Data processing terms
A list of email addresses is personal data about people who have never heard of us. This page sets out who is responsible for what.
Last updated September 2026.
1. Who is who
When you upload a list, you decide why those addresses are being checked and what happens to the results. That makes you the controller. We check them because you asked us to and for no other reason, which makes us your processor.
Your own account details are different. For your name, your login, your API keys and your billing history, we are the controller, and the privacy policy covers those.
2. What we do with a list, and nothing else
We verify the addresses and hand you the results. We don't sell uploaded addresses, we don't add them to a shared database, and we don't reuse them to improve our own product. Your instructions are the upload itself plus whatever you set through the API.
3. What is processed
| Data | Whose it is | Kept for |
|---|---|---|
| Email addresses you upload | The people on your list | Until you delete the job |
| The verdict for each address | The people on your list | Until you delete the job |
| MX host and response reason | The people on your list | Until you delete the job |
| Job size, time and credits used | You, as our customer | The life of your account |
We are not asked for names, postal addresses or anything else about the people on a list, and you should not upload any.
4. What leaves our infrastructure during a check
Verifying an address means asking the receiving mail server about it, so that server sees the address being checked and the address we connect from. No message is sent, so nothing arrives in anyone's mailbox. The check is our own, which means your list is not passed to another verification vendor.
5. Deletion, and requests from people on your list
Delete a job and its addresses, verdicts and reasons go with it. You can do that from the API as soon as you have downloaded the results. If someone on a list asks you to erase their data, deleting the job removes it from us, and that is the whole of what we hold about them.
Closing an account is not the same action as deleting data. Delete your jobs first if you want the addresses gone.
6. If something goes wrong
If we become aware that uploaded data has been accessed by someone who should not have had it, we will tell the affected customers without undue delay, with what we know at that point, so you can meet your own obligations to the people on your list.
The security page has the rest
What is stored, for how long, and the certifications we do not hold.