Draft for legal review. This page is an engineering first draft and has not yet been reviewed by a lawyer. Bracketed placeholders mark items pending business/legal sign-off.
EmailValidator ("we", "us") operates emailvalidator.ai, an email-verification service. For the personal data described below we act as a data controller for your account data, and as a data processor for the email lists you submit for validation. Contact: [privacy@emailvalidator.ai]. [If appointed:] Our Data Protection Officer can be reached at [dpo@emailvalidator.ai].
Account data (we are controller): name, email address, password (hashed), company (optional), authentication identifiers from social login providers you choose, and billing records (handled by Stripe — we store invoice/transaction metadata, never card numbers).
Submitted validation data (we are processor): the email addresses and accompanying spreadsheet columns you upload or send via API for verification, and the verification results we produce.
Technical data: IP address and request metadata in transient server logs, and strictly-necessary cookies (see our Cookie Notice).
We never sell your data. We share it only with the subprocessors that run the service (hosting, storage, email delivery, payments, authentication) — see our Subprocessor List. To verify an address we must connect to the recipient's mail server, which inherently discloses the address to that server.
Google Analytics 4 and Google Ads (conditional): where you have given consent to analytics or advertising cookies, anonymous usage signals (page views, funnel events) are sent to Google Ireland Limited, acting as a data processor on our behalf. No personally identifiable information (name, email, user ID) is included in these signals. The legal basis for this processing is your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time via the Cookie Notice.
Under the GDPR you can: access a copy of your data; correct it; erase it; restrict or object to processing; and receive it in a portable format. You can exercise access/portability and erasure yourself from Account → Privacy & data (export and "Delete my account"), or email [privacy@emailvalidator.ai]. We respond within one month. You may also complain to your local supervisory authority.
Our primary hosting is in the EU ([Hetzner, Germany/Finland]) and uploaded lists and results are stored in the EU ([AWS S3, Ireland]). Some subprocessors (e.g. [Stripe], [Resend], social-login providers, Google) may process data outside the EEA; where they do, transfers are covered by Standard Contractual Clauses or an adequacy decision. Google's data processing terms include SCCs for international transfers of analytics data. See the Subprocessor List.
Data is encrypted in transit (TLS) and at rest. Access is restricted and audited. No method is perfectly secure, but we maintain appropriate technical and organisational measures and a breach-notification process.
We do not sell or share your personal information as those terms are defined under the CCPA. California residents have rights to know, delete, correct, and to non-discrimination; exercise them as in Section 6.
We post changes here and update the version and date above; material changes will be notified by email.