Data we process
The input is whatever identifiers you submit: phone numbers, email addresses, or account-eligible identifiers such as a platform username. The output is a fixed set of technical and status fields returned per identifier:
- Validity and E.164 formatting
- Country, carrier, and line type (mobile, landline, VoIP, toll-free)
- Portability and routing context
- Registration or availability signals for the platform being checked (for example, whether a number is registered on WhatsApp or Telegram)
- For the email and exchange checkers: whether the address or account exists at the named provider
That is the entire output contract. No field identifies a natural person by name, address, photograph, or any profile attribute.
Data we never collect
ZelNum is verification infrastructure, and the boundary is hard:
- No private account content. We never read messages, contact lists, profile photos, bios, status updates, or anything else inside a WhatsApp, Telegram, Instagram, or any other account.
- No logins to third-party accounts. No check requires or performs authentication as any user, and no credential is ever requested from the person behind the number.
- No identity attributes. We do not return or store the owner's name, address, ID number, or any other personal attribute. A lookup answers "what is this number," never "who is this person."
- No profile building. We do not assemble histories, link numbers to people across sources, or maintain any directory of results.
Where results come from
Three source families, all queried at request time through commercial providers:
- Telecom signaling. HLR/MNR and carrier databases operated by licensed providers. These return validity, network, line type, and portability — the same class of data any SMS route or bank uses to verify a number before sending a one-time passcode.
- Platform availability signals. Registration and availability checks delivered through licensed upstream providers, without logging in to any account and without accessing any profile content. The result states whether an identifier shows as registered — nothing more.
- Email and exchange verification. Standard mailbox-existence checks (syntax, domain, MX, mailbox probe) of the kind used by every email service at signup.
Upstream providers are bound by commercial agreements to deliver data lawfully. We do not sell raw upstream data, and results are licensed to you for your own operational use under the Terms.
On scraping and platform terms
ZelNum does not scrape WhatsApp, Telegram, Instagram, or any other platform. No crawlers run against those services, no accounts are created to probe them, and no rate limits are bypassed. The availability signals we return come from upstream providers as described above.
We are equally explicit about what that means practically: a "registered" result means the identifier shows registration signals to the licensed provider — it is not a claim of ownership, identity, activity level, or consent to be contacted. Results are data-quality signals, and the Acceptable Use Policy prohibits using them for outreach, tracking, or profiling.
GDPR roles and lawful basis
You submit identifiers from your own records because you intend to contact, store, or manage them — you decide why. That makes you the controller of the submitted data and ZelNum a processor acting on your instructions. Establishing and documenting the lawful basis (consent, contract performance, or legitimate interest, with the balancing test kept on file) is part of your controller obligations.
On our side, we process account data (email, billing) as a controller for running the service, under the Privacy Policy. Submitted identifiers and their results are processed only to perform the lookup, are stored per the retention rules below, and are never used for our own marketing or shared with third parties beyond the licensed providers needed to answer the query.
Rights and deletion
If a person whose identifier appears in your records asks what happened to their data, you handle their request as controller — results are delivered to your account, and we do not retain a copy beyond the retention window. Two practical routes exist:
- You hold the record. Delete the identifier from your list or CRM; future lookups are new processing under your new lawful basis.
- Lookup-deletion requests. Send the identifier to [email protected] and we will remove it from any cached results within 7 business days and can block it from future lookups.
Retention
Submitted identifiers and their results are kept only as long as needed to deliver the result and honour the billing and abuse-prevention obligations described in the Privacy Policy. They are not retained to build history, and deletion of your account removes them on the schedule stated there.
Security
Data in transit is encrypted, access inside ZelNum is role-restricted, and the operational details — key management, sub-processors, disclosure history — live on the Security & Data Handling page. Vulnerability reports are welcomed there and are answered within one business day.
Contact
Data-source questions, deletion requests, and processor documentation for your compliance team: [email protected] or the contact page.