Privacy Policy for emailvalidation.io
Last updated: 27 October 2026
This website collects certain types of personal information from its users.
You can print this policy at any time by using your browser’s print feature.
Data Controller and Owner
Everapi GmbH
Getreidegasse 22
A-2284 Untersiebenbrunn, Austria
Commercial register: FN569823a
Managing director: Dominik Kukacka
Email: office@
Data protection officer: we have not appointed one. For privacy questions, write to office@
What Data We Collect
We may collect the following types of personal data, either directly or via third parties:
- First name
- Last name
- Email address
- API usage data
- Email validation results
Each category of data collected is described in detail in the appropriate section of this privacy policy or where specifically explained before data is gathered.
Users may voluntarily provide this data, while usage data is typically collected automatically when interacting with the site.
Unless otherwise noted, all requested data is necessary for proper functionality. If users fail to provide such data, we may not be able to offer our services effectively.
Where optional data is indicated, users can choose not to provide it without affecting service quality.
If unsure about what information is required, users are encouraged to contact the Owner directly.
This website does not use cookies for analytics or advertising. The free tools set one cookie that is strictly necessary for them: after an invisible Cloudflare Turnstile check, a cookie valid for two hours that only proves the check passed. The dashboard uses cookies to keep you signed in and for analytics.
Users are solely responsible for any third-party personal data shared through this Application.
How and Where Data Is Processed
Processing Methods
We implement suitable technical and organizational measures to prevent unauthorized access, alteration, disclosure, or destruction of personal data.
Data is processed using IT systems according to procedures closely aligned with stated purposes. Authorized personnel (such as staff in administration, marketing, legal, system operations) or third-party partners (e.g., hosting providers, IT firms) may access data when needed. These parties may be appointed as data processors, and an up-to-date list is available on request.
Processing Location
Our servers are rented from Hetzner Online GmbH and stand in data centers in Germany. Requests reach them through Cloudflare, which handles each request in one of its data centers, usually one near you; that data center can be outside the EU. Some of the service providers listed below are in the United States. See “Transfers Outside the EU” below.
Transfers Outside the EU
Some of our service providers are based in the United States or process data there. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). Otherwise, and in addition, we have agreed on the European Commission’s standard contractual clauses with the provider (Art. 46(2)(c) GDPR). You can ask us for a copy of these safeguards.
Data Retention
Unless otherwise stated, data is retained only as long as required for the purpose it was collected. We may keep it longer if required by law or with user consent.
Why We Process Data
We collect personal data for the following reasons:
- To deliver and maintain our email validation services
- To comply with legal obligations
- To respond to legal or regulatory requests
- To defend our rights and those of our users or third parties
- To detect and prevent misuse or fraud
- To improve our email validation algorithms and service quality
Examples of Processing
1. Contacting Users
When users fill out a contact form, we use the provided data to respond to inquiries.
Collected data: name, surname, email address
2. Hosting, Infrastructure and Service Providers
We use the following service providers to host and deliver this Application and its features. They process personal data on our behalf.
| Provider | What it does for us | Data it may receive | Location |
|---|---|---|---|
| Hetzner Online GmbH | Servers for the API, the email checks, the dashboard and our databases | All data described in this policy | Germany |
| Cloudflare, Inc. | DNS, network proxy and encryption (TLS) for the API and the dashboard; hosting of this website, the documentation and the free tools; storage of uploaded lists and exports; bot protection (Turnstile); delivery of contact form messages | API requests including the checked email addresses, uploaded lists and their results, single checks made with the free tools on this website and their results (cached for up to 7 days), website visits, contact form messages | United States, global network |
| Sentry | Error tracking | Details of requests that caused an error, which can include checked email addresses | United States |
| PostHog | Cookieless analytics for this website (no cookies, nothing stored in your browser; email addresses are removed from page addresses before an event is sent); dashboard analytics | Usage data; in the dashboard, recordings of page sessions | EU |
| Postmark | Sending account emails | Your email address and the content of the email | United States |
| Stripe | Payments and invoices | Billing details | Ireland, United States |
| Slack | Internal notifications to our team | Account name and email address | United States |
| Backblaze, Inc. | Backups of our main database, encrypted on our servers before upload; kept for 14 days | Encrypted copies of the database, including your account data; Backblaze cannot read them | Netherlands (Amsterdam) |
| Our email (Google Workspace), where messages to us and contact form messages are stored; bot protection on the sign-up page (reCAPTCHA); sign-in with Google, if you choose it | Your messages and contact details; for reCAPTCHA your IP address and browser information | Ireland, United States | |
| Anthropic, PBC | AI-assisted support: drafts replies to support requests, which then say that they were written with the help of AI. Anthropic does not use this data to train its models | Your message, its attachments and the account details needed to answer | United States |
| Adobe (Adobe Fonts) | The fonts of this website, loaded by your browser; no cookies | Your IP address and the address of the page | United States |
| A search data service | Finding a company’s website in the email finder | Company names entered in the email finder | United States |
Sign-in with another account
If you sign in to the dashboard with Google, GitHub, GitLab or Microsoft, that provider tells us your name and email address. Their own privacy policies apply to what happens at the provider.
