Privacy, explained clearly.

Who is responsible

C9 Ventures Ltd, a company registered in England and Wales (number 17292146), with its registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, operates QuietPass. We are the controller for website inquiries, access requests, account administration, security, and our business correspondence. Contact david@quietpass.com or write to our registered office with a privacy question.

For live customer queries, the customer’s and QuietPass’s respective data protection roles depend on the agreed service and supplier. Those roles, permitted purposes, and processing terms must be established before live access. This website notice does not replace a customer data processing agreement.

Information we collect

Access requests: your email, company, use-case description, requested checks, target countries, volume band, request reference, submission time, and a limited campaign-source label where supplied. Please describe your project without including customer phone numbers, credentials, or sensitive personal information.

Accounts and applications: email and verification records, business membership, business/use-case details, evidence you upload, access decisions, and support correspondence. When phone verification is enabled, this includes your phone number and verification status. A verified number can be associated with only one developer account.

Technical information: our hosting and security providers process information such as IP address, browser/device information, requests, and security events. The access-request service stores a keyed digest of the IP address for rate limiting rather than the raw address in its request table. A digest is pseudonymous information, not necessarily anonymous information.

Why we use it

We use access-request and correspondence details to assess fit, respond, and arrange onboarding. Our basis is our legitimate interest in handling business inquiries and developing the service. For an individual entering a contract with us, necessary pre-contract steps or performance of that contract may also apply.

We use account, verification, and security information to provide controlled access and prevent abuse, relying on contract where applicable and our legitimate interests in running a secure service. We process information to meet legal obligations where required. We do not subscribe access applicants to a marketing newsletter, sell their contact details, or use this form for automated credit or eligibility decisions.

Required form fields let us assess and respond to your request. If you do not provide them, we cannot process the form; you can contact us by email instead.

Service providers and international processing

Cloudflare hosts and protects the website and application. Supabase provides authentication, the database, and private file storage; our current main project is hosted in Sydney, Australia. Resend delivers sign-in emails, and Google Workspace handles business email. These providers and their subprocessors may process information in other countries as part of hosting, support, security, and delivery.

Provider data processing terms address international transfers using applicable safeguards, including standard contractual clauses and UK addenda where relevant. You can request details about the safeguards applicable to your information by contacting us. Provider terms are available from Supabase, Resend, and Cloudflare.

When enabled, SMS verification sends the destination number and verification message to our SMS provider, Vonage, and the delivery network. Live carrier or SIM-swap checks require relevant network-data providers. We will identify applicable processing and supplier requirements before enabling those checks for a customer. We may also disclose information to professional advisers or authorities where necessary and lawful.

How long we keep information

Website access requests: stored in the application database for up to 180 days, then removed by scheduled cleanup. Rate-limiting IP digests are cleared after two days by the same cleanup. If the conversation develops into an account or commercial relationship, relevant information may be retained separately for that relationship.

Account and verification information: retained while needed to administer access, enforce the one-number-per-account rule, and prevent misuse. Application evidence and approval records are retained while needed to manage or evidence the relevant access decision. Contact us to close an account or request a retention review.

Ordinary free-query history: stored response content is cleared after 24 hours and usage entries after 30 days by scheduled cleanup. Verification previews, supplier reconciliation, idempotency controls, and billing/audit records have different purposes; the applicable live-service terms will explain those records before activation.

Business correspondence and records needed for legal obligations or disputes are retained according to that purpose and any applicable legal period. Copies in provider backups follow the provider’s backup cycle. Deletion from the active database is not a promise of immediate removal from every backup.

Cookies and website measurement

The console uses necessary, secure cookies for sign-in, session continuity, and verification. These are separate from website measurement.

We use Cloudflare Web Analytics on public website pages to understand aggregate traffic and loading performance. It does not use analytics cookies, local-storage identifiers, or session replay. We do not install it in the private console, supplier tests, or billing tests. It is not used to record form contents, phone-check responses, or API keys. Cloudflare processes network information when receiving website requests and measurement beacons. See Cloudflare’s description of Web Analytics.

Limited source labels on access requests help us understand which launch activity prompted an inquiry. We do not retain arbitrary tracking query strings in the request record.

Your choices and rights

Depending on the applicable law and circumstances, you may request access, correction, deletion, restriction, or portability of your personal information, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent without affecting prior lawful processing. These rights are subject to their applicable conditions and exceptions.

Contact david@quietpass.com to make a request. We may need to confirm your identity, and will respond within the applicable legal timeframe. If your number was queried by another business, contact that business first; we can help identify the appropriate route where possible.

You may complain to the UK Information Commissioner’s Office at ico.org.uk, or the relevant data protection authority where you live. You do not have to contact us first, though we would welcome the chance to resolve a concern.

Changes to this notice

This notice is dated October 16, 2026. We will update it as the service and processing change. Material changes affecting an existing account will be communicated through an appropriate account or contact channel.