This Data Processing Agreement ("DPA") is part of the Terms of Service between you (the customer) and Inbox Perfection LLC ("we"). You accept it when you create an account. It applies whenever we process personal data on your behalf, mainly the email addresses you submit for validation.
Roles
You are the controller of the personal data you submit. We are your processor and process it only on your documented instructions, which are these Terms, this DPA and the requests you make through the dashboard and the API.
Subject matter and duration
- Purpose: checking whether email addresses can receive mail, and returning the results to you.
- Data: email addresses; an IP address only if you send one with an API request; the other columns of files you upload for bulk validation.
- Data subjects: the people whose addresses you submit, usually your customers, subscribers or contacts.
- Duration: for as long as you use the service. Uploaded files and results are deleted 30 days after upload (results of a list that finishes in its last day are kept for 7 days after it finishes); checks run in the dashboard stay in your history for 30 days; API checks are not stored. To answer a repeat check of the same address without checking it again, the result of a completed check is kept for 12 months under a keyed hash of the address, never the address itself.
Our obligations
- We process the data only to provide the service and never use it for our own purposes, to profile people or to send them email.
- Everyone who can access the data is bound by confidentiality.
- We keep the security measures described on our security page in place, including encryption in transit, strict access control and automatic deletion.
- We tell you without undue delay after we become aware of a personal data breach that affects your data.
- We help you answer requests from data subjects and with data protection impact assessments where needed.
- At the end of the service we delete the data, apart from copies the law requires us to keep and the stored results of completed checks. Those are kept under a keyed hash of the address, are not linked to your account and expire 12 months after the check.
- We give you the information you reasonably need to check that we meet this DPA.
Subprocessors
You authorise the subprocessors listed on the subprocessors page. The full name and address of each one, including our email verification infrastructure provider, is in the DPA annex in your dashboard (sign in to view it). We inform you at least 30 days before we add or replace a subprocessor; you may object, and if we cannot resolve the objection you may close your account. Each subprocessor is bound by data protection terms at least as protective as this DPA.
International transfers
Mailbox checks are processed in the United States. Where the law requires it, transfers rely on the European Commission's standard contractual clauses or another valid transfer mechanism.
Contact
Write to privacy@email-validation.org for anything about this DPA; a person reads every message.