Acceptable use
ZapBounce keeps the lists you lawfully hold in good order. You confirm a lawful basis for every address, and you never use the service to discover new ones.
Last updated 24 September 2026.
1. You hold a lawful basis for every address
By uploading a list, you warrant that you have a lawful basis to process every address on it. That includes lists you got from a data provider. Where a list came from is yours to vouch for, and ZapBounce relies on that warranty.
Verification tells you whether an address can accept mail. It never creates consent to email anyone, so a valid result is not permission to send. Whether and how you contact the people on a list stays with you and the rules that apply to you.
2. Verification, never discovery
ZapBounce may not be used to discover addresses. Don't use the API to find out which addresses exist. Guessing at firstname.lastname@ patterns and keeping the ones that come back valid is a permutation run, whatever the list is later used for. The same goes for running a dictionary of names against a domain, or appending guessed addresses to a list of names.
3. Abuse of the mail servers we talk to
Every check opens a connection to somebody else's mail server. The API is rate limited for that reason, and the limits are in the documentation. Don't try to get round them by splitting one job across accounts or keys. Volume that gets our addresses blocked by a large provider degrades results for every other customer.
4. The ordinary prohibitions
Don't use ZapBounce to break the law, to send or prepare spam, to stalk or harass anyone, or to check addresses as part of taking over an account that isn't yours. Don't probe, scan or attack the service, and don't resell access to it without asking us first.
The short version
- Hold a lawful basis for every address you upload, including provider lists.
- Verification never creates consent to email anyone.
- No permutation, dictionary or appending runs to discover addresses.
- Stay inside the documented rate limits, and never split a job to avoid them.
These rules sit beside the data processing terms, which name every sub-processor, and the security page, which covers how uploaded lists are stored. For what a check costs, see pricing.