Your list exists to be checked and handed back, and that's all ZapBounce does with it. The addresses aren't sold, aren't pooled into a shared database, and aren't reused to improve the product. Nobody on your list hears from us, because the check itself sends nothing: each connection closes before the DATA step, so no message reaches any inbox.
Retention is a setting you control, per API key. The default is 30 days, long enough to download results and re-check a few rows. Set it to 0 and the job is deleted the moment you download it, or stretch it to 90 days for a slower review cycle. Agencies running one key per client can give each client its own window.
You can also delete on demand. DELETE /v1/batches/{id} removes a job and every address in it at once. POST /v1/erasure removes a single address across your whole account, which is how you answer a GDPR erasure request in one call. The GDPR deletion reference shows both.
Your data stays in the United States. The only time an address leaves that region is the SMTP probe to the recipient's own mail server, which is how any verification works. The sub-processors are listed by name: Vercel, Amazon Web Services, Cloudflare, Google and Stripe. Any change is announced 30 days ahead on the data processing terms page.
Windows vary widely across the market. ZeroBounce deletes files after 30 days, Emailable keeps them 3 to 30 days, and Verifalia lets customers choose from 5 minutes to 30 days, per each vendor's own pages read on 24 September 2026. ZapBounce's range of 0 to 90 days per key covers both the cautious team and the one that re-checks later. Our GDPR answer covers the legal side.
Related questions
Does email verification store my emails?
ZapBounce stores a list and its results for 30 days by default, then deletes them. You can set any window from 0 to 90 days per API key, or delete a job at any time with one API call.
Will ZapBounce sell or share my email list?
No. ZapBounce never sells uploaded addresses, never adds them to a shared database and never reuses a list to improve the product. The only outside contact is the SMTP probe to each address's own mail server.
Where is my list stored?
In the United States, with Amazon Web Services for storage and Vercel for the API. The five sub-processors are named on the data processing terms page, and changes are announced 30 days ahead.
Can I delete one person from all my verified lists?
Yes. POST /v1/erasure removes one address across every job in your account in a single call. That covers a GDPR erasure request without hunting through old uploads.