GDPR
Last updated: 1 November 2026
mailchecker ("mailchecker") follows the GDPR, and the UK GDPR for customers in the United Kingdom. This page describes the two roles we play and what each one means for you. The full detail is in the privacy policy.
For the addresses you submit, we are your processor
When you send an address to the API, check it in the dashboard, upload a file, or run it through Shield, you decide why those addresses are processed; we process them only to return a verdict. That makes you the data controller and mailchecker your data processor. As your processor we:
- process addresses only to verify them and return the result to you, never for our own purposes, and never sell, share or use them for marketing;
- record single-address checks in your account's verification history, which you can see and which you can ask us to delete;
- keep our request log and Shield check history with the address masked, for 30 days;
- delete uploaded files, their results and working data 30 days after upload, or as soon as you delete the list. A sweep runs every hour to remove lists that have passed 30 days;
- use only the providers listed in the privacy policy, each under data processing terms;
- make a data processing agreement (DPA) available on request: [email protected].
Verifying an address means contacting the mail server responsible for it and asking whether the mailbox exists. That request carries the address and nothing else. We never send email to the addresses you submit. Mail servers are run by other organisations around the world, so the address is necessarily seen by them; this is what verification is.
For your account, we are the controller
For the data that describes you as our customer (your account email, sign-in method, billing history, support conversations and usage records) we are the data controller. The privacy policy sets out what we collect, why, on what legal basis, for how long, and with whom it is shared.
Who processes data for us
| Provider | What for |
|---|---|
| Hetzner | Hosting of the service and its database |
| Cloudflare | Network protection and bot checks on our forms |
| Paddle.com | Payments, invoicing and tax, as merchant of record (Paddle is an independent controller of your payment details) |
| Brevo | Service emails, and live chat if you open it |
| Sign in with Google, only if you choose it |
Where data leaves the UK or the European Economic Area, the transfer relies on an adequacy decision or on standard contractual clauses.
Your rights
Whether the data concerns your account or an address in your list, you can ask us to provide access to it, correct it, delete it, restrict or object to its processing, or hand it over in a machine-readable form, and you can withdraw consent where we rely on it. Send requests to [email protected]; we answer within one month. If an address was submitted by one of our customers, that customer is its controller and we will pass your request on. You can also complain to the data protection authority in your country, such as the UK Information Commissioner's Office.
Security
Traffic to the API and the dashboard is encrypted in transit. Passwords are stored only as salted hashes and API keys as hashes. Access to production systems is limited to the people who operate the service and protected by strong authentication. Addresses are kept only as long as described above. If a personal data breach affects you, we will tell you without undue delay and as the law requires.