Last updated: October 28, 2026 (the website was added: accounts, sign-in, uploaded lists, subscriptions through our merchant of record, AI summaries, retention and what is kept when an account is deactivated; earlier: October 22, 2026, website and contact email changed to emailsignal.app; September 30, 2026, renamed from EmailVerify to EmailSignal)
This Privacy Policy explains how EmailSignal (formerly EmailVerify) ("we", "us", "our") collects, uses, stores and shares personal data when you use the EmailSignal apps on platforms such as Shopify, Wix and BigCommerce (the "Apps") and the EmailSignal website at emailsignal.app and its dashboard at web.emailsignal.app (the "Website"), together the "Service". It also describes your rights and how to use them.
By using the Service you acknowledge that you have read and understood this policy.
1. Who we are and our role
For data protection law, we have two roles:
- Data processor for the email addresses and lists you send us to verify. You (the store owner, site owner or account holder) are the DATA CONTROLLER: you decide why and how those addresses are processed, and we process them on your behalf, only to provide the Service.
- Data controller for the data about you as our customer: your account, sign-in, subscription and use of the Service, which we process to run the Service, keep it secure and meet our legal obligations.
As the user, you are responsible for making sure that your own use of verified data complies with applicable privacy and marketing law.
2. Data we process
Depending on how you use the Service, we process:
- Email addresses and lists you submit. Apps: customer and contact addresses fetched from your account through the platform's API. Website: addresses you type, paste, or upload in a file. An uploaded file is kept with all the columns it contains, so that the results can be returned in the same layout; if the file holds names, phone numbers or other data, we hold those too. Please remove what you do not need before you upload.
- Verification results. The outcome of each check (deliverable, risky, undeliverable, unknown, with a reason where there is one). Apps: written back to your account as customer tags or contact labels. Website: kept in your account with the list or single check, and offered to you as a download.
- Account data (Website). Your email address, your name if you give it, a password (kept only as a one-way hash) or, if you sign in with Google, the name, email address and account identifier Google gives us, the state of your email confirmation, and the time of your sign-ins.
- Account metadata (Apps). Your account identifier on the platform (for example the shop domain or site ID) and basic configuration data.
- Subscription and credit records. Your plan, its state and dates, the credits granted and used, and the identifiers our payment provider gives us for your subscription. We do not collect or see your card or bank details: payment is taken by our merchant of record (section 5).
- Usage and security data. Technical data from using the dashboard and the Website: IP address, browser type, pages visited, timestamps, and the results of bot-protection checks, kept in log files and, on the marketing site, in analytics tools (section 5).
- Counts, not addresses, for summaries. The dashboard's written summary of your results is prepared from totals (how many addresses had each status, by day). Your addresses are never part of it.
3. Legal basis for processing (GDPR)
If you are in the European Economic Area or the United Kingdom, we process personal data on these bases:
- Contractual necessity (Article 6(1)(b)): processing the addresses you submit, and your account and subscription data, is necessary to provide the Service you contracted for.
- Legitimate interests (Article 6(1)(f)): we process technical and usage data to maintain and improve the Service, prevent fraud and abuse (including repeated sign-ups for free credits) and keep it secure. Our interests do not override your fundamental rights.
- Legal obligation (Article 6(1)(c)): we may process data to comply with law or a valid legal order, including accounting and tax rules.
- Consent (Article 6(1)(a)): where we use analytics cookies or similar technologies that need consent, we rely on yours, which you may withdraw at any time.
4. How we use the data
We use the data described above only to:
- operate the Service and give you verification results, statistics and written summaries of them;
- write results back to your customers or contacts (Apps) or give them to you as downloads (Website);
- manage your account, sign you in, send the emails the Service needs (to confirm your address, to reset a password, to tell you a list is finished, about your credits and subscription) and respond to you;
- keep the Service secure and prevent fraud and abuse;
- improve how the Service performs, from aggregated and anonymised usage.
We do NOT sell personal data. We do NOT use the addresses you submit for marketing, profiling or any purpose other than verifying them for you.
