1. Who we are
Verifyre (verifyre.co) is operated by Sixty Seven Digital FZCO, a company licensed in the IFZA free zone and registered at IFZA Business Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. In this policy "we", "us" and "Verifyre" mean Sixty Seven Digital FZCO. You can reach us at privacy@verifyre.co or through the contact page.
This policy explains what personal data we collect when you visit the website, use the free tools, create an account, verify email addresses, use the API or the form widget, or write to us, and what we do with it. It applies alongside our Terms of Service and, for business customers in the EEA, UK and Switzerland, our GDPR and data processing page.
2. Two roles: controller and processor
We act as a controller for the personal data we decide how to use: your account details, billing records, support correspondence, security logs and website analytics. Sections 3 to 9 cover that.
We act as a processor for the email addresses (and any other columns) you upload, paste, import or send to the API for verification. You decide why and how those addresses are processed; we process them only to return a verification result to you. Section 10 and the GDPR page cover that.
3. Data we collect as a controller
Account data. Name, email address, company name, password (stored as a bcrypt hash, never in clear text), time zone, credit balance, the date you signed up and the IP address of your sign-ins.
Billing data. The credit packs you buy, amounts, currency, invoice details and a payment reference from our payment provider. Card numbers are entered on and held by Stripe; we never see or store them.
Usage data. Jobs you run (name, size, counts of each verdict, timing), API keys you create (stored as SHA-256 hashes with a visible prefix), webhooks you configure, platforms you connect (credentials encrypted with AES-256-GCM), and the results of single checks you run from the dashboard.
Correspondence. Messages you send through the contact, enterprise or affiliate forms, and support email, together with the IP address the message came from.
Security data. Sign-in attempts (IP, email, outcome), security events (rate limits, blocked requests, honeypot hits), and the block list of IP addresses that abused the service. These are kept to protect the service and every customer on it.
Website analytics. Page path, referrer, country (from a CDN header), device class and a visitor identifier that is a salted hash of your IP address and browser, re-salted every day so it cannot be linked across days or to you. There is no analytics cookie and no third-party analytics script.
Free tool checks. The address or domain you enter into a free tool and the result, with the IP address the request came from, kept to enforce the hourly fair-use limits and to improve the engine. These are not linked to an account.
4. Cookies
We set one strictly necessary cookie: the session cookie that keeps you signed in. It is httpOnly, Secure and SameSite, and it holds a random token, not personal data. A second short-lived cookie is set only if you open a coming-soon preview link. Cloudflare Turnstile, which we use to tell people from bots on forms, may set its own cookie on the challenges.cloudflare.com domain when it runs; it does not track you across sites. We set no advertising, analytics or social cookies, so there is no cookie banner.
5. Why we use your data and on what basis
- To provide the service (contract): running your account, verifying addresses, delivering results, sending transactional email such as job completion notices and receipts.
- To bill you (contract and legal obligation): processing payments, issuing invoices, keeping accounting records.
- To keep the service secure (legitimate interest): detecting abuse, blocking attacks, limiting free-tool use, investigating incidents.
- To answer you (legitimate interest and contract): replying to support, sales and enterprise enquiries.
- To improve the product (legitimate interest): aggregate statistics on verdicts, timings and provider behaviour that contain no addresses.
- To send you product news (consent): only if you opt in, and every message has a one-click unsubscribe.
We do not sell personal data, use it for advertising, or build any dataset of email addresses from customer lists.
6. Who we share it with
Sub-processors and service providers, each bound by a contract: Hetzner Online GmbH (servers in Helsinki, Finland), Cloudflare, Inc. (edge network, bot protection and Turnstile, when enabled) and Stripe, Inc. (card payments). The current list and their locations are on the GDPR page.
Platforms you connect. When you connect Mailchimp, Klaviyo or another platform, we send verification results back to that platform on your instruction. Their handling of the data is governed by their own policies.
Legal requests. We disclose data only where a law we are subject to requires it, and we tell you unless we are legally prevented from doing so.
Business transfer. If Sixty Seven Digital FZCO is acquired or merges, your data moves with the service under the same commitments, and we notify you.
7. Where your data lives and international transfers
Our servers are in Finland, inside the European Union. Sixty Seven Digital FZCO is established in the United Arab Emirates, so staff access to the service from the UAE is an international transfer under GDPR and UK GDPR. We rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) for that transfer, with technical measures (encryption at rest, access logging, least-privilege access) described on the GDPR page. Stripe and Cloudflare operate globally under their own transfer mechanisms.
8. How long we keep it
- Account data: while your account exists, then 30 days after you delete it, except what we must keep for accounting (invoices, seven years) and security (block list entries, up to 24 months).
- Jobs and results: until you delete the job. Deleting a job removes every address in it immediately; encrypted backups age out within 30 days.
- Single checks from the dashboard and API logs: 90 days, then reduced to counts.
- Free tool checks: 30 days.
- Correspondence: three years from the last message.
- Security logs: 12 months; the block list up to 24 months.
- Analytics: aggregate only; raw page-view rows 13 months.
9. Your rights
Wherever you are, you can ask us to access, correct, export or delete the personal data we hold about you as a controller, object to or restrict processing based on legitimate interest, and withdraw consent at any time. Account holders can do most of this from the dashboard (edit profile, delete jobs, revoke keys, delete account). For anything else, write to privacy@verifyre.co; we answer within 30 days and may ask you to confirm your identity. If you are in the EEA, UK or Switzerland you may also complain to your local supervisory authority. Residents of California and other US states with privacy laws have equivalent rights of access, deletion, correction and non-discrimination; we do not sell or share personal data as those laws define it.
10. The addresses you verify
Addresses you upload, paste, import or send to the API are processed on your instructions as your processor. We use them only to return a verification result, store them only while the job exists, never combine them with other customers' data, and delete them when you delete the job. If someone whose address you verified contacts us, we will refer them to you as the controller and help you respond. Full processor terms, including our sub-processor list and security measures, are on the GDPR page, and a signed data processing addendum is available to business customers.
11. Security
Data is encrypted at rest and in transit, passwords are hashed with bcrypt, API keys are stored as SHA-256 hashes, platform credentials are encrypted with AES-256-GCM, sessions are server-side, and every public form and endpoint carries abuse protection. Details are on the security page. No system is perfectly secure; if we learn of a breach affecting your data we will notify you without undue delay and, where required, within 72 hours.
12. Children
Verifyre is a business tool and is not directed at children under 16. We do not knowingly collect their data; if you believe a child has created an account, tell us and we will delete it.
13. Changes
We may update this policy as the service or the law changes. The date at the top is the last substantive revision. For material changes we will email account holders or show a notice in the dashboard before they take effect.
14. Contact
Sixty Seven Digital FZCO, IFZA Business Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. Email privacy@verifyre.co. For data protection matters under GDPR you can also write to our EU contact point at the same address; we will name a representative where Article 27 requires one.