Privacy Policy

What we collect

• Account data: name, email address, password hash (bcrypt, never plaintext), OAuth provider id if you sign in with Google.
• Verification data: the email addresses you submit, and their verification results, so your history, exports, and filters work.
• Billing data: payment amounts and transaction references. Card details never touch our servers — Square and PayPal handle them on their own PCI-compliant infrastructure.
• Operational data: API key metadata (prefix and hash, never plaintext), rate-limit counters by IP, and standard server logs.

What we never do

• Sell, rent, share, or monetize your lists or verification data. Period.
• Send email to your leads. Verification uses SMTP handshakes that ask a server whether a mailbox exists — no message is ever composed or delivered.
• Use your submitted addresses for anything except returning you a verdict.

Legal bases (GDPR)

Where GDPR applies: contract performance (Art. 6(1)(b)) for providing the verification service; legitimate interests (Art. 6(1)(f)) for security, abuse prevention, and rate limiting; consent for optional product emails.

Retention

Verification records are retained until you delete them or close your account (data export available at deletion). Reset/verification tokens expire within 24 hours and are purged daily. Server logs roll on a 30-day cycle.

Your rights

Access, correction, export, and deletion are self-service in Settings. Anything else, email privacy@null-bounce.com and we respond within 30 days.

Subprocessors

• Database hosting (PostgreSQL provider)
• Square — card payments
• PayPal — alternative payments
• Resend — transactional email delivery (welcome, receipts, alerts only)

Contact

Questions: privacy@null-bounce.com. Postal address available on request for GDPR correspondence.