Privacy Policy
Peru RUC Check (taxid.halpii.com) is run by HALPII S.A.C., Lima, Peru. This page explains what we store when you use the website, the REST API or the MCP server, and why. We keep as little as we can.
What we store
| Data | When | Details |
|---|---|---|
| Email address | When you create an API key | Stored with the key so we can contact you about it. The key itself is stored only as a SHA-256 hash; we cannot read it back. |
| IP address, as a hash | Every lookup and every key request | We never store your IP in plain form. We combine it with a secret value (a salt), hash it with SHA-256 and keep only the first 24 characters. We use this hash to count requests per network. |
| Request log | Every lookup, including refused ones | Date and time, channel (website, REST or MCP), the country of the lookup, your API key id or IP hash, for Peru the first two digits of the RUC you looked up (not the full number; for Mexico, Colombia and Costa Rica no part of the ID is logged), the result (for example found, not found, rate limited or source unavailable), the HTTP status, and your user agent (cut to 200 characters). |
| Daily counters | Every lookup and key request | How many requests each API key, each IP hash and the shared keyless MCP allowance made on each day. These enforce the daily limits. |
Our pages set no cookies of their own and use no analytics or advertising trackers.
Why we store it
- To enforce the daily limits of each plan and the keyless allowance.
- To measure how the service is used (for example, how many lookups are made each day and through which channel).
- To detect and stop abuse, such as attempts to get around the limits or to copy the registry in bulk.
- To contact you about your API key, for example if we change its limits.
We do not sell this data, and we do not use your email for marketing.
How long we keep it
We do not delete these records automatically today. We keep them until they are deleted on request. You can ask us at any time to delete your email and API key, and the log rows tied to that key; write to contacto@halpii.com.
Who processes it
- Cloudflare runs the service (Cloudflare Workers) and the database that holds the keys, counters and request log (Cloudflare D1). Like any network provider, Cloudflare handles your IP address to deliver each request.
- Supabase hosts our copy of SUNAT's Padrón Reducido del RUC, a public registry of companies. To answer a lookup, the service sends the RUC to Supabase and reads the matching record. No email, IP or key data is stored there.
- Colombia lookups are answered live from the RUES dataset that Confecámaras publishes on datos.gov.co, and Costa Rica lookups live from the Ministerio de Hacienda (api.hacienda.go.cr). The service sends them only the tax ID being looked up, never your email, IP address or key. Their answers are cached at Cloudflare for up to 24 hours and are not stored in our database.
- Norway, Finland, France, Ireland and Taiwan lookups are answered from the official open registries: the Brønnøysund Register Centre (data.brreg.no), the Finnish Patent and Registration Office (avoindata.prh.fi), the French government's Annuaire des Entreprises (recherche-entreprises.api.gouv.fr), the Companies Registration Office Ireland (opendata.cro.ie) and Taiwan's Ministry of Economic Affairs (data.gcis.nat.gov.tw). The service sends them only the number being looked up, never your email, IP address or key. Their answers are cached at Cloudflare for up to 24 hours and are not stored in our database.
- Mexico lookups are answered from our copy of SAT's public lists (articles 69-B and 69 of the Código Fiscal de la Federación), stored in Cloudflare D1. We store names from those lists only for companies; for individuals we keep only the RFC and the list status.
- Our pages load fonts from Google Fonts, and the API docs page loads its viewer from jsDelivr. Your browser contacts those services directly when it loads the page.
Registry data about people
The registry data we serve is public data about companies, published by SUNAT. We do not serve data about natural persons: for RUCs that start with 10, 15, 16 or 17 we only check that the number is valid, in line with Peru's Personal Data Protection Law (Ley 29733). For company RUCs (prefix 20) registered under a person's name, we withhold the name and street address. If a record about you appears and you want it withheld, write to us and we will add it to our withheld list.
The same rule applies to the other countries. Mexico: for individuals (13-character RFC) we show only whether the RFC appears on a SAT list, never the name or the birth date encoded in the RFC. Colombia: for individual merchants we show only the check digit and the status of the commercial registration, never the name, legal representative or address. Costa Rica: names are shown only for legal entities. Norway, Finland and France: for businesses run by one person (Norwegian enkeltpersonforetak, Finnish sole traders, French entrepreneurs individuels) we show only the registry status, never the name or address; for Norwegian sub-units we show only the status and the number of the main unit. Taiwan: we never show the company's responsible person.
Your rights
Under Ley 29733 you can ask to access, correct, delete or object to the use of your personal data. If you are in another country, you may have similar rights under your local law. Write to contacto@halpii.com with your request and, for API keys, the email you used. We will answer within the time the law sets. You can also complain to Peru's data protection authority (Autoridad Nacional de Protección de Datos Personales).
Who is responsible
HALPII S.A.C., Lima, Peru. Contact: contacto@halpii.com. If we change this policy, we will update this page and the date below.
Last updated: November 14, 2026