--- title: "Privacy Policy - Emvero" description: "What personal data the service processes, why, for how long, and who else touches it." url: https://emvero.io/privacy/ language: en updated: 2026-10-10 --- Legal # Privacy Policy Last updated: 2026-10-10 ## 1. Who we are Emvero operates this service and is the controller for the data described here. Write to privacy@emvero.io; the same address reaches our data protection contact. ## 2. What we process, and why Two categories of data are involved, and they are worth separating clearly. ### Addresses submitted for verification When an address is submitted through this website or the API, it is processed to determine whether it can receive mail. That involves DNS lookups against the domain and, where warranted, an SMTP conversation with the receiving mail server up to the point of offering the recipient. **No message is delivered to the address.** The prober has no DATA stage. The conclusion is stored so that a repeat verification of the same address can reuse it when it is sufficiently fresh for the requested check depth, without probing a third party’s mail server again. Later checks may need updated evidence. Retention: 30 days, on the legitimate interest of not probing somebody else’s mail server twice for the same answer. ### Data about visitors to this website - **Counting your checks.** A check is charged to the credit balance of the account that ran it. What is kept for billing is the account and the day, as counts rather than addresses. Nothing is stored per visitor and nothing on your device. How fast one network address may ask is limited in memory and written nowhere. Classified as strictly necessary; not subject to consent. - **Product analytics.** Which pages and features are used, which verification statuses are returned, and roughly how long a check took. **The verified address is never sent to analytics**: not as a property, not in a URL, not in a page title, and not to any session-recording tool. - **Enquiries.** What you type into the contact form, so that sales can answer it. - **The language a page opens in.** For a URL without a language prefix, we use a supported `?lang=` value, then the `vl.locale.v1` cookie, then the first language in your browser's `Accept-Language` header if it is supported. If these preferences do not select a supported language, the page opens in English. Your network address is not used to choose the language. The language you view or choose is remembered in the cookie and browser local storage. This preference is classified as strictly necessary and does not require consent. ## 3. Lawful basis Contract for the verification you ask for. Legitimate interest for security, rate limiting and product analytics. Consent for anything in the analytics or marketing categories, and you can withdraw it at any time. ## 4. Who else touches the data Hetzner Online GmbH hosts the service in Germany. The machines verification probes from are provided by FastVPS OÜ, and every one of them is inside the European Economic Area; that work is moving to OVHcloud, also inside it. Paddle is the merchant of record for purchases and receives what taking a payment needs - your name, billing address, payment details and purchase history - which it handles as its own controller under its own privacy notice; a card number never reaches us. Google receives measurement signals without analytics cookies before consent or after refusal; analytics cookies and product events are enabled only once you have accepted analytics. Nobody else touches the data. ## 5. Where processing happens Storage happens in the EU, in Germany. Verification opens its SMTP session from a probe fleet, and every host in that fleet is inside the European Economic Area. The one exception is analytics, which travels under the European Commission’s standard contractual clauses. Google Analytics 4 loads immediately in Consent Mode and sends measurement signals without analytics cookies before consent or after refusal. Analytics cookies and product events require consent. ## 6. How long data is kept Verification results, 30 days. Account records, for as long as the account exists and 90 days after it closes. Enquiries, 24 months. Server logs, 14 days. ## 7. Your rights Access, rectification, erasure, portability, objection, and withdrawal of consent at any time. Write to privacy@emvero.io. You may also complain to your national supervisory authority. ## 8. Cookies and similar storage Described in the [cookie policy](https://emvero.io/cookies/). Your choice can be changed at any time from cookie settings. ## 9. Changes to this policy Material changes are published here with a new date, and sent by email to account holders at least 30 days before they take effect. ## 10. Contact privacy@emvero.io, or through [contact sales](https://emvero.io/contact/).