Privacy Policy

Who we are

SimpleVerifier (simpleverifier.com) is an email verification service. In this policy, “we” and “us” mean SimpleVerifier. We are the controller of the personal data described here. If you have a question about it, email [email protected].

This policy describes what the site and service actually do today. Our security page, subprocessor list and DPA template go into more detail. We keep it short and in plain English, and we update it when the product changes.

What we collect and why

Your account

You sign in with Google. From your Google profile we store your email address and your name in our account database, along with your plan, whether your subscription is active and the date your account was created. We use this to sign you in, give you access to what you pay for, and show your verification history. We do not store a password for you, and we do not store your Google profile picture in our database.

Payments

Payments are taken by Stripe in an embedded checkout. Your card details go directly to Stripe and never reach our servers. From Stripe we keep your email address, the name you entered at checkout, your plan and your Stripe subscription ID, and we look up your subscription status in Stripe to decide whether your account is active.

Lists you upload and addresses you verify

When you upload a CSV or check a single address, the file or address is sent to our verification server, which checks each address with DNS lookups and a conversation with the recipient’s mail server. Your verification jobs (the file name, the number of addresses, the results and a downloadable results file) are stored on that server against your account email so that your history and downloads follow you between devices, and are deleted 7 days after the list is submitted. On paid plans, a finished list's risky addresses (only those marked Send with care or Check again later, with their earlier status and reason, no other columns) and its job record without the results file are kept for 14 days after the list finishes, so you can re-check them; free accounts keep them only as long as the results file. Confirmed results are also cached by address, without your account, for 14 days, so a repeat check is instant. We do not use your lists for marketing, and we do not sell or share them.

Email finder and lead search

When you use the email finder, the first names, last names and company domains you enter are sent to our verification server, which tests likely addresses against the company’s mail server. When you use lead search, the business type and locations you enter are sent to the same server, and your monthly usage is recorded against your account email.

The results of these features are about third parties: publicly available business listings and information published on business websites, such as business names, phone numbers, addresses, owner names, contact emails and social profiles. If you are one of those people and want to know what we hold about you, or want it removed, email [email protected].

Phone numbers

Phone numbers you check are sent to our verification server to be parsed and formatted. With the phone add-on (or the older Email + Phone plan), a live carrier lookup also sends the number to Telnyx, which returns the line type and carrier. We record how many live lookups your account has used each month.

API keys

When you create an API key, we store only a SHA-256 hash of it, never the key itself, together with a short hint of its last characters so you can tell your keys apart, the date it was created and the time it was last used. Addresses and numbers you send through the API are handled the same way as the ones you check in the dashboard.

The free tools

• Email verifier: the one address you enter is sent to our verification server and checked; the result may be cached for up to 14 days like any other check.
• Catch-all checker: only the domain is used. If you type a full address, the part before the @ is discarded and a random address at that domain is tested instead.
• Email list health check: your list is processed in your browser. Only the domain names are sent to us, and that request is neither logged nor stored by our code.
• Deliverability, DNS record and DKIM checkers: only the domain (and DKIM selector, if you give one) is sent, for public DNS and blocklist lookups.
• Disposable email checker: the domain is looked up in a list bundled with the site. Nothing is sent to any third party.
• Email header analyzer, SPF and DMARC generators and the cost calculator: these run entirely in your browser. What you paste is never sent to us.

To stop abuse of the free tools, we count requests per IP address for one minute. That count is held only in memory and is not written to any database.

Analytics

We use Vercel Web Analytics, which counts page views without cookies and without storing your IP address. We also use Google Analytics 4 to understand how the site is used. Google Analytics is configured with advertising features off: ad storage, ad user data and ad personalisation are always denied. In the European Economic Area, the UK, Switzerland and Brazil, Google Analytics cookies are not set unless you accept them. See Cookies for details.

