1. Summary
VeriList stores the minimum needed to run your account and validate your lists. We do not sell personal data, we do not build advertising profiles, and we do not send email to the addresses you upload.
2. Data we collect
- Account data: email address, optional display name, hashed password, account status, role, sign-in timestamps.
- List data: the files you upload and the results generated from them, including per-address classification and the DNS detail behind it.
- Billing data: invoice identifiers, plan, amount, currency, invoice status and the transaction identifiers reported by the payment processor. Card and bank details never reach our servers; Bitcoin payments are handled by the processor.
- Technical logs: IP address, user agent, request path and timestamps for security, rate limiting and abuse prevention.
- Product email: verification, password reset and invoice notifications sent to your account address.
3. Why we process it
Account and list data are processed to deliver the Service you requested (contract). Technical logs and rate-limit counters are processed for security and abuse prevention (legitimate interest). Billing records are processed to meet accounting and tax obligations (legal obligation). Product email is sent to operate your account.
4. What we do not do
We do not sell or rent personal data. We do not use uploaded lists for marketing. We do not contact the addresses in your lists, and we do not share your lists with third parties except the infrastructure needed to process them.
5. Processors
The Service relies on a small number of processors: a hosting provider for compute and storage, a DNS resolver to look up mail exchanger records, a Bitcoin payment processor for invoices, and an email delivery provider for transactional messages. Each receives only the data needed for its function. Depending on the operator's configuration, data may be processed outside your country; where required, transfers rely on appropriate safeguards.
6. Retention
Uploaded files and result files are removed after the retention period configured by the operator (default 30 days, adjustable in the admin console). Account records are kept while the account exists. Invoice and payment records are kept as long as accounting law requires. Security logs are kept for a short rolling window. Deleting your account removes account data and results that are still within retention.
7. Your rights
Subject to applicable law, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, a portable copy, and you may object to processing based on legitimate interest. Requests can be sent to the support address published on this site; we respond within the period required by law. You may also complain to your local data protection authority.
8. Security
Passwords are stored as salted scrypt hashes. Sessions use signed, HTTP-only cookies with CSRF protection. Access to the admin console is restricted by role and audited. Data in transit is protected by TLS when the Service is deployed behind HTTPS. No system is perfectly secure, so report suspected issues promptly and responsibly.
9. Children
The Service is intended for business use by adults. It is not directed at children and we do not knowingly collect their data.
10. Changes
Material changes to this policy are announced on this page with a new "last updated" date; continued use after a change constitutes acceptance.
11. Contact
Privacy questions and data requests: use the support address published on this site. Replace this section with your legal entity, postal address and, where applicable, the contact details of your data protection officer before launch.