← home

Privacy Policy

# Privacy Policy — email-validate

> ⚠️ TEMPLATE DRAFT (Gate B1). Not legal advice. Placeholders in [BRACKETS].

Effective date: [DATE]. Operator: [ERIC / ENTITY NAME, CONTACT EMAIL].

## What we collect

- **Signup data:** your email address and chosen plan (when paid tiers launch).
- **Usage metadata:** timestamp, API key name (or a one-way hash of the
  client IP for anonymous requests — raw IP addresses are never stored),
  request path, response status,
  and latency for each API call.
- **Server logs:** request method and path (query strings are stripped before
  logging), response status, timing.

## What we do NOT collect or store

- **The email addresses you validate are never persisted.** They exist in
  memory only for the duration of the request. No query strings, request
  bodies, or submitted addresses appear in any log we keep.
- No advertising or analytics trackers. No cookies on API endpoints.

## How validation works technically

Validation performs DNS mail-exchange (MX) lookups for the **domain** portion
of submitted addresses and consults local reference lists. Domain names are
visible to DNS resolvers as a technical necessity. We use standard resolvers
and do not build profiles from lookups.

## Retention

- Usage metadata: 90 days, then deleted (aggregates may be kept).
- Server logs: 30 days (hosting-provider log drain).

## Third parties (subprocessors)

- **DigitalOcean** — application hosting (servers may process requests
  transiently anywhere in our chosen region).
- **Stripe** — billing only, when paid tiers launch (we never see card numbers).

## Your rights

You may request access to, or deletion of, your account and usage data at any
time via [CONTACT EMAIL]. We do not sell data, ever.

## Roles under GDPR/CCPA

For addresses you submit, **you are the data controller and we act as a
transient processor**. For your account data, we are the controller.

## Changes

Material changes to this policy will be announced 14 days in advance.