We also use PostHog to see which pages and steps people use, and to record sessions so we can find and fix problems. Recordings hide everything typed into form fields. PostHog keeps an anonymous visitor ID in your browser so we can see which steps lead to a purchase; in the EEA, the UK, Switzerland and Brazil it runs without cookies unless you accept analytics cookies. When you are signed in, we link your visits with a scrambled (hashed) version of your email address, so PostHog never receives the address itself.

Server logs

Like every website, our hosting provider records technical information about requests, such as your IP address, browser type, the page requested and the time. Our own code also writes a short log line with your email address when a subscription starts or ends, and logs errors. We use logs to keep the service running, fix problems and prevent abuse.

Emails we send

We are introducing email to account holders. Nothing is sent without an unsubscribe link, and one click in any email stops it. We never email the addresses in the lists you verify.

• Account and service emails: a few emails after you first sign in to help you use your free checks (for example, how to export a list from the tool you use), and messages about a checkout you started or your subscription. They contain no prices or offers.
• Tips and occasional offers: in the EEA, the UK, Switzerland and Pakistan, only if you tick the box on the sign-in page. Elsewhere the sign-in page says we send them, and you can tick a box there to skip them. Either way you can unsubscribe in any email.
• What we record: your choice, the country it was made from, the date and which wording you saw, so we can show what you agreed to. Some new accounts are placed at random in a group that gets no lifecycle emails, so we can measure whether the emails help.
• Who sends them: Resend, from mail.simpleverifier.com. Resend receives your account email, first name, that record, and product events such as “first check completed” or “checkout started” with the plan name. It never receives your lists.
• How long: while your account exists. If you unsubscribe, we keep that fact so you are not emailed again.

The Google Sheets add-on

The SimpleVerifier add-on for Google Sheets lets you verify a column of email addresses or phone numbers, or a single cell with the SV_VERIFY and SV_PHONE functions, using your own SimpleVerifier API key. It asks Google for these permissions (OAuth scopes), and uses each only for the reason given:

• spreadsheets.currentonly: to read the cells you choose in the spreadsheet the add-on is open in, and to write the results into new columns in that same sheet. It gives no access to any other file in your Google Drive.
• script.external_request: to send the values you choose to the SimpleVerifier API at simpleverifier.com and receive the results.
• script.container.ui: to show the SimpleVerifier menu and sidebar inside Google Sheets.

• What it reads: only the cells you select, or the column you pick, in the current sheet, plus the header row so it can show you the column names. It does not read other sheets, other spreadsheets or anything else in your Google account.
• What it writes: it inserts result columns next to the column you are verifying, in the same sheet, and fills them with the results.
• Your API key: stored in your Google user properties (Apps Script PropertiesService), which only you can read. The progress of a long run is kept there too, so it can resume. Removing the key in the sidebar deletes it.
• What it sends to us: each cell value you ask it to check, sent to the SimpleVerifier API only to verify it. Those checks are then handled like any other API call, as described above. Results of the single-cell functions are cached in the spreadsheet’s Google Apps Script cache for up to six hours so a sheet does not re-check the same value on every recalculation.
• What we do not do: we do not sell Google user data, use it for advertising, or transfer it to anyone except as needed to provide the add-on’s features, to comply with the law, or with your consent. No person at SimpleVerifier reads it unless you ask us to for support, it is needed for security, or the law requires it.

SimpleVerifier’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Instantly and Smartlead integrations

Subscribers can connect an Instantly or Smartlead account to verify the leads in a campaign.

• Your API key: checked with the provider, then encrypted with AES-256-GCM and stored on our server. It is never shown again, never sent back to your browser and never written to logs. Removing it in the dashboard deletes it.
• What we read: your campaign names, and for the campaign you choose, each lead’s email address, first and last name, company and lead ID. These become a verification job, kept for the same time as an uploaded list.
• What we change: nothing, unless you turn on write-back for a run. Then, after that run’s verification completes, we remove the leads marked invalid from that campaign and/or add those addresses to your block list, as you chose.

