# Privacy Policy

URL: https://email-validation.org/legal/privacy/
Updated: 2026-10-20

> Documentation index: https://email-validation.org/llms.txt

Version October 20, 2026

This document is a draft that is still being reviewed by our lawyers. Company details marked MISSING will be filled in before launch.

This policy explains what personal data email-validation.org processes, why, for how long, who else handles it and how to use your rights. The controller for your account data is Inbox Perfection LLC, 16192 Coastal Hwy, Lewes, DE 19958, US. Write to [privacy@email-validation.org](mailto:privacy@email-validation.org) for anything in this policy; a person reads every message.

## Two roles

- **Your account.** For the data about you as a customer (your email address, sign-in methods, payments, settings and support messages) we are the controller.
- **Addresses you check.** For the email addresses you submit for validation, in single checks, lists or API calls, you are the controller and we are your processor under the [Data Processing Agreement](https://email-validation.org/legal/dpa/). We use those addresses only to run the checks you ask for. To answer a repeat check of the same address without checking it again, we keep the result of a completed check for 12 months under a keyed hash of the address; we do not keep the address itself.

## What we collect and why

- **Account data:** your email address, an optional name, company name, country and VAT ID. We need these to run your account, issue invoices and meet tax rules (contract and legal obligation).
- **Sign-in data:** sign-in codes (stored only as hashes and deleted when they expire), passkey public keys, the identifier of a linked Google account and your active sessions (contract and security).
- **Purchase data:** what you bought, when, the amount and the invoice details. Card details are handled by Stripe; we never see your card number (contract and legal obligation).
- **Usage data:** credit balance, daily usage totals per status and per API key, and the checks you run in the dashboard (contract).
- **Stored check results:** the result of each completed check (for example deliverable or undeliverable, with the details shown in the result and the time of the check), kept for 12 months under a keyed hash of the address. A keyed hash is a one-way code made with a secret key: we cannot read the address back from it, we can only recognise the same address when it is checked again. We use it to answer repeat checks quickly and without contacting the address's mail server again. Unknown and catch-all results are not kept (legitimate interest in fast, consistent answers).
- **Support messages:** what you write to our support addresses or the help chat, and the AI assistant's replies (legitimate interest in answering you).
- **Security data:** an audit trail of sign-ins and account changes, and a keyed hash of network addresses for abuse limits. We do not store IP addresses in readable form (legitimate interest in keeping the service safe).
- **Page analytics:** our servers count page views by page, country and referring site category. There are no analytics cookies or scripts.

We do not sell personal data, and we do not use the addresses you check for marketing or to build profiles. No email is sent to the addresses you check.

## How long we keep data

| Data | Kept for | Counted from |
| --- | --- | --- |
| Lists you upload for bulk validation | 30 days | upload |
| Bulk job working files and result files | 30 days | upload |
| Email you send to our support and role addresses | 30 days | receipt |
| Daily security audit exports | 365 days | export |
| What you wanted to do before signing in (an address to check or a pack to buy), encrypted | until it expires | sign-in start (used once after sign-in, or removed when the sign-in attempt or session ends) |
| Your dashboard check history (API checks are not kept in a history) | 30 days | the check |
| Support conversations by email and chat | 90 days | the last message in the conversation |
| Privacy, abuse, legal and security requests handled by a person | 365 days | receipt |
| Delivery attempts to your webhook endpoints | 30 days | delivery |
| Evidence for payment disputes: consent time, hashed network address and daily usage totals | 180 days | your last purchase (also after account deletion) |
| A keyed hash of your address that stops free credits being claimed twice, with any account restriction in force at deletion or set by a later payment dispute | 24 months | account deletion |
| Unpaid usage of a deleted account (keyed hash of the address), re-applied if the same address signs up again | 24 months | account deletion |
| A keyed hash of the payment card that limits the first-payments bonus to 3 payments | 24 months | the last payment with that card |
| The name of a file you uploaded for bulk validation; job counts stay while your account exists | 30 days | the upload (when the bulk files expire) |
| Purchase and invoice records required by tax law | the period required by tax law | the purchase |
| Security audit trail (sign-ins, key changes, credit adjustments) | 365 days | the event |
| Your account, keys, credit lots, daily usage totals, webhook settings and a keyed hash of your sign-up address | while your account exists | account creation |
| Your bulk list history: file names, status and counts (the files themselves go after 30 days) | while your account exists | upload |
| Signed-in sessions | until it expires | sign-in (at most 30 days) |
| Keeps a support chat conversation together | until it expires | the start of the chat (deleted a day after it expires) |
| Results of completed checks, stored under a keyed hash of the checked address (never the address itself), to answer repeat checks without checking the address again | 12 months | the check |
| Credit balance records of a deleted account | 30 days | account deletion |
| Working state of a bulk list (file name, progress); after expiry only ids, status and counts remain, and the object is wiped 7 days later | 30 days | upload (erased at once when the account is deleted) |
| Aggregated usage and page statistics (no email addresses, no IP addresses) | 3 months | the event |
| Operational logs without addresses, keys or query strings | 7 days | the request |
| Support prompts are not logged by the AI gateway | not stored | n/a |

When you delete your account we delete its data right away, including your support conversations. We keep only: purchase records we must keep for tax law; payment-dispute evidence and the security audit trail, for the periods in the table above; the credit balance records of the deleted account, for 30 days; stored check results, which are not linked to any account, until they expire 12 months after the check; and a keyed hash of your email address that stops free credits being claimed twice, together with any unpaid balance or account restriction (a suspension or billing hold) in force at deletion, which applies again if the same address signs up. If a payment made before the deletion is refunded or disputed later, the unpaid share and a billing hold apply to the account that address has opened again, or to the next one it opens.

## Who processes data for us

We use the subprocessors listed on the [subprocessors page](https://email-validation.org/legal/subprocessors/): our hosting and email provider, our payment processor, Google if you sign in with Google, and our email verification infrastructure provider. Each one is bound by a data processing agreement. We announce changes to that list 30 days in advance.

## International transfers

Our website and API run on a global network, and mailbox checks are processed in the United States. Where data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on the safeguards in our agreements with each provider, such as the European Commission's standard contractual clauses.

## Your rights

Depending on where you live, you can ask for a copy of your data, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You can export your account data and delete your account in your settings at any time. For anything else, write to [privacy@email-validation.org](mailto:privacy@email-validation.org); we answer within one month. You may also complain to your data protection authority.

## Cookies

We use only strictly necessary cookies and per-browser preferences. The [Cookie Policy](https://email-validation.org/legal/cookies/) lists each one.

## Children

The service is for businesses and is not directed at children.

## Changes

When this policy changes in a material way we announce it on the [changelog](https://email-validation.org/changelog/) and by email before it takes effect.