Privacy policy

1. Who we are

MailSure operates the MailSure email verification service. For information about your own account, we are the "responsible party" under the Protection of Personal Information Act, 2013 (POPIA). For the email lists you upload or send to our API, you are the responsible party and we act as your "operator", processing that information only on your instructions (see section 5).

Privacy questions and requests go to privacy@mailsure.co.

2. What we collect

Account information

• Your email address and a password. We store only a salted hash of the password, never the password itself.
• If you pay before creating a login, we first create a temporary account for you so the payment has somewhere to go. It holds only your purchase, and PayPal's buyer email is offered to you when you finish setting up your login. Temporary accounts that never make a payment are deleted after a few days.
• Records of the emails we send you (the address, what kind of email, and whether it was delivered), kept for 90 days. We send receipts, password reset links and important notices about your account. We do not send marketing email.
• Your credit balance and a ledger of every credit added or used.
• API keys you create: a name, a short prefix and a one-way hash. The full key is shown once and we cannot retrieve it.

Email addresses you ask us to check

• Single checks and API requests: we process the address to return a result. We do not keep the address or the result after the response is sent. We record only that a credit was used.
• Uploaded lists: we store the entire file you upload: every row and every column, not just the email column, together with the results, so you can view and download them. Please remove columns you do not need before uploading.

Payment information

Subscriptions and credit packs are processed by PayPal. We keep your plan and its billing period, a PayPal reference for your subscription, and a record of each payment (amount, date and what it was for). We never see or store your card or bank details or your PayPal login.

Technical information

• Your IP address is used briefly in server memory to limit sign-ups and sign-in attempts and to prevent abuse. We do not write it to our database.
• Our servers and hosting provider may keep standard access logs (time, page requested, IP address, browser) for security and troubleshooting.

Cookies

We use a strictly necessary cookie that keeps you signed in (a signed session token, valid for 30 days) and one that remembers the colour theme you picked. We also use Google Tag Manager to measure how visitors use the public pages and whether our marketing works. Google may set its own cookies and receive your IP address, the pages you view and technical details of your browser. We do not send Google the email addresses you check, the contents of your lists or your account details. You can block these cookies in your browser settings or with a tracking-protection extension, and the site works the same without them.

3. How we use it

• To provide the service: verify addresses, run bulk lists, keep your credits and API keys.
• To take payment and manage your plan.
• To keep the service secure and prevent fraud and abuse.
• To contact you about your account, such as security notices or changes to these terms.
• To meet legal and accounting obligations.

We do not sell personal information, and we do not use the lists you upload for our own marketing or for any purpose other than returning your results.

4. How verification touches third parties

To check an address we look up the domain's mail servers in the public DNS. Where mailbox checks are switched on, we may also open a connection to that domain's mail server and ask whether it would accept mail for the address, then disconnect. We never send an email to the address. As a result, the receiving mail server may see the address being checked and the technical details of our verification server.

5. Your lists: you are the responsible party

You must have a lawful basis for processing the addresses you upload and for sending to them. We process them on your behalf, only to verify them and return the results, and we apply security safeguards to them. If you need a data processing agreement, contact us.

6. Who we share it with

• Hosting and infrastructure providers that run our servers and databases.
• PayPal, to process payments.
• Anthropic, whose AI model writes the optional report summaries for paying customers. It receives only technical facts about a result (for example a domain's mail setup, or the counts for a list), including the domain of a single address you ask us to summarise, but never the part before the @ and never the addresses in an uploaded list. If you ask the cold email checker for a written review, the text of that draft is sent to Anthropic to produce it.
• Authorities or advisers where the law requires it, or to protect our rights, always limited to what is necessary.

These providers may only use the information to deliver their service to us.

7. Where information is stored

Our servers are hosted in South Africa. PayPal processes payments in other countries, so some payment information crosses borders. Where information is transferred outside South Africa, we rely on recipients that are bound by comparable protections.

8. How long we keep it

• Account information: for as long as your account exists. Deleting your account (Account page) removes it, together with your API keys, credit history and lists, and cancels any active subscription.
• Uploaded lists and results: deleted automatically 30 days after upload. You can delete them sooner: from a list's page, all finished lists at once from your Account page, or by deleting your whole account. Deletion is immediate and permanent.
• Payment records: as long as the law requires us to keep financial records. When you delete your account they stay, but they are no longer linked to you: they contain no name or email address.
• Server logs: for a short period, then they are overwritten.

You can do all of this yourself from the Account page. If you can't sign in, email privacy@mailsure.co and we will act on a verified request within 30 days.

9. Security

We protect information with reasonable technical and organisational measures: encrypted connections, hashed passwords and API keys, restricted access to our servers and regular software updates. No system is completely secure, so if we become aware of a breach affecting your information we will notify you and the Information Regulator where the law requires.

10. Your rights

Under POPIA and, where it applies, similar laws such as the GDPR, you can ask us to:

• confirm whether we hold personal information about you and give you a copy
• correct information that is inaccurate
• delete information we no longer need
• stop processing your information or stop marketing to you

Email privacy@mailsure.co to make a request. If you are not satisfied with our response, you may complain to the Information Regulator (South Africa) at inforegulator.org.za, or to your local data protection authority.

11. People whose address is on someone's list

If your email address was uploaded or checked by one of our customers, we are processing it on that customer's behalf and we have no relationship with you. Ask the customer to remove you from their list, or contact us and we will pass your request on or delete the data where we can.

12. Children

The service is for businesses and adults. We do not knowingly collect information from anyone under 18.

13. Changes

We may update this policy. When we make material changes we will update the date above and, where appropriate, notify you by email. Continued use of the service after a change means you accept the updated policy.

14. Contact

MailSure
Email: privacy@mailsure.co