Emails From Us
- Account emails such as sign-in links, invoices, payment reminders and usage alerts are part of the service and are sent through Postmark
- Product news: we may tell customers about new features and similar products of ours by email. You can turn this off in the notification settings of the dashboard or with the link in every such email
- Every email we send through Postmark is logged there so that we can see whether it was delivered
3. Email Validation Service
When users validate email addresses through our service:
- We process the email addresses provided for validation
- To check whether a mailbox exists, we ask the recipient’s mail server about the address; no email is sent
- We store validation requests and results on our servers to run the service, prevent abuse and answer support requests
- The log of each mailbox check keeps the checked address, its mail server and our conversation with that server for 90 days. After that, only the result without the address is kept for statistics
- Single checks you make in the dashboard are kept in your check history for 90 days, then deleted
- Lists sent to the bulk API and their results are deleted after 30 days, or right away when the user deletes the job
- Single checks made with the free tools on this website are cached at Cloudflare, together with their results, for up to 7 days
- We do not sell validated email addresses, and we share them only with service providers that process data on our behalf, such as those listed above
- We implement strict security measures to protect email data
Legal Basis for Processing
| Purpose | Legal basis |
|---|---|
| Your account, the API, the dashboard and payments | Performance of a contract (Art. 6(1)(b) GDPR) |
| Invoices and bookkeeping records | Legal obligation (Art. 6(1)(c) GDPR), Austrian tax law (§ 132 BAO) |
| Answering the contact form, support emails and AI-assisted drafting of replies | Steps before or performance of a contract (Art. 6(1)(b) GDPR); otherwise our legitimate interest in answering you quickly (Art. 6(1)(f) GDPR) |
| Analytics of this website and the dashboard, including session recordings in the dashboard | Our legitimate interest in understanding and improving our service (Art. 6(1)(f) GDPR) |
| Bot protection, rate limits, error tracking and security logs | Our legitimate interest in keeping the service secure and available (Art. 6(1)(f) GDPR) |
| Product news to customers | Our legitimate interest in direct marketing (Art. 6(1)(f) GDPR, § 174(4) TKG 2021); you can object at any time |
| Loading the fonts of this website from Adobe Fonts | Our legitimate interest in a consistent appearance of the website (Art. 6(1)(f) GDPR) |
More on Data Retention
- Account data (name, email address, company and settings) is kept until you delete your account
- Invoices and payment records are kept for 7 years after the end of the year, as Austrian tax law requires (§ 132 BAO)
- Our request log deletes the request URL, the IP address a request came from and its user agent after 90 days; the number of requests per day is kept for your usage history
- Our web server logs, which contain the request line and the IP address a request came from, are deleted after about 14 days
- Sign-in sessions end after 7 days
- Contact form messages and support emails are kept as long as we need them to answer your request and later questions about it
- Backups of our main database are kept for 14 days
- If you gave consent, the data is kept until you withdraw it
- Legal obligations can require us to keep data longer
- Lists sent to the bulk API and their results are deleted after 30 days
- The log of mailbox checks deletes the checked address, its mail server and the conversation with that server after 90 days
- Single checks made in the dashboard are deleted from your check history after 90 days
- Single checks made with the free tools on this website and their results are cached at Cloudflare for up to 7 days
Once the retention period ends, data is deleted and access/portability rights no longer apply.
GDPR Rights for Users
Under the GDPR, users have the right to:
- Withdraw previously given consent
- Object to data processing for specific reasons
- Request access to their data
- Verify or correct their data
- Restrict processing
- Have data deleted
- Receive data and transfer it to another provider
- Lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@
dsb , dsb.gv.at .gv.at
Users can also inquire about how data is protected when transferred abroad.
Objecting to Data Processing
If we process data under public interest or legitimate interest, users may object by explaining their specific situation.
Users may always object to direct marketing use without giving a reason. If objected, data will no longer be used for that purpose.
How to Use These Rights
To exercise these rights, users can contact the Owner using the contact details above. Requests are free and will be processed within a month.
If personal data has been shared with others, the Owner will attempt to notify them of any corrections or deletions, unless it’s impossible or overly difficult.
Additional Info
Legal Use
We may use personal data in legal proceedings or in preparation for legal action related to misuse of our Application or services.
Extra Information
Additional details about specific services or data handling may be provided on request.
System Logs and Maintenance
For maintenance and operational purposes, we or third parties may log interactions and collect information such as IP addresses.
Unlisted Information
Users can request further details about data practices by contacting the Owner.
Privacy Policy Updates
We may revise this privacy policy at any time. Users will be informed on this page or elsewhere in the Application. We may also notify users by email if possible.
Users should check this page regularly for updates. If consent is required for any changes, we will request it again as needed.
Legal Note
Unless otherwise mentioned, this privacy policy applies solely to this Application.
Definitions
- Personal Data: Information identifying a natural person, directly or indirectly.
- Usage Data: Automatically collected info like IP addresses, browser details, and time spent on pages.
- User: The person using this site.
- Data Subject: The individual to whom personal data refers.
- Data Processor: Entity processing data on behalf of the Data Controller.
- Data Controller: The party that determines how and why data is processed — in this case, the Owner.
- Service: The services provided via this Application.
- EU: References in this policy to the “EU” include both EU and EEA member states.