GDPR
Last updated: 31 August 2026.
Verifying an email address means processing personal data belonging to someone who is not our customer. This page explains how that works and what it requires of you.
Who is responsible for what
For the addresses you submit, you are the controller and we are the processor. You decide whose addresses get checked and why. We only run the check you asked for and give you the answer. We do not decide what happens to that data and we do not use it for our own purposes.
For your own account and billing data we are the controller, and the privacy policy covers it.
What this requires of you
A processor cannot make you lawful. Before you upload a list, you need your own legal basis for holding and checking those addresses, usually legitimate interest for business contacts, and you need to be able to answer the people on that list if they ask. We are stating this plainly because tools in this category often imply the opposite.
What we do with a submitted address
- Check the syntax and the domain’s mail records.
- Ask the receiving mail server whether it would accept mail for that address. This is a question, not a message. We never send email to the addresses you verify.
- Return the verdict to you and remember it for up to 30 days so a repeat check is instant.
Retention
Bulk job data, both the list you uploaded and the results, is deleted automatically 7 days after the job is created. You can delete a job sooner from your dashboard and it goes immediately, including the stored files. The cached verdict for an address expires after at most 30 days.
Sub-processors
We use Amazon Web Services and Hostinger for hosting and SMTP checks, Vercel for the website, Freemius and SSLCommerz for payments, Google for optional sign-in, reCAPTCHA and transactional email, and Sentry for error monitoring. Microsoft Clarity and Google Analytics run on the marketing site only, and only after a visitor accepts cookies. The full picture is in section 4 of the privacy policy.
If we add a sub-processor that handles verification data, we will tell account holders by email before it starts.
International transfers
Our servers are outside the EU, so submitting EU personal data means transferring it out of the EU. We do not currently offer EU-only storage, and we would rather say that than imply a residency option we do not have.
Data Processing Agreement
We will sign a DPA with any customer who needs one, at no cost. Email info@sfemailverifier.com and say whether you want to use your paper or ours.
Data subject requests
If someone asks you to erase them and they are in a list you sent us, deleting that job removes them from our side entirely. If you need confirmation in writing, ask.
If you are the person whose address was checked rather than our customer, you can write to info@sfemailverifier.com and we will remove your address from our cache and pass the request to the customer who submitted it.
Security
Traffic is encrypted in transit, passwords are hashed, API keys can be rotated by you at any time, and access to production is limited to the people who operate the service. If a breach affects your data we will tell you without undue delay.