5. Who else processes the data
To provide the Service we use the following categories of processors and recipients. All are bound to process data only for the purpose we engage them for and to keep it secure.
| Who | What for | What they receive |
|---|---|---|
| Email verification providers | Checking whether an address can receive mail | The addresses to check, and nothing else. A current list is available on request at contact@emailsignal.app. |
| Cloudflare (Cloudflare, Inc.) | Hosting, storage, databases, delivery and bot protection (Turnstile) | Everything the Website stores: accounts, lists and results, and the technical data of your requests. |
| Creem (creem.io) | Our merchant of record and payment provider for Website subscriptions: takes payment, handles tax, invoices, refunds and disputes | Your email address, plan and payment details. Creem is an independent controller of the payment data you give it; see its privacy notice. |
| Resend | Sending the emails of the Website | Your email address and the text of the message. |
| Google (Google LLC) | Signing in with Google, if you choose it | What you allow Google to share: your name, email address and account identifier. |
| OpenRouter and the language model it routes to | Writing the dashboard's summary of your results | Totals and rates only: counts by status and by day. Never an address. |
| Analytics tools on the marketing site and the App dashboards | Understanding use of the sites | Google Analytics (Google LLC) and Microsoft Clarity (Microsoft Corporation) on the marketing site; Microsoft Clarity and Smartlook (Smartlook.com, s.r.o.) in the App dashboards. The Website dashboard (web.emailsignal.app) uses no analytics. |
| Platforms | The Apps run inside platforms such as Shopify, Wix and BigCommerce | They process data under their own privacy policies. |
6. International transfers
We operate internationally and some of our processors are outside the European Economic Area. Where personal data is transferred outside the EEA, we make sure appropriate safeguards are in place: the European Commission's Standard Contractual Clauses, or an adequacy decision where there is one. You can ask for a copy of the mechanism that applies at contact@emailsignal.app.
7. How long we keep data
| Data | How long |
|---|---|
| Apps: addresses and results | While the App is installed on your account. Within 30 days of uninstallation they are deleted or anonymised, unless the law requires us to keep them longer. |
| Website: lists, results and single checks | A list, with its results, stays until you delete it (from its page). Whatever is still stored in the account, lists and single checks alike, is removed from our storage 60 days after you deactivate your account. If you reactivate the account within those 60 days, it is still there. |
| Website: account and billing records | Kept after deactivation: your email address and sign-in details, the account, its credits and its subscription records. We keep them for accounting and tax obligations, to support you if you return, and to prevent abuse, such as repeated sign-ups for free credits. You can ask us to erase more (section 9). |
| Technical and usage logs | Up to 12 months, then deleted. |
| Billing records held by our payment provider or by a platform | As long as their rules and the tax and accounting law require, up to 7 years. We do not control these. |
8. Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or disclosure, including:
- encryption of data in transit (TLS/HTTPS);
- passwords stored only as one-way hashes, and bot protection on sign-up and sign-in;
- access to data limited to authorised people;
- a separate area of storage for each account, and regular security reviews of our infrastructure.
No system is completely secure. If a personal data breach is likely to put people's rights and freedoms at risk, we will tell the people concerned and the supervisory authorities as the law requires.
9. Your rights
Depending on where you live, you may have these rights over your personal data.
European Economic Area and United Kingdom (GDPR / UK GDPR):
- access: a copy of the data we hold about you;
- rectification: correcting inaccurate data;
- erasure: asking us to delete your data where there is no good reason for us to keep it;
- restriction: limiting how we process it in certain cases;
- portability: receiving it in a structured, machine-readable format (Website: your results can be downloaded from each list);
- objection: to processing based on legitimate interests;
- withdrawal of consent, where processing rests on consent, without affecting what was done before;
- complaint: to your local data protection authority (for example the ICO in the UK, or your national authority in the EU).
California (CCPA / CPRA): the right to know what personal information we collect, use and disclose; to delete it; to opt out of its sale or sharing (we do NOT sell or share personal information as defined by the CCPA); and not to be treated worse for using these rights.
Erasure of Website data. You can delete any list, with its results, yourself. Deactivating the account removes everything stored in it after 60 days (section 7). If you also want your email address, your sign-in details or other records erased, write to contact@emailsignal.app: we handle those requests by hand, and erase what the law allows us to, keeping only what we are required to keep (for example invoices).
To use any of these rights, contact us at contact@emailsignal.app. We will reply within 30 days, or within the time the law requires. If you are one of the people on a list that a customer of ours submitted, please also contact that customer, who is the controller of that data; we will help them respond to you.
11. Children's privacy
The Service is for businesses and their authorised personnel. We do not knowingly collect personal data from anyone under 16. If you believe we have, write to contact@emailsignal.app at once.
12. Changes to this policy
We may update this policy. When we make a material change we update the "Last updated" date above and tell you in the dashboard or by email. If you keep using the Service after the new policy takes effect, you accept it.
13. Contact and data protection enquiries
For any question, concern or request about this policy: contact@emailsignal.app, or the contact page. We aim to answer every enquiry within 30 days.