Email deliverability platform with GDPR compliant email verification
This page exists for the security review. It states what data we hold, on what basis, who can reach it, how long it stays and what happens when someone asks to be removed.
Business contact data, in a professional context
The scope is deliberately narrow, because a narrow scope is what makes this defensible.
We do not process special category data. We do not build profiles of private individuals, we do not hold home addresses or phone numbers, and we do not run reverse lookups from an address to a person's private life.
- Work email addresses, the company domain they belong to and the naming pattern of that domain.
- The name and professional role of the person the address belongs to, where that is published.
- Technical data about the domain: MX records, the detected mail provider and the catch-all status.
- The verification result and the time it was produced.
The basis we rely on
We process business contact data on the basis of legitimate interests in business to business communication, balanced against the interests of the person concerned. That balance is what the rest of this page is about.
The rights a person can exercise
Anyone can write to [email protected] about an address that belongs to them.
Suppression is permanent by design. Erasing a record without suppressing it would mean the address comes back the next time anyone searches that domain, which is not erasure at all.
- Access: we tell them what we hold about that address and where it came from.
- Rectification: we correct data that is wrong.
- Erasure: we remove the record, and the address goes on a permanent suppression list so it is never returned again, to any customer.
- Objection: a person can object to processing, and we stop.
- We act on a request within one month, and we confirm in writing when it is done.
Who on your side can do what
| Control | Starter | Growth | Scale | Enterprise |
|---|---|---|---|---|
| Seats | 2 | 10 | Unlimited | Unlimited |
| Role based access control | Not included | Not included | Included | Included |
| Team workspaces with per client separation | Not included | Not included | Included | Included |
| Audit log of searches, exports and API calls | Not included | Not included | Included | Included |
| SSO with SAML | Not included | Not included | Not included | Included |
| SCIM user provisioning | Not included | Not included | Not included | Included |
| Configurable retention window | Standard | Standard | Configurable | Custom |
| Regional data residency | Not included | Not included | Not included | Included |
How long data stays and where it lives
- Search results and exports are held for the standard retention window on Starter and Growth, and for a window you configure on Scale.
- Enterprise sets a custom retention window and a region for data residency.
- Suppression entries are kept indefinitely on purpose, because their whole function is to stop an address returning.
- Deleting your account removes your searches, your lists and your exports. It does not remove suppression entries, for the reason above.
The data processing agreement
Enterprise includes a data processing agreement covering us as processor for the data you bring, the subprocessors we use, the security measures in place and the breach notification timeline. It is signed before the first invoice, alongside the security questionnaire.
What Enterprise commits to in writing
- A 99.9 percent uptime commitment with a named response window for incidents.
- A named technical contact and an onboarding process.
- Invoicing against a purchase order with net terms.
- Support for your security questionnaire, answered by us rather than pointed at a portal.
Verification is a deliverability control, not just a data control
The security review usually asks about data. The marketing operations review asks about the sending domain, and this is the same purchase.
Mailbox providers score how often your domain sends to addresses that do not exist. Verification before the send keeps that number down, which keeps your mail in inboxes, which is the whole reason the campaign exists. That is why bulk email verification and scheduled re-verification are usually the first things an operations team turns on.