Plain language
Privacy policy
Vetto is built to keep as little personal data as possible. This page lists all of it.
Updated
Vetto is a service run by an independent developer based in Spain (EU). To reach us about anything on this page, reply to your Gumroad receipt (customers) or to any email you received from Vetto.
1. Visitors to this website
- No cookies and no third-party analytics or ad pixels on the public pages.
- We count visits anonymously: one daily total per campaign, page and step (viewed the page, tried the demo, reached pricing, clicked a sign-up or buy button). No IP address or identifier is stored with these counts.
- If you arrive from a campaign link or another site, your browser's local storage keeps the campaign tags (for example
utm_source=reddit) or the referring site's domain for 30 days, so that a signup can be credited to the right campaign. It never leaves your browser unless you create an account. - Requests are served by Cloudflare, which processes your IP address to deliver and protect the site.
- The live demo and the free tools do not store the email addresses you type. The DNS result for a domain (for example “has a mail server”) is cached. The CSV audit runs in your browser and only sends domain names.
2. Vetto account holders
| Data | Why | Kept |
|---|---|---|
| Email address | Sign-in and service messages | Until you delete your account |
| Password and recovery code | Sign-in; stored only as salted, one-way hashes | Until you delete your account |
| Session cookie (__Host-sid) | Keeps you signed in | 30 days or until you sign out |
| Sites, settings, usage counters | Running the service and plan limits | Until you delete the site or account |
| Campaign or referrer that brought you | Measuring which marketing works | Until you delete your account |
| Gumroad license key and status | Unlocking and re-checking Pro | Until you delete your account |
Deleting your account in Dashboard → Account removes all of the above immediately.
3. People who fill in a form protected by Vetto
When a site uses Vetto, the site owner decides to check signups and is the controller of that data; Vetto processes it on their behalf. For each check:
- The email address is analyzed in memory and is not stored in plain text.
- To detect repeat signups, Vetto stores two salted hashes of the address (salt unique to each site), used for 90 days and then purged automatically. A hash cannot be turned back into the address.
- The site owner's log keeps a masked address (
ja•••@gmail.com), its domain, the country and network type derived from the IP address, and the verdict, for 90 days before it is purged. - IP addresses are never stored in plain text: only short one-way hashes used for rate limiting, which expire with the limit window and are purged automatically.
- Vetto never sends email to the address and never probes mailboxes. It only reads public DNS records of the domain.
4. Who processes data for Vetto
- Cloudflare: hosting, database and DNS lookups.
- Google Public DNS: fallback DNS lookups (domain names only).
- Gumroad: payments and license keys. Vetto never sees your card.
- Slack or Discord: only if a site owner turns on alerts; the alert contains the masked address.
Vetto does not sell or share personal data with anyone else.
5. Your rights
Under the GDPR you can ask for a copy of your data, its correction or its deletion, and you can complain to your data protection authority (in Spain, the AEPD). To exercise a right, reply to your Gumroad receipt (customers) or to any email you received from Vetto. If you filled in a form on someone else's site, contact that site first: they control that data.
Give your signup form sharp eyes.
Free on one site. One line of HTML. Remove it any time and your form works exactly as before.
Founding offer: Pro for life for $69 once, first 100 buyers, until Nov 27.