Data processing terms

Last updated 24 September 2026.

These data processing terms form part of the ZapBounce terms of service. ZapBounce is operated by Hashlogics, a US LLC. If your procurement team needs a countersigned copy, you can request one from privacy@zapbounce.com.

1. You are the controller, ZapBounce is your processor

When you upload a list, you decide why those addresses are checked and what happens to the results. That makes you the controller. ZapBounce checks them because you asked and for no other reason, which makes us your processor.

Your own account details work the other way. For your name, login, API keys and billing history, we are the controller, and the privacy policy covers those.

2. A list is used to verify it, and for nothing else

ZapBounce verifies the addresses and hands you the results. We never sell uploaded addresses, never add them to a shared database, never contact the people on a list, and never reuse a list to improve the product. Your instructions are the upload itself plus whatever you set through the API.

3. What is processed, and for how long

Each job stays until you delete it with DELETE /v1/jobs/{id}. Agencies that run one account per client can give every client its own API key.

4. Where data is hosted

ZapBounce is hosted in the United States. A list leaves that region only for the SMTP probe, when our checker asks the receiving mail server about an address. That server sees the address being checked and the address we connect from. No message is sent, so nothing arrives in anyone's mailbox, and the check is our own, so your list never goes to another verification vendor.

5. Sub-processors

ZapBounce uses exactly 5 sub-processors. We announce any change to this list 30 days before it takes effect, so you have time to review it.

6. Deletion and erasure requests

You can delete any job at once with DELETE /v1/jobs/{id}. Its addresses, results and reasons go with it. If one person on your lists asks you to erase their data, delete the job that holds their address and remove it from your own copies of the list.

Closing an account is a separate action from deleting data. Delete your jobs first if you want the addresses gone before you close it.

7. If something goes wrong

If we become aware that uploaded data has been accessed by someone who should not have had it, we tell the affected customers without undue delay, with what we know at that point, so you can meet your own duties to the people on your list.