1. Roles
When you upload, paste, import or send email addresses to Verifyre for verification, you are the controller and Sixty Seven Digital FZCO is the processor within the meaning of Article 28 GDPR. You decide the purpose (checking whether addresses are deliverable before you send) and the means (which addresses, when, via which channel); we process them only on your documented instructions, which are these terms, the product's settings and your use of the dashboard, API, widget and integrations.
For your own account details, billing and support correspondence we are a controller; that is covered by the Privacy Policy.
2. What processing happens
For each address we: parse it; look up DNS (MX, A, TXT records) for its domain; compare the domain and local part against disposable, free-provider and role lists; where the receiving server permits, open an SMTP session and ask whether the mailbox exists (RCPT TO), including a random-address probe for catch-all detection; derive a verdict, reason and score; store the result with the address for as long as the job exists; return it to you in the dashboard, the API, an export or by writing it back to a platform you connected.
No message is ever sent to the address. The SMTP session never issues a DATA command, so nothing reaches the mailbox and its owner is not contacted.
3. Categories of data and data subjects
Data: email addresses; any additional columns you include in an upload (we recommend including only what you need for the export); the verification result (verdict, reason, score, provider, MX hosts, flags, timing). Data subjects: the people whose addresses are on your lists, typically your customers, subscribers, leads or users. We do not know and do not infer anything about them beyond whether the mailbox accepts mail.
4. Your obligations as controller
You confirm that you have a lawful basis to hold and verify each address (for example, consent to a newsletter, a contract with a customer, or a legitimate interest in keeping records accurate), that your privacy notice covers verification of addresses with a service provider, and that you will handle any data-subject request that reaches you. Verifying addresses you have no right to hold (purchased, scraped or stolen lists) breaches our Terms and we will close the account.
5. Our obligations as processor
We will: process addresses only on your instructions and tell you if an instruction seems to breach the law; keep the data confidential and ensure staff with access are bound by confidentiality; apply the security measures in section 8; engage sub-processors only as listed in section 7, under equivalent terms, and notify you of changes; assist you with data-subject requests, security and impact assessments as far as the processing allows; delete or return the data at the end of the service; and make available the information needed to demonstrate compliance, including reasonable audits with notice.
6. Location and transfers
Verification runs on our own servers in Helsinki, Finland (Hetzner Online GmbH), inside the EU. Data at rest stays there. Sixty Seven Digital FZCO is established in the United Arab Emirates, which has no EU adequacy decision, so administrative access by our staff from the UAE is a transfer under Chapter V GDPR. That transfer is covered by the EU Standard Contractual Clauses (2021/914, Module 2, controller to processor) and the UK International Data Transfer Addendum, incorporated in the DPA, supported by the technical and organisational measures in section 8 (encryption at rest, TLS, least-privilege access, access logging, no bulk export of customer lists outside the EU). Swiss customers are covered by the same clauses adapted for the FADP.
7. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Dedicated servers and backups for the application and database | Helsinki, Finland (EU) |
| Cloudflare, Inc. | Optional edge network: TLS termination, bot and abuse filtering, visitor-country header, Turnstile human check on forms | Global edge; EU data centres for EU traffic; US entity under its own DPA and transfer mechanism |
| Stripe, Inc. | Card payments and receipts (your billing data, never the addresses you verify) | United States and Ireland, under Stripe's DPA |
Platforms you connect (Mailchimp, Klaviyo, Brevo, HubSpot and others) receive results on your instruction and are your own processors, not ours. We will give account holders at least 14 days' notice by email before adding a sub-processor that handles verified addresses; you may object on reasonable grounds and terminate if we cannot accommodate the objection.
8. Security measures (Article 32)
- Encryption of all disks at rest; TLS 1.2+ for every connection with HSTS; HTTP never serves content.
- Platform credentials encrypted with AES-256-GCM under a server-held key; API keys stored as SHA-256 hashes; passwords as bcrypt hashes.
- Server-side sessions with httpOnly, Secure cookies; staff access to production restricted to named individuals with hardware keys and logged.
- Network-level firewall, automatic banning of abusive sources, rate limits and bot filtering on every public endpoint, security headers and a mutation screener on every request.
- Daily encrypted backups retained 30 days; restore tested; migrations applied forward only.
- Logical separation of customer data by account; no pooling of lists; aggregate statistics only ever contain counts.
- Vulnerability handling: dependencies audited before each deploy; a security contact at security@verifyre.co with a two-working-day response target.
9. Retention and deletion
Addresses and results exist for as long as the job exists. Deleting a job deletes every address in it immediately from the live database; encrypted backups age out within 30 days. Single checks run from the dashboard or API are retained for 90 days, then reduced to counts. Closing your account deletes every job within 30 days. Per-domain facts (MX records, catch-all status, provider) are cached without any address attached. On request we confirm deletion in writing.
10. Data-subject requests
If a data subject contacts us about an address you verified, we will refer them to you within five working days and not respond on your behalf unless you ask us to. If you receive a request, you can find and delete an address across your jobs from the dashboard or ask support to do it. We hold no other data about data subjects.
11. Personal data breach
If we become aware of a breach affecting addresses you verified, we will notify you without undue delay and in any case within 48 hours of confirming it, with what we know about its nature, scope and likely consequences and the measures taken, and we will update you as the investigation proceeds, so that you can meet your own 72-hour obligation.
12. Audit
Once a year, or after a breach, you may ask for the information needed to demonstrate our compliance, and may conduct or commission an audit on 30 days' notice, during business hours, without disrupting the service, at your cost, under confidentiality. We will answer written security questionnaires within 15 working days.
13. The Data Processing Addendum
Business customers can sign a DPA that incorporates these terms, the Standard Contractual Clauses and the UK Addendum. Request it through the enterprise page or by email; we return a signed copy within two working days. For most customers these published terms, which already apply, are sufficient; the signed DPA exists for procurement teams that need a document on file.
14. Contact
Data protection enquiries: privacy@verifyre.co. Sixty Seven Digital FZCO, IFZA Business Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. We will name an EU representative under Article 27 where required and publish the details here.