The Chrome extension

The SimpleVerifier extension for Google Chrome finds the email addresses and phone numbers on the page you are viewing when you ask it to, checks them in your browser, shows the open site’s mail setup, and runs live mailbox checks for signed-in accounts. It asks Chrome for these permissions and uses each only for the reason given:

• storage: to keep your default phone country, a random install id, a use count, your usage-stats choice and, if you paste one, your API key in the extension’s local storage in your browser profile (not synced).
• contextMenus: to add “Verify with SimpleVerifier” to the right-click menu. Chrome passes the extension only the text you selected, and only when you click that item.
• activeTab and scripting: to see the address of the tab you are on while the popup is open, and to read its text and mailto: and tel: links only when you click “Find emails and phone numbers on this page”.
• Access to simpleverifier.com: to read whether you are signed in and how many free live checks you have left, and to run the live checks you ask for, using your normal simpleverifier.com sign-in cookie, or the API key you pasted, which then counts each live check as an API call on your plan.

• Live checks: each address you live-check is sent to us with your sign-in and handled like any other check on the site, as described above.
• Page scans and free checks: the page’s text is read inside your browser, and the syntax, typo, disposable, role and phone-format checks run there too. None of it is sent to us or anyone else.
• Mail records: the domain of the open tab, and of an address you check on its own, is looked up through Cloudflare’s public DNS-over-HTTPS service (cloudflare-dns.com), which receives the domain name and your IP address.
• Usage stats: unless you switch them off in the popup, the extension sends anonymous usage events to PostHog under a random install id: event names, counts, live-check verdicts and which upgrade button was clicked. They never contain an email address, phone number, page address or domain, and are not linked to your account.
• What we do not do: the extension has no ads, loads no remote code, and we do not sell or share the data it handles. Its use of data is limited to checking the addresses and numbers you ask it to check and measuring, in aggregate, how the extension is used, and complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. More detail, including every event name, is on the extension privacy page.

Legal bases (GDPR and UK GDPR)

• Contract: your account, payments, verification jobs, the email finder and lead search, because we need this data to provide the service you signed up for.
• Legitimate interests: running the free tools, rate limiting, security, server logs, cookieless Vercel Analytics, and Google Analytics outside the regions where we ask for consent. We also rely on legitimate interests to process the public business information returned by the email finder and lead search, and you can object to that at any time.
• Consent: Google Analytics cookies for visitors in the EEA, the UK, Switzerland and Brazil. You can withdraw consent at any time using the buttons in the Cookies section.
• Emails: account and service emails rely on contract and legitimate interests. Tips and offers rely on consent in the EEA, the UK, Switzerland and Pakistan, and on legitimate interests with an opt-out elsewhere. See Emails we send.
• Legal obligation: keeping payment records that tax and accounting law requires.

How long we keep it

• Account record: kept while your account exists, and deleted when you ask us to delete it. There is no self-service deletion yet; we do it by hand.
• Verification jobs and results files: deleted 7 days after the list is submitted (a list still running is kept until it finishes), so download your results within that time.
• Risky rows kept for a re-check: only the addresses a list marked Send with care or Check again later, with their earlier status and reason. Free accounts: deleted with the results file. Paid plans: kept, with the list’s job record but not its results file, for 14 days after the list finishes, then deleted. Safe and invalid addresses and your other columns are never kept for this.
• Cached verification results: used for 14 days, then deleted.
• Rate-limit counters: about a minute, in memory only.
• Google Analytics data: kept by Google for the retention period set in our Google Analytics account.
• Payment records: held by Stripe, and kept for as long as tax and accounting law requires.
• Server logs: kept by our hosting providers for their standard log retention periods.

