Compliance API Privacy Policy

Last updated: October 12, 2026

This policy covers the Palavir Compliance API (the "API"), a screening service that checks names and NPIs against the HHS-OIG LEIE exclusion list, SAM.gov exclusions, and the Treasury OFAC sanctions list. It is operated by Palavir LLC ("Palavir," "we," "us") and is available two ways: through our listing on RapidAPI, and as a direct subscription at palavir.co/compliance-api. Our general website privacy policy covers the rest of palavir.co.

1. Information We Collect

Screening requests you send

A screening request contains a name and, optionally, a state, NPI, or EIN for each entity you want checked (up to 100 per batch request). Our API code processes these values in memory to produce a result and does not write them to a database or log them. The one exception is that a malformed request can leave a fragment of its text in an error log entry. Requests are rate-limited by your RapidAPI user identifier or, if absent, your IP address; those counters are held in memory. Our hosting provider (Vercel) and, for RapidAPI customers, RapidAPI itself process request metadata such as IP addresses and timestamps under their own policies.

Direct subscription accounts

  • Email address and optional company name you enter at checkout
  • Stripe customer and subscription identifiers, and subscription status and billing-period dates
  • The API key we issue to you, which we store in our database and send to the email address you used at checkout
  • Webhook settings you register: the webhook URL, an optional notification email, a signing secret, and filter rules (sources, states, and any list of up to 10,000 NPIs you want monitored). An NPI list you provide for filtering is stored for as long as the subscription exists
  • Logs of webhook deliveries to your endpoint

RapidAPI customers

If you subscribe through RapidAPI, RapidAPI handles your account, billing, and API keys. We do not receive your payment details. We see only the user identifier RapidAPI attaches to each request.

2. Data About Individuals in the Screening Lists

The lists we screen against are public government records: the LEIE (HHS Office of Inspector General), SAM.gov exclusions (GSA), and the OFAC Specially Designated Nationals list (U.S. Treasury). They name individuals and businesses. A match result can include the matched name, NPI, state, city, exclusion type and date, specialty, and OFAC program details. For the paid tier it can also include aggregate state Medicaid billing totals tied to an NPI, derived from public Medicaid data. We do not return Social Security numbers. We republish this data as the government publishes it. It is a screening aid and does not replace checking the official source. If a record about you is wrong or has been removed at the source, the correction has to be made by the publishing agency; contact us and we will update our copy at the next refresh.

3. How We Use Information

  • Return screening results to you
  • Provision your API key, deliver webhooks, and send your purchase confirmation and API key emails
  • Process payments and manage your subscription
  • Enforce rate limits and keep the API secure against abuse
  • Notify Palavir staff internally when a new subscription is created

We do not sell your information and we do not use the names you submit for screening to train models or build other products.

4. Service Providers

  • Vercel hosts the API and website
  • RapidAPI operates the marketplace and gateway for RapidAPI customers
  • Stripe processes direct-subscription payments (see Stripe's privacy policy)
  • Supabase stores direct-subscription account and webhook records
  • Resend delivers our emails to you
  • A private internal notification service receives a short message, including your email address, when a direct subscription is created

If Palavir is part of a merger, acquisition, or sale of the API, your information may be transferred to the successor, which will be bound to honor this policy. We will tell you before that transfer and offer you the chance to delete your account.

5. Retention and Deletion

Screening request contents are not retained by our application. We retain your personal information, including subscriber, API key, webhook, webhook-delivery, and billing records, for as long as your subscription is active or as needed to provide you services, and we deactivate the key when the subscription ends. Contact and inquiry form submissions are retained for up to 24 months. If you request deletion of your data, we will remove it within 30 days, except where we are required by law to retain it (for example, financial records for tax purposes). To delete your account, API key, webhook settings, or stored NPI list, email support@palavir.co. Records we must keep for tax or legal reasons, such as invoices, are kept as the law requires.

6. Security

Traffic is encrypted over HTTPS, the screening endpoints require the RapidAPI gateway secret, and webhook deliveries are signed with HMAC-SHA256 so you can verify them. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

7. Your Rights

Depending on where you live, including California and other US states or Canada, you may have rights to access, correct, or delete your personal information. Email support@palavir.co. This policy is governed by the laws of the State of Michigan, USA.

8. Children

The API is for businesses and is not directed to individuals under 13.

9. Changes to This Policy

We may update this policy. We will revise the date above and, for material changes, notify subscribers by email.

10. Contact

Palavir LLC, a Michigan limited liability company
22515 Pontchartrain Dr, Southfield, MI 48034
Email: support@palavir.co