Privacy policy
Last updated: 14 October 2026
This policy explains what personal data Verimail Ltd collects when you use the Verimail website, dashboard, API and file verification service, why, and what we do with it. Verimail Ltd is a company registered in England and Wales (company no. 14045644), registered office 71 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Questions and requests: privacy@verimail.io.
Two kinds of data
There is your data as our customer, for which we are the data controller, and there are the email addresses you submit for verification, for which you are the controller and we are your processor. The GDPR page describes the two roles; this policy covers both.
The addresses you submit
- API. An address sent to the API is checked and the result is returned to you. We do not store it. It appears in our request logs for 30 days; if you send it in the request body (POST) rather than the URL, it does not appear in URL logs.
- Files. An uploaded file, its result file and the working data of the verification are stored in the European Union and deleted 30 days after upload, or as soon as you delete the file from the dashboard. The file's entry in your dashboard (name, dates, counts) stays without any addresses.
- The live check box on the website works the same way as the API and is protected by reCAPTCHA (see cookies below).
- Verifying an address means asking the mail server responsible for it whether the mailbox exists. That request carries the address and nothing else, and goes through verification servers we operate in several countries inside and outside the EU and the UK.
- We use submitted addresses only to verify them. We do not build lists from them, sell them, or use them for our own marketing.
Your data as our customer
| What | Why | Legal basis | Kept |
|---|---|---|---|
| Account: email address, sign-in method (Google, GitHub or email and password), the IP address at sign-up, your API key | To run your account, authenticate you, and prevent abuse | Contract; legitimate interest in security | While the account exists |
| Billing: plan, credits, payment history | To bill and to keep required financial records | Contract; legal obligation | While the account exists; invoices for the period required by tax law |
| Usage: request logs with IP address, endpoint, timing and status | To operate, secure and debug the service | Legitimate interest | 30 days |
| Support conversations | To answer you | Contract; legitimate interest | Up to 24 months after the last message |
| A customer record in our CRM (email address, plan) | To manage the customer relationship and send service notices | Legitimate interest | While the account exists, then deleted on request |
| Website measurement: the pages you view, a random identifier for your browser, and the campaign link that brought you, if there was one (see cookies) | To know which pages and campaigns bring customers | Legitimate interest | Up to 90 days in your browser; with your account record once you create one |
We send service emails: sign-up confirmation, file completion, billing and security notices. We do not send marketing email without your consent, and every marketing email has an unsubscribe link. We never use card details: payments are taken by Paddle, and we only learn that a payment succeeded.
Who we share data with
We share data only with the providers below, each bound by data processing terms, and only for the purpose stated. We do not sell personal data.
| Provider | Purpose | Where |
|---|---|---|
| Google Cloud | Database, file storage and the verification service | European Union |
| Firebase (Google) | Authentication and website hosting | United States (Firebase Authentication and the hosting CDN) |
| Paddle.com | Payments, invoicing and tax, as merchant of record | United Kingdom and United States |
| Postmark | Sending service emails | United States and European Union |
| HubSpot | Customer records and service notices | United States and European Union |
| Our event and email service | A record of sign-ups, account activity and payments, to understand how Verimail is used | European Union |
| Our marketing agency | Measuring which campaigns bring customers: your email address when you sign up, your payments (amount, currency, country) and the pages you view | European Union |
| Google reCAPTCHA | Abuse protection on the live check box | Worldwide |
| Google Ads and Analytics | Website and campaign measurement, without cookies unless you consent | Worldwide |
| Verification servers we rent from hosting providers | Contacting the mail servers of the addresses you submit | Several countries inside and outside the EU and the UK |
Where a provider processes data outside the UK or the EU, the transfer relies on an adequacy decision or on standard contractual clauses in that provider's data processing terms. We may also disclose data when the law requires it, or to protect the service, our users or the public. If Verimail Ltd is sold or merged, customer data passes to the new owner under this policy, and we will tell you beforehand.
Cookies and browser storage
- Pages on verimail.io store three first-party cookies, for up to 90 days: a random identifier for your browser, and the campaign link that first brought you here and the latest one, when there was one (the tags of an advertising or newsletter link). The identifier is also kept in your browser's local storage. We use them to count page views and to know which campaigns bring customers. When you create an account, they are attached to it. Google's measurement tag runs with consent set to denied: it sends no cookies and no identifiers, only aggregate signals.
- Google reCAPTCHA loads only when you use the live check box, and may set Google cookies needed to tell people from bots.
- Paddle's checkout sets the cookies it needs to take a payment when you buy.
- Your sign-in to the dashboard is kept in your browser's local storage by Firebase Authentication, not in a cookie. The dashboard also keeps your recent single-address checks in your browser's local storage; they are not sent to us. After a sign-up it stores a short code (not your address) so the sign-up is reported to our advertising measurement only once.
You can block cookies in your browser; the live check box and the checkout then will not work.
Your rights
You can ask us to give you access to your personal data, correct it, delete it, restrict or object to its processing, or hand it over in a machine-readable form, and you can withdraw consent at any time. Deleting your account from the dashboard removes your account record; files are removed at their 30-day mark, and we delete your CRM record and support history on request. Write to privacy@verimail.io; we answer within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or to the supervisory authority in your country.
Security
Traffic is encrypted in transit. Access to production systems is limited to the people who operate the service and protected by strong authentication. No system is completely secure; if a breach affects you, we will tell you without undue delay.
Children
The service is for businesses and professionals and is not directed at anyone under 18. We do not knowingly collect data from children; tell us if you believe we have.
Changes
When this policy changes we update the date at the top, and for a material change we email the address on your account before it takes effect.