Who we share it with

We do not sell your personal data, and we do not share it for advertising. We use these service providers (processors) to run SimpleVerifier. They process data only on our instructions:

• Google: Sign-in with Google, and Google Analytics 4 (privacy policy)
• Stripe: Payments and subscription billing (privacy policy)
• Supabase: Database holding your account record (privacy policy)
• Vercel: Website hosting, server logs and cookieless Web Analytics (privacy policy)
• PostHog: Product analytics and session recordings (US data region) (privacy policy)
• Contabo GmbH (Germany): Hosts our verification server (api.simpleverifier.com), which runs the SMTP checks, the email finder and lead search, stores verification jobs and holds API keys (privacy policy)
• Telnyx: Live phone carrier lookups with the phone add-on; the phone number is sent to Telnyx (privacy policy)
• Resend (United States): Sends our account and lifecycle emails and handles unsubscribes (see Emails we send) (privacy policy)

To verify an address, our server connects to the mail server responsible for that address’s domain and asks whether it would accept mail for it. No email is sent. We may also disclose data if the law requires it.

International transfers

Our service providers process data in several countries, including the United States. When personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the safeguards our providers offer, such as the European Commission’s Standard Contractual Clauses or the EU-U.S. Data Privacy Framework where a provider is certified.

Your rights

Wherever you live, you can ask us what data we hold about you, ask us to correct it, or ask us to delete it. Email [email protected] from the address on your account, and we will reply within 30 days. We may need to confirm your identity first. We will never treat you differently for using your rights.

• EEA and UK (GDPR and UK GDPR): you have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests, and to withdraw consent at any time. You can also complain to your local data protection authority, or in the UK to the Information Commissioner’s Office.
• Brazil (LGPD): you can confirm whether we process your data, access it, correct it, have unnecessary data anonymised or deleted, port it, learn who we share it with, and revoke consent. You can also complain to the ANPD.
• California (CCPA): you can ask to know what personal information we collect, use and disclose, and ask us to correct or delete it. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Cookies and local storage

• Sign-in cookies (strictly necessary): when you sign in, NextAuth sets session, CSRF and callback cookies so you stay signed in securely. The site cannot work without them, so they do not need consent.
• Free-trial cookie (strictly necessary for the trial): sv_dev, a random device ID set when you are offered the free trial, used only to allow one trial per device. With it we keep a scrambled (salted, one-way) hash of your IP address and your card’s Stripe fingerprint for the same purpose, for as long as the trial record exists.
• Email choice cookie (strictly necessary): sv_email_pref, set when you press Continue with Google on the sign-in page. It carries your email choice through the Google sign-in and expires after one hour.
• Google Analytics cookies: _ga and _ga_0T3ME1CD3N, used to tell visits apart. In the EEA, the UK, Switzerland and Brazil they are set only after you click Accept on the cookie banner. Elsewhere they are set by default, and you can turn them off below.
• Your cookie choice: stored in your browser’s local storage under the key sv-analytics-consent, so we do not ask again on every page. It never leaves your browser.
• Vercel Web Analytics: uses no cookies.
• PostHog: stores an anonymous visitor ID in a cookie and local storage. In the EEA, the UK, Switzerland and Brazil it does this only after you accept analytics cookies. Turning analytics off below removes it.

We use no advertising cookies. To change your choice, use the buttons below. “Turn off analytics cookies” stops Google Analytics and deletes their cookies from this browser. “Reset my cookie choice” forgets your earlier answer, so visitors in Europe and Brazil see the banner again. You can also clear this site’s data in your browser settings.

Children

SimpleVerifier is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, email [email protected] and we will delete it.

Security

The site is served over HTTPS, the account database is read and written only by our server-side code, and card payments are handled entirely by Stripe. No system is perfectly secure, but we limit what we collect so there is less to protect.

Changes to this policy

When we change how we handle data, we update this page and the “Last updated” date at the top. If a change is significant, we will say so clearly on this page.

Contact

For any privacy question or request, email [email protected].