Privacy Policy
Bluprise LLC ("ValidMy", "we") operates ValidMy.email and is the data controller for account data. For the email addresses you submit for verification, you are the controller and we are your processor — we handle them only to perform the verification you requested.
1. Data we collect
Account data
- Your name and email address.
- A bcrypt hash of your password. We never store your password in readable form and cannot recover it.
- Your API key, plan, credit balance, and billing cycle dates.
Verification data
- The email addresses you submit, and the verification result for each.
- Usage records: how many addresses you checked, when, the outcome counts, and the domains involved.
Payment data
Payments are processed by Stripe, Inc. Card numbers, CVCs, and bank details go directly to Stripe and never touch our servers. We store only your Stripe customer and subscription identifiers, and invoice metadata (amount, status, date, PDF link).
Technical data
IP addresses (used to enforce free-tier limits and to detect abuse) and standard server logs.
2. Why we process it, and our lawful basis
| Purpose | Lawful basis (UK/EU GDPR) |
|---|---|
| Provide verification and maintain your account | Performance of a contract |
| Take payment and issue invoices | Performance of a contract; legal obligation |
| Enforce rate limits and prevent abuse | Legitimate interests (service integrity) |
| Cache results for up to 30 days | Legitimate interests (efficiency, reduced load on third-party mail servers) |
| Respond to support requests | Performance of a contract; legitimate interests |
| Meet tax and accounting duties | Legal obligation |
3. How verification works, and what leaves our systems
To verify an address we perform DNS/MX lookups and open an SMTP conversation with the mail server responsible for that domain. During this we disclose the address being checked to that mail server — this is inherent to how email verification works and is the purpose you engaged us for. We never send an actual email to the address; the conversation is terminated before any message body is transmitted.
4. Retention
| Data | Retained for |
|---|---|
| Verification cache (address + result) | 30 days from the check, then purged |
| Usage log records | Life of the account, for billing and analytics |
| Account data | Life of the account, then deleted within 30 days of closure |
| Invoices and payment records | As required by tax law, typically 7 years |
5. Sharing
We do not sell personal data and we do not share your submitted lists with anyone for their own purposes. We use a small number of processors:
- Stripe, Inc. — payment processing and billing.
- Our hosting provider — runs the servers on which the Service operates.
- Upstash — Redis used for rate-limit counters (IP addresses and account identifiers only).
- Recipient mail servers — as described in section 3.
We may also disclose data where required by law, or to protect our rights, safety, or the integrity of the Service.
6. International transfers
We are based in the United States and our infrastructure is located in Europe. Where personal data is transferred across borders we rely on appropriate safeguards, including Standard Contractual Clauses where applicable.
7. Security
- All traffic is served over HTTPS with TLS; HSTS is enforced.
- Passwords are hashed with bcrypt.
- API keys are high-entropy random tokens and can be rotated from the dashboard at any time.
- Card data is handled exclusively by Stripe, a PCI-DSS Level 1 provider.
- Access to production systems is restricted and key-authenticated.
No system is perfectly secure. If we become aware of a breach affecting your personal data we will notify you and any relevant regulator as required by law.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our processing of your personal data, to data portability, and to withdraw consent. California residents additionally have rights under the CCPA/CPRA, including the right to know and to delete — and we confirm we do not sell or share personal information as those terms are defined.
To exercise any right, email kareem@bluprise.com. We will respond within 30 days. You may also complain to your local supervisory authority.
9. If you are a data subject whose address was verified
If someone submitted your email address to us for verification, we hold it only as a cached result for up to 30 days, and we act on the instructions of the customer who submitted it. Contact us at kareem@bluprise.com and we will purge it from our cache on request and, where appropriate, refer you to that customer.
10. Cookies
We use no advertising or tracking cookies. Your login session is held in your
browser's localStorage as a signed token, used solely to keep you signed in.
Clearing your browser storage signs you out.
11. Children
The Service is not directed to anyone under 18 and we do not knowingly collect their personal data.
12. Changes
We may update this policy. Material changes will be notified by email or in the dashboard before taking effect, and the "last updated" date above will change.
13. Contact
Bluprise LLC
A Delaware limited liability company, United States.
Registered mailing address available on request.
Email: kareem@bluprise.com