Privacy Notice & Data Protection Practices

1. Controller vs. Processor operational duality

In accordance with data protection jurisprudence, MailCheckup operates under two distinct legal capacities:

• Data Controller: Secuno LLC acts as Data Controller for customer registration credentials, workspace billing details, direct support inquiries, and technical operational telemetry collected across mailcheckup.net and cp.mailcheckup.net.
• Data Processor: For all email addresses, contact lists, and subscriber databases uploaded or submitted via API for verification, the Customer acts as the Data Controller, and Secuno LLC acts strictly as a Data Processor pursuant to GDPR Article 28 and CCPA service provider rules.

2. Categories of personal data processed

We process only those categories of data strictly necessary to fulfill email verification and platform administration:

• Customer Account Credentials: Full name, corporate email address, encrypted password hash (bcrypt), and account creation timestamps.
• Financial & Billing Data: Transaction references, purchased credit pack volumes, Stripe customer tokens, and billing country. Raw credit card numbers and security codes (CVV) are processed directly by Stripe under PCI-DSS Level 1 compliance and never touch Secuno LLC servers.
• Verification Targets: Email strings submitted for syntax, MX, disposable, and SMTP handshake checks.
• Technical Telemetry: Client IP addresses, API user agent headers, request timestamps, and rate-limiting metrics.

3. Ephemeral RAM processing & zero payload delivery

MailCheckup was engineered with a strict privacy-by-design architecture. When an address is verified, our dialers execute an RFC 5321 diagnostic SMTP handshake in ephemeral system memory (RAM). The sequence issues HELO, MAIL FROM:<probe@...>, and RCPT TO:<target@...> commands, reads the remote server's diagnostic response code (e.g. 250 OK or 550 Mailbox Unavailable), and immediately issues a QUIT command.

Zero Email Message Delivery: We never transmit an email message body, marketing header, attachment, or actual communication to the recipient. The check is purely diagnostic at the network socket layer.

4. Legal bases for processing under GDPR Article 6

Our processing activities are grounded in explicit statutory legal bases under GDPR Article 6(1):

• Contract Performance (Art. 6(1)(b)): Providing API access, verifying uploaded batches, maintaining credit balances, and delivering customer service.
• Legal Obligation Compliance (Art. 6(1)(c)): Maintaining accurate financial ledgers, tax accounting records, and responding to lawful statutory requests.
• Legitimate Interests (Art. 6(1)(f)): Monitoring system security, preventing unauthorized Port 25 dictionary scanning, defending against denial-of-service attacks, and optimizing RFC handshake latency.

5. Zero data reselling, zero brokerage & no enrichment

Unlike legacy data brokers who monetize customer email lists by scraping contacts into shared B2B prospecting directories, Secuno LLC operates under an irrevocable Zero Data Broker Resale Policy.

We do NOT resell, license, rent, trade, monetize, share, or pool customer uploaded email addresses. We do NOT append demographic data, phone numbers, or social media handles for secondary monetization. Customer verification records remain strictly isolated within the customer's authenticated workspace.

6. Subprocessors and international data transfers

Customer data is hosted in Tier-4 Amazon Web Services (AWS) facilities located in the United States (us-east-1). We engage a strictly vetted, minimal list of technical infrastructure subprocessors (including Cloudflare for DDoS protection and Stripe for payments) governed by binding Data Processing Agreements.

For transfers of personal data from the European Union, European Economic Area, and United Kingdom to the United States, we execute the European Commission Standard Contractual Clauses (Decision 2021/914 Module 2) and UK IDTA to guarantee adequate data protection standards.

7. Automated data retention & self-service hard purge

In adherence to the GDPR storage limitation principle, customer verification files and completed reports are retained for thirty (30) calendar days from completion, after which automated serverless tasks cryptographically shred the files from our AWS S3 buckets.

1-Click Instant Purge: Customers who require zero residual storage can click "Purge List" immediately following export download. This action irreversibly unlinks and hard-deletes the underlying CSV data from our storage systems within seconds.

8. Global data subject rights (GDPR, UK GDPR, CCPA)

Under GDPR Chapter III and the California Consumer Privacy Act (CCPA/CPRA), individuals possess fundamental statutory data rights:

• Right of Access (Art. 15): Request a copy of the personal data held about you.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete account records.
• Right to Erasure ("Right to be Forgotten", Art. 17): Request deletion of personal records.
• Right to Restriction of Processing (Art. 18): Restrict processing during dispute resolution.
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing grounded in legitimate interests.
• CCPA Non-Discrimination: Freedom from discrimination for exercising privacy rights.

9. Technical & organizational security measures (TOMs)

Secuno LLC maintains enterprise-grade technical safeguards:

• Transport Security: Strict TLS 1.3 encryption across all REST API endpoints and web portal traffic with HSTS preloading.
• Storage Security: AES-256 server-side encryption across all AWS S3 storage volumes and PostgreSQL databases.
• Cryptographic Secrets: Customer API keys hashed using Argon2id; webhooks authenticated via HMAC SHA-256 signatures.
• Access Isolation: Multi-tenant workspace data segregation; strict principle of least privilege (PoLP) for administrative engineering access.

10. Contacting the DPO & supervisory complaints

To exercise your privacy rights or contact our designated Data Protection Officer, email privacy@mailcheckup.net or send physical mail to:

Secuno LLC
Attn: Data Protection Officer
30 N Gould St, Sheridan, WY 82801, USA
Phone: +1 (315) 961-7074

European residents also have the right to lodge a formal complaint with their national data protection supervisory authority (e.g. the CNIL in France, the BfDI in Germany, or the ICO in the United Kingdom).

The table below summarizes our data category processing taxonomy:

11. Frequently asked privacy questions