Who we are
SimpleCold is an email verification service. It checks whether email addresses can receive mail and explains each result. This policy covers simplecold.com, the SimpleCold dashboard, the API and the free tools on this website.
In this policy, "SimpleCold", "we" and "us" mean the business that runs the service. You can reach us about anything in this policy at [email protected].
When you upload a list or send addresses to check, we process the people in that list on your behalf and on your instructions. For that data you are the controller and we are your processor; the GDPR and DPA page explains that part. This policy is about the personal data we decide how to use: your account, billing, our website, and the records we keep to run and protect the service.
What we collect
Your account and organisation
- Your name and email address. If you add them, your job title, phone number and how you heard about us.
- If you sign in with Google: the name, email address and profile picture link that Google shares with us. We don't receive your Google password.
- Your organisation's name and the people in it, including the email addresses of people you invite.
- We don't store passwords. You sign in with a one-time code sent to your email, or with Google.
Billing
- Payments are taken by Stripe on its own checkout page. Your card details go to Stripe and never reach our servers.
- We keep a record of each purchase: the amount, the number of credits, the currency and Stripe's payment and invoice references.
The addresses you check
- Every address you check (in the dashboard, through the API or with a free tool) and its result: the domain, category, reason, failure type, mail server and website country, website language and any typo suggestion.
- Files you upload, including every column in them, plus the results files we create from them. Bulk jobs also store the file name and counts.
- If you connect HubSpot: the access tokens HubSpot gives us, and the contacts we import from the list you pick (contact ID, email, first name, last name).
- API keys: we store only a one-way hash of each key and a short hint so you can recognise it.
- A record of actions in your organisation, such as a job started or an API key created. For single checks this record holds a count, not the addresses.
Our website and free tools
- What you type into a free tool (an email address or a domain) and the result.
- Your IP address, used to apply the daily free-check limits. We count by IP address (or, for IPv6, by the network block your address belongs to).
- What you send through our contact, demo, waitlist or newsletter forms.
- If you book a demo call, the booking details you give the calendar tool.
Technical logs
Our servers log requests to the dashboard and the API: the IP address, browser or client, the signed-in user ID and the full address of the request. An address you check through the API is part of the request address, so it can appear in these logs.
Support and feedback
When you email us or use our feedback board and help centre (run on Canny), we keep the conversation. Signing in to the feedback board from the dashboard shares your user ID, name, email address and organisation ID with Canny.
Why we use it
We use personal data only for these purposes. Where the GDPR or UK GDPR applies, the legal basis is shown next to each one.
| Purpose | Legal basis |
|---|---|
| Running your account and the service: sign-in, verification, files, results, team invitations | Performing our contract with you |
| Taking payment, issuing invoices and keeping financial records | Performing our contract; legal obligations |
| Service email: sign-in codes, invitations, job finished or failed, low credit notices | Performing our contract |
| Keeping the service secure: logs, rate limits, bot checks, blocking throwaway sign-up addresses, fraud prevention | Legitimate interests in protecting the service and our customers |
| Reusing a recent result for the same address instead of asking the mail server again (see below) | Legitimate interests in fast, accurate results and fewer requests to mail servers |
| Answering questions, support requests, demo requests and feedback | Legitimate interests; steps you ask for before a contract |
| Product news emails to customers: new features and important product changes | Legitimate interests (unsubscribe at any time with the link in any of these emails) |
| Complying with the law and defending legal claims | Legal obligations; legitimate interests |
The verification result cache
When we check an address, we store its result against the address. If the same address is checked again soon after, by you or by another customer, we may return the stored result instead of contacting the mail server again. Results are reused for up to 30 days if the mailbox was confirmed, 14 days if it was risky and 60 days if it was undeliverable; a result the mail server would not confirm is never reused.
The stored result holds the address and what we found about it (domain, category, reason, failure type, countries, website language, typo suggestion). It does not record which customer asked, which list the address came from or any other column from your file.
What we don't do
- We don't sell personal data or share it for advertising.
- We don't send email to the addresses you check. Verification talks to the mail server without delivering a message.
- We don't use analytics or advertising cookies on this website or in the dashboard. See the cookie policy.
Where your data is stored
SimpleCold runs in the United States. Our database is hosted by Neon on AWS in us-east-2 (Ohio), and our application, files and cache are hosted by DigitalOcean in the United States, with files stored in New York. Some vendors process data in other countries; the subprocessors page shows where.
If you are in the European Economic Area, the United Kingdom or Switzerland, this means your data is transferred to the United States. Where the law requires a transfer safeguard, we rely on the European Commission's Standard Contractual Clauses (with the UK addendum where it applies) or on an adequacy decision that covers the recipient.
How long we keep it
We don't delete data automatically yet. We keep your account and organisation details, purchase records, uploaded files, results files and the record of actions in your organisation for as long as your account exists.
You can ask us to delete your account, your files and your results at any time by emailing [email protected] from the email address on your account. We complete deletion within 30 days, except for records we must keep by law, such as purchase and invoice records, which we keep for as long as tax and accounting rules require.
Entries in the verification result cache are kept until deleted. If you want a specific address removed, email us and we will delete it within 30 days.
If you unsubscribe from product news, we keep your email address and the date on our do-not-email list for as long as we send product email, so we don't email you again. It stays there even if you delete your account, unless you ask us to remove it.
Sign-in codes expire after 10 minutes. Free-tool usage counters tied to IP addresses expire after about a day. Server logs are kept by our hosting provider's logging system for a limited period and are not copied elsewhere.
How we protect it
Connections to SimpleCold are encrypted, files are private and are downloaded through links that expire after a few minutes, and API keys are stored only as hashes. The security page describes what we do, and what we don't claim.
Your rights
Depending on where you live, you may have the right to:
- Get a copy of the personal data we hold about you.
- Have it corrected if it is wrong.
- Have it deleted.
- Receive it in a portable format.
- Object to, or ask us to limit, how we use it. To stop product news emails, use the unsubscribe link at the bottom of any of them: one click stops them, and account emails such as sign-in codes, receipts and job results keep arriving.
- Withdraw consent where we rely on it.
- Complain to your local data protection authority.
How to use them
Email [email protected]. We may ask you to confirm the request from the email address on your account. We reply within 30 days. You can download the results of any bulk job yourself from the dashboard at any time.
If your address was in a list one of our customers verified, that customer decides how it is used. Tell us which address it is and we will pass your request to the customer where we can identify them, and remove the address from our result cache.
Children
SimpleCold is a business tool and is not meant for anyone under 16. We don't knowingly collect data about children.
Changes to this policy
When we change this policy we update the date at the top. If a change affects how we use your data in a meaningful way, we tell account owners by email before it takes effect.
Contact
Questions or requests about privacy: [email protected]. Security reports: [email protected]. Anything else: [email protected].