Privacy Policy
Last updated: October 20, 2026
SignupSieve, Philippines ("we") operates the SignupSieve API and the free email checker on our website (together, the "Service"). This policy explains what data the Service processes, why, and for how long.
1. Roles
- For email addresses our customers submit, the customer is the controller and we are their processor: we process the addresses only to return results to that customer, and to protect all customers from fraud as described below.
- For our customers' account details, we and RapidAPI are controllers. RapidAPI handles sign-up, keys and payments under its own privacy policy.
2. What we process, and what we keep
| Data | What happens | Kept for |
|---|---|---|
| Email address submitted for a check | Analysed in memory to compute the result, then discarded. Never written to disk or a database. | Not kept |
Domain part of the address (e.g. acme.com) | DNS records, mail-server relationships and domain registration date are looked up and cached. Domain-level information about organisations, not individuals. | Cache: 24 hours. Mail-server graph: until removed |
| Address shape per company domain (e.g. "first.last") | Counted, without names | 180 days after the last check at that domain |
| Keyed one-way hashes (HMAC-SHA256 with a secret server key) of the inbox | Added to probabilistic counters (HyperLogLog) that detect repeated signups by one person at one customer, and bursts of signups at one domain. The counters cannot be reversed into addresses. | Per-customer repeat counters: 90 days. Domain burst counters: 30 minutes |
| End user's IP address (optional, only if the customer sends it) | Compared in memory against public cloud-provider and Tor exit-node lists, then discarded. Never stored. A keyed one-way hash of it counts distinct signups from that IP at that customer. | Hash counter: 1 hour |
Check result data inside the check_id | Numeric signal values (for example "name naturalness 0.4") are encoded and signed inside the check_id returned to the customer. We store nothing for the check. | Not kept by us |
| Feedback the customer sends (outcome for a check) | Stored with the numeric signal values, the customer's account ID and the domain, to train the model and compute domain reputation. Contains no email address. | Until the model no longer needs it, at most 24 months |
| Customer account ID (from RapidAPI) | Used to keep each customer's data separate and to bill usage | For the life of the account |
| Email address typed into the free checker on our website | Same as any check: analysed in memory, then discarded. Never stored. | Not kept |
| Visitor IP address on the free checker | A keyed one-way hash counts checks per visitor to enforce the free limit. The IP itself is never stored. | Hash counter: 1 hour |
| Service logs | Errors and slow requests: path, status, time and customer account ID. Never email addresses. | Up to 30 days (our hosting provider's log retention) |
3. Why (legal basis)
We process this data to prevent fraud: fake, automated and duplicate signups. Under the GDPR this is a legitimate interest (Recital 47). Customers are responsible for telling their own users that they use a fraud-prevention service.
4. Who else is involved (sub-processors)
| Provider | Role | Location |
|---|---|---|
| RapidAPI (Nokia) | API gateway, keys, billing | Per RapidAPI's privacy policy |
| Render | Application hosting | Singapore |
| Upstash | Redis | Singapore |
| Supabase | Postgres database | Tokyo, Japan |
| rdap.org and domain registries | Public domain registration lookups (domain names only) | Various |
5. Security
Traffic is encrypted in transit (HTTPS/TLS). The API accepts only requests that come through RapidAPI, except the free checker, which only answers our own website and is limited per visitor. Customer data is separated per account. Hashes are keyed with a secret that never leaves our servers.
6. International transfers
Our providers may process data outside your country. Where required, transfers rely on the providers' standard contractual clauses.
7. Your rights
Because we do not store email addresses, we usually cannot link stored data to a specific person. For requests about your data, contact the company that submitted your address (our customer), or contact us through the messaging option on our RapidAPI listing and we will help.
8. Changes
We will post updates here and on the RapidAPI listing.
Contact
SignupSieve: use the contact or messaging option on our RapidAPI listing.