Email deliverability platform with GDPR compliant email verification
This page exists for the security review. It states what data we hold, on what basis, who can reach it, how long it stays and what happens when someone asks to be removed.
Business contact data, in a professional context
The scope is deliberately narrow, because a narrow scope is what makes this defensible.
We do not process special category data. We do not build profiles of private individuals, we do not hold home addresses or phone numbers, and we do not run reverse lookups from an address to a person's private life.
- Work email addresses, the company domain they belong to and the naming pattern of that domain.
- The name and professional role of the person the address belongs to, where that is published.
- Technical data about the domain: MX records, the detected mail provider and the catch-all status.
- The verification result and the time it was produced.
The basis we rely on
We process business contact data on the basis of legitimate interests in business to business communication, balanced against the interests of the person concerned. That balance is what the rest of this page is about.
The rights a person can exercise
Anyone can write to [email protected] about an address that belongs to them.
Suppression is permanent by design. Erasing a record without suppressing it would mean the address comes back the next time anyone searches that domain, which is not erasure at all.
- Access: we tell them what we hold about that address and where it came from.
- Rectification: we correct data that is wrong.
- Erasure: we remove the record, and the address goes on a permanent suppression list so it is never returned again, to any customer.
- Objection: a person can object to processing, and we stop.
- We act on a request within one month, and we confirm in writing when it is done.
Who on your side can do what
| Control | Starter | Growth | Scale |
|---|---|---|---|
| Seats | 2 | 10 | Unlimited |
| Role based access control | Not included | Not included | Included |
| Team workspaces with per client separation | Not included | Not included | Included |
| Audit log of searches, exports and API calls | Not included | Not included | Included |
| Configurable retention window | Standard | Standard | Configurable |
How long data stays and where it lives
- Search results and exports are held for the standard retention window on Starter and Growth, and for a window you configure on Scale.
- Suppression entries are kept indefinitely on purpose, because their whole function is to stop an address returning.
- Deleting your account removes your searches, your lists and your exports. It does not remove suppression entries, for the reason above.
Processing terms
For the lists you bring, we act as processor on your instruction. The processing terms, the service providers we use and the way we handle a breach are set out in the terms of service and the privacy policy, which apply to every plan.
Verification is a deliverability control, not just a data control
The security review usually asks about data. The marketing operations review asks about the sending domain, and this is the same purchase.
Mailbox providers score how often your domain sends to addresses that do not exist. Verification before the send keeps that number down, which keeps your mail in inboxes, which is the whole reason the campaign exists. That is why bulk email verification and scheduled re-verification are usually the first things an operations team turns on.