GDPR compliance

Last updated: 17 September 2026

Verimail Ltd is a company registered in England and Wales (company no. 14045644). We apply the UK GDPR and, for customers and data subjects in the European Economic Area, the EU GDPR. This page describes the two roles we play and what each one means for you. The full detail is in the privacy policy.

For the addresses you submit, we are your processor

When you send an address to the API or upload a file, you decide why those addresses are processed; we process them only to return a verdict. That makes you the data controller and Verimail Ltd your data processor. As your processor we:

• process addresses only to verify them and return the result to you, never for our own purposes;
• do not store addresses sent to the API; they appear in request logs for 30 days (send them by POST to keep them out of URL logs);
• delete uploaded files, result files and working data 30 days after upload, or as soon as you delete the file;
• use the sub-processors listed in the privacy policy, each bound by data processing terms;
• host the service and store data in the European Union;
• make a data processing agreement available on request: privacy@verimail.io.

Verifying an address means contacting the mail server responsible for it and asking whether the mailbox exists. That request carries the address and nothing else, and it is sent through verification servers we operate in several countries inside and outside the EU and the UK, because mail providers treat requests differently depending on where they come from. No other data about you or the address owner leaves the EU for this purpose.

For your account, we are the controller

For the data that describes you as our customer (your account email, sign-in method, billing history, support conversations and usage records) we are the data controller. The privacy policy sets out what we collect, why, on what legal basis, for how long, and with whom it is shared.

Your rights

Whether the data concerns your account or an address in your list, you can ask us to provide access to it, correct it, delete it, restrict or object to its processing, or hand it over in a machine-readable form. Send requests to privacy@verimail.io; we answer within one month. You can also complain to the UK Information Commissioner's Office or to the supervisory authority in your country.

Security

Traffic to the API and the dashboard is encrypted in transit. Access to production systems is limited to the people who operate the service and protected by strong authentication. Addresses are kept only as long as described above. If a personal data breach affects you, we will tell you without undue delay.