Privacy Policy
At CheckSignup, privacy is not an afterthought or compliance checklist—it is an architectural invariant. This Privacy Policy details how we handle developer accounts, process email validation queries at the network edge, and enforce our strict Zero-Plaintext Personally Identifiable Information (PII) Storage guarantee.
1. Privacy-by-Design Architecture & Core Invariants
CheckSignup operates as a real-time email intelligence and fake signup prevention platform. Unlike legacy data enrichment services that harvest, store, or sell consumer email lists, CheckSignup was engineered from day one on the principle of Zero Data Retention of Raw Queries:
Zero-Plaintext PII Invariant: CheckSignup NEVER stores, archives, or logs the raw plaintext email addresses submitted via our API or Live Sandbox to persistent storage or databases.
Our platform acts purely as an edge intelligence filter. We provide binary and heuristic risk signals (disposable domain detection, MX validity, canonical alias normalization, and typo corrections) without retaining your end users' personal data.
2. Categories of Information We Process
We delineate between the information required to manage developer accounts and the payload data submitted through our validation API:
| Data Category | Examples | Purpose & Handling |
|---|---|---|
| Developer Account Data | Name, email address, Google Profile ID, profile avatar. | Collected via Google OAuth 2.0 strictly for developer authentication, API key generation, tier access, and billing alerts. |
| In-Flight Validation Payloads | Target email address submitted to /validate. |
Held strictly in volatile edge memory for <30ms during classification; never written to persistent disk or databases in plaintext. |
| Ledger & Audit Metadata | Irreversible SHA-256(email) hash, domain name (e.g. gmail.com), request timestamp, token ID. |
Recorded in pre-settlement ledger for duplicate detection (idempotency), rate limiting, and accounting reconciliation. |
| Operational Telemetry | Client IP address, User-Agent, HTTP response latency. | Ephemeral DDoS defense, edge rate limiting, and firewall anomaly mitigation. Retained in rolling logs for up to 30 days. |
3. Ephemeral In-Memory Edge Validation Lifecycle
When your backend application or AI agent submits an email to our endpoint (POST /validate), the request undergoes the following lifecycle:
- Edge Ingestion: The payload is received at the closest Cloudflare edge node over TLS 1.3 encryption.
- In-Memory Evaluation: Syntax parsing, canonical alias stripping, Trie classification against 75,000+ disposable domains, and DNS MX checks are executed entirely in volatile runtime RAM.
- Immediate Discard: The JSON verdict is generated, response transmitted to your server, and the memory buffer holding the raw string is immediately released by the garbage collector.
- No Disk I/O: No unencrypted or plaintext email strings are ever written to disk, relational databases, cache layers, or external log collectors.
4. Cryptographic Hashing & Ledger Audit Trail
To maintain an auditable ledger for credit accounting and prevent duplicate deductions (via idempotency keys), we compute a one-way cryptographic digest using SHA-256:
Stored Record: sha256_hash = SHA-256(canonical_email)
This one-way mathematical hash cannot be reversed to discover the original user's email address, ensuring full pseudonymization in strict compliance with GDPR Article 4(5) and Article 32 security standards.
5. Legal Bases for Processing under GDPR & UK GDPR
For individuals residing in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process data under the following legal bases pursuant to Article 6 of the General Data Protection Regulation (GDPR):
- Performance of Contract (Art. 6(1)(b)): Processing developer account details and API credentials to fulfill our service agreement and provide email validation APIs.
- Legitimate Interests (Art. 6(1)(f)): Processing ephemeral queries and cryptographic hashes to defend web services from spam attacks, fake registration farms, credential stuffing, and botnets.
- Compliance with Legal Obligations (Art. 6(1)(c)): Retaining financial transaction records, invoices, and audit logs required under applicable corporate and tax laws.
6. Sub-Processors & Absolute Zero Data Sale Guarantee
Our Zero Data Sale Promise: CheckSignup does not sell, rent, monetize, license, or trade any personal data, developer contact lists, or customer email queries to third-party data brokers, advertising networks, or marketing companies. Period.
We utilize a minimal footprint of enterprise infrastructure sub-processors under strict Data Processing Agreements (DPAs):
- Cloudflare Inc.: Global Edge Network, Workers compute runtime, and DNS resolution infrastructure.
- Google LLC: Identity provider for Google OAuth 2.0 developer authentication.
- Stripe Inc. (optional for paid tiers): Payment processing and invoice management. We never store raw credit card numbers.
7. Data Retention & Multi-Tenant Isolation
Our retention schedules are designed to minimize data exposure:
- Raw Query Email Data: 0 seconds (ephemeral RAM execution only).
- SHA-256 Ledger Audit Logs: Maintained for active account billing history and fraud dispute resolution; purged automatically upon account termination.
- Developer Account Information: Stored for the duration of the developer account's active existence. Upon deleting an account, all associated API keys, profile data, and custom settings are deleted within 30 days.
- Multi-Tenant Isolation: Customer accounts and API key scopes are strictly compartmentalized. One tenant's usage analytics, keys, and quotas are cryptographically isolated from all other tenants.
8. Your Rights under GDPR, CCPA & Global Privacy Regulations
Depending on your jurisdiction (including EU/EEA under GDPR, UK under Data Protection Act 2018, California under CCPA/CPRA, and Virginia/Colorado/Connecticut state laws), you possess the following rights regarding your personal data:
- Right to Access: Request confirmation of whether we process your personal account information and obtain an export copy.
- Right to Rectification: Request correction of inaccurate account details.
- Right to Erasure ("Right to be Forgotten"): Request permanent deletion of your developer account and associated profile records.
- Right to Restriction of Processing: Request the limitation of processing under specific legal disputes.
- Right to Data Portability: Receive your account credentials and transaction ledger records in a structured, machine-readable JSON format.
- Right to Non-Discrimination: We will never deny services, charge differing prices, or provide degraded performance for exercising your statutory privacy rights.
10. Security Controls & Infrastructure Defenses
We implement rigorous technical and organizational security measures to protect data against unauthorized disclosure or access:
- End-to-End TLS 1.3: All inbound API traffic and internal RPC streams require modern cryptographic ciphers over HTTPS.
- Zero-Trust SSRF Guard: DNS queries for MX resolution strictly prohibit resolving to private IPv4 ranges (
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.1), link-local addresses, and cloud provider metadata endpoints. - Fail-Closed Authentication: All protected endpoints terminate immediately if authentication or token signatures fail.
11. Data Protection Officer (DPO) & Privacy Contact
If you have questions regarding this Privacy Policy, wish to exercise your statutory rights (such as data export or deletion), or need to execute an enterprise Data Processing Addendum (DPA), please contact our Data Protection Officer:
- Privacy Inquiries & DPO: privacy@checksignup.com
- Data Subject Rights Requests: dpo@checksignup.com
- Security Incident Response: security@checksignup.com