Privacy Policy

2. How We Use Your Data

2.1 Service operations

Data is used to process verification jobs (including scheduled recurring jobs), present results and reporting, manage credit balances, and support account and team management features.

2.2 Support and communication

Contact submissions and support tickets are used to respond to inquiries and improve service quality. We may send transactional emails regarding your account activity, verification results, and billing events.

2.3 SMS notifications

If you provide a phone number and opt in, we send transactional SMS alerts (e.g., low credit warnings, bulk job completion). We do not use your phone number for marketing.

2.4 Security

Login activity records, two-factor authentication data, and session information are used to detect unauthorized access and protect your account.

3. Data Handling Principles

• We do not send emails on your behalf from uploaded lists.
• We do not resell customer-uploaded contact data.
• We apply appropriate safeguards for stored service data.
• We do not use your data for advertising or profiling.

4. Teams and Shared Data

If you join or create a team, your email address and name are visible to other team members. Verification jobs, results, and credit usage within a team workspace are shared among team members according to their assigned roles. The team owner is the data controller for team-level data.

5. Third-Party Services

We use the following categories of third-party service providers to operate the platform:

• Payment processing, Stripe processes payments and stores card details under their own privacy policy.
• Authentication, Google OAuth may be used for sign-in. We receive only your name and email address from Google; we do not access your contacts, calendar, or other Google data.
• SMS delivery, If SMS is enabled, Twilio delivers text messages. Your phone number is transmitted to Twilio solely for message delivery.
• Infrastructure, Hosting, database, caching, and background processing providers handle data as needed for platform operations.

6. Webhooks and External Data Delivery

If you configure webhook endpoints, Mailthentic sends verification event data to your specified URLs. Webhook payloads are signed with HMAC for authenticity. You are responsible for the security of your receiving endpoints. We retain webhook delivery logs (status codes and timestamps) for debugging and retry purposes.

7. Cookies and Sessions

We group cookies by purpose, and we only set the ones you allow. You can change your choices at any time on the cookie preferences page, and withdrawing is as easy as agreeing.

7.1 Strictly necessary (always on)

Session and CSRF cookies keep you signed in and protect forms. A random device identifier (mt_did) lets us see when the same browser opens several accounts. It is first party, it is never shared with anyone, and it is never used to build a profile of you or to follow you onto other websites, which is why it is treated as strictly necessary and is not covered by the consent toggles.

7.2 Analytics (your choice)

Google Analytics and Microsoft Clarity tell us which pages are used and where people get stuck. Clarity records how a page is interacted with.

7.3 Marketing (your choice)

The Meta Pixel measures whether our advertising leads to signups, and it does involve sharing data with Meta, which may use it across other sites. An affiliate cookie (mt_aff) records which partner referred you so they can be paid.

7.4 Where you are changes your rights

In the EU, EEA, United Kingdom, Switzerland and Brazil, nothing beyond the strictly necessary cookies loads until you agree. In the United States you may opt out of the sale or sharing of your personal information at any time, and we honour Global Privacy Control signals automatically. Everywhere else you can change your settings whenever you like. If we cannot determine your location we apply the strictest rule.

7A. Preventing Signup Abuse

To stop one person creating many accounts to farm free credits, we record a salted hash of the signup IP address (never the raw address), the device identifier described above, and the network operator behind the IP, which tells us whether it belongs to a VPN or hosting provider rather than a home internet connection.

We rely on legitimate interests for this, specifically preventing fraud and abuse of the service. It is used only for that purpose. A signal here never blocks an account or bans anyone: at most, a signup that looks like a duplicate starts without free credits, and staff can review it. Using a VPN is not held against you on its own.

8. Data Retention and Deletion

8.1 Retention

Verification results are retained for as long as your account is active or as needed for operational and compliance purposes. Login activity records are retained for security auditing. Expired credits are automatically removed from active balances.

8.2 Data export

You may export your account data at any time through the Account settings in the dashboard.

8.3 Account deletion

You may permanently delete your account through the dashboard. This removes your personal information, verification history, team memberships, and all associated data. This action is irreversible.

9. Security Practices

We implement technical and organizational controls to protect service data, including:

• Encrypted data transmission (TLS/HTTPS)
• Hashed and salted password storage
• Optional two-factor authentication (TOTP)
• Session management with device tracking
• HMAC-signed webhook payloads
• Role-based access control for team workspaces

No system is entirely risk-free. Users should maintain strong passwords, enable 2FA, and revoke unused sessions.

10. Your Rights and Responsibilities

You are responsible for the lawful collection and use of data uploaded to Mailthentic and for compliance with applicable privacy regulations (such as GDPR, CCPA, or other local laws). You have the right to access, correct, export, or delete your personal data through the dashboard or by contacting support.

11. Policy Updates

We may update this policy from time to time. Material changes will be reflected on this page with an updated effective date. If changes significantly affect how we handle your data, we will notify you via email or in-app notification.

12. Contact Information

For privacy questions or data requests, please reach out via the Contact page.