Data privacy

1. What this covers

This notice explains how Horizon Goods and Services, trading as Up, handles personal data in Email Finder Verifier.

There are two very different kinds of data here, and they are treated differently. There is data about you, our customer. There is also data about other people, the addresses you ask us to check. The second kind is the heart of this service, so it is set out plainly below.

2. Data about you

When you sign up we hold:

• your name, work email and, if you enter one, your company name,
• your API keys and the plan you are on,
• a record of your API calls: which endpoint, when, how long it took, and the outcome,
• billing details held by Stripe. We never see or store your full card number.

We use this to run your account, meter usage, take payment, prevent abuse, and reply to you. Our basis is performing our contract with you, and our legitimate interest in keeping the service safe.

3. Data about the people you check

When you submit an address, or a name and a company domain, you are sending us personal data about someone who is not our customer. This is what happens to it.

• We resolve the domain's mail server and open an SMTP conversation to ask whether the address is deliverable.
• No message is ever delivered to that person. They receive nothing and are not contacted.
• We store the address, the domain, the result, and the address pattern the domain appears to use, so repeat checks are faster and more accurate.
• For a domain that accepts every address, we may check whether the address matches a public account signal to reach a clearer answer.
• We do not sell this data, and we do not build marketing profiles from it.

For this data you are the controller and we act as your processor. You decide whose addresses are checked and you confirm you have a lawful basis for doing so. We act on your instructions, which are the API calls you make.

4. Who else sees it

We keep the list of third parties short and name them:

• Stripe, for payment processing,
• Clerk, for sign in and account security,
• Cloudflare, for serving the website and protecting it,
• Hetzner and Contabo, who host the servers that run the API and perform the checks.

We do not share your data with advertisers or data brokers. We disclose data only when the law requires it, and we tell you unless we are barred from doing so.

5. Where data is held

Our servers are in Germany and Finland. Our company operates from India.

Where personal data covered by UK or EU law moves outside that area, we rely on standard contractual clauses.

6. How long we keep it

• Account and billing records: while your account is open, then up to seven years where tax law requires it.
• Usage logs: twelve months, then deleted.
• Addresses you submitted and their results: retained while they stay useful as a cache. Ask us and we will delete a specific address or your full submitted set.
• If you close your account we delete or anonymise your data within ninety days, apart from records the law makes us keep.

7. Your rights

Depending on where you live you may ask for a copy of your data, ask us to correct or delete it, object to a use, or ask us to move it. Write to us and we will answer within thirty days.

If someone whose address you submitted contacts us directly, we will point them to you as the controller and help you respond.

You may also complain to your data protection regulator.

8. Keeping it safe

Traffic runs over TLS. API keys are stored hashed. Access to production is limited to named people and uses key based authentication.

If a breach affects your data we will tell you and the relevant regulator within seventy two hours of confirming it.

9. Cookies

The marketing site sets no tracking or advertising cookies. The dashboard sets only what is needed to keep you signed in, and one preference for light or dark mode.

10. Contact

Horizon Goods and Services, trading as Up, is the data controller for data about you, and the processor for data about the people you check. Our address is Bengaluru, Karnataka, India.

Questions go to [email protected].

11. Data processing terms

If you are covered by UK or EU data protection law, ask us for a data processing agreement and we will send one to sign before you go live.

It records that you are the controller, that we act only on your instructions, and how we handle a request from someone whose address you submitted.

12. Age

The service is sold to businesses, not to consumers, and is not intended for anyone under sixteen. We do not knowingly hold data about children.

13. Automated decisions

A verification result is produced automatically, but it is a factual answer about a mailbox rather than a decision about a person.

We do not profile anyone, score anyone, or make a decision that has a legal effect on the person whose address you check.

14. Changes to this notice

We may update this notice. The date at the top always shows the current version, and we announce a material change by email before it takes effect.