API lookups are processed in memory and never written to a database, logs or analytics; request URLs sit in infrastructure logs for 30 days; uploaded CSVs are kept until you delete them.
Phone numbers sent to the API are processed in memory and are not written to a database, application logs or analytics. Because a GET request puts the number in the URL, infrastructure request logs retain that URL for 30 days before automatic deletion; sending the parameters in a POST body avoids this. Uploaded CSV files and their results are stored so you can download them, and are kept until you delete them from the dashboard, which removes the stored objects; files may be deleted more than 90 days after upload. Processing happens on Google Cloud in the EU (europe-west1). Veriphone is GDPR compliant, publishes a pre-signed Data Processing Agreement, and lists its sub-processors with 30 days' notice of changes.