting provider (European Union), which operates the servers where the service runs.

We do not sell your data, we do not share it for advertising, and there are no third-party analytics or advertising trackers in the app or on this website.

5. International transfers

Some of the providers listed above are located in the United States. Those transfers rely on the European Commission's standard contractual clauses or on an adequacy decision, as applicable to each provider.

You can ask us for details of the safeguards in place by writing to contact@ibanex.app.

6. How long we keep it

Hashed check records and their reports: up to 24 months, so that repeated queries do not need to be paid for again.

Credit and purchase records: for as long as your balance may be used, and afterwards for the period required by tax law.

Web server logs: up to 12 months.

The history you see inside the app is stored on your own device and disappears when you delete the app or use "Reset".

7. Your rights

You have the right to access, rectify, erase, restrict and object to the processing of your data, and to data portability, by writing to contact@ibanex.app.

Please note an honest limitation: because there is no account and IBANs are stored only as irreversible hashes, we usually cannot link stored data to you as a person. If you send us your device key (Settings, at the bottom of the screen) we can act on the data associated with it.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or with the supervisory authority of your country.

8. Children

IBANEX is not directed at children under 16 and we do not knowingly process their data.

9. Changes to this policy

If we change this policy we will update the date shown at the top of this page. Significant changes will be announced in the app.

This version is the one currently in force.