Data Processing Agreement
Last updated: October 20, 2026
This data processing agreement (DPA) governs, within the meaning of article 28 of the General Data Protection Regulation (GDPR), the processing of the email addresses a PricklyMails customer submits for verification and of the results of that verification. It supplements the Terms of Service and the Terms of Sale, of which it forms an integral part: it is accepted with them and applies from the creation of the account. A signed copy is provided on request. The French version is authoritative.
1. Purpose and scope
This agreement sets out the conditions under which PricklyMails processes, on behalf of an account holder (the "Customer"), the email addresses the Customer submits for verification and the results of that verification (the "entrusted data"). It applies when the Customer uses the service for a business, non-profit or public activity, not for purely personal use. When the service is used for purely personal purposes, PricklyMails applies exactly the same safeguards to the entrusted data. It does not cover the Customer's account data (identity of its users, billing, sign-ins), which PricklyMails processes as a controller, as described in its Privacy Policy. Where it conflicts with other PricklyMails terms on the protection of the entrusted data, this agreement prevails.
2. Parties and roles
The Customer is the controller: it chooses the addresses it submits, why it has them verified and what it does with the results. PricklyMails is the processor. The service is operated by Hugo Deltour, a micro-entreprise (sole trader) with registration in progress, operating as PricklyMails. No data protection officer has been appointed, as the appointment is not mandatory at PricklyMails' scale; the contact for any question about this agreement is legal@pricklymails.com.
3. Nature, purpose and duration of the processing
The sole purpose of the processing is to verify the deliverability of the addresses the Customer submits, then to return the result to the Customer. The Customer submits its addresses, one at a time or in batches, through the API, the dashboard or the PricklyMails MCP server. For each address, and depending on the active checks, PricklyMails checks the syntax, looks up the domain's mail servers in the DNS, detects disposable domains, role addresses (such as contact or support), free email providers and likely typos, then, if the SMTP check is active, connects to the domain's mail server and presents the address as a recipient, without ever sending a message. From this it derives a status and a score, which the Customer reads through the API and the dashboard; webhook notifications contain only the event, the job identifier, its status and the time. With a test key, no DNS query or SMTP connection takes place and the result is simulated. The processing lasts as long as the Customer uses the service, and this agreement applies for as long as PricklyMails holds data on the Customer's behalf.
4. Data and data subjects
The entrusted data are the submitted email addresses, which may contain a first or last name, and the results of their verification: status, reason, score, flags (disposable, role or free address, domain that accepts every address), mailbox provider name, names of the domain's mail servers, SMTP response code, suggested domain in case of a typo, and dates and durations of the checks. They also include the free-form references the Customer attaches to its submissions (row identifier, batch name). The data subjects are the people whose address the Customer submits, for example its customers, prospects, subscribers, users, contacts or employees. The service needs no special category of data within the meaning of article 9 of the GDPR, nor any data relating to criminal convictions, and the Customer undertakes not to submit any.
5. What PricklyMails keeps
The address is never written to the database or to any disk. While it is being verified, it waits in a temporary queue held in memory only, on the server, from which it is erased as soon as the verification ends, and after 96 hours at the latest. When the Customer supplies an idempotency key so that a resent request is not processed twice, a one-way hash (HMAC-SHA256) of the address is kept for 24 hours with that key, then removed by the daily cleanup. The history attached to the Customer's account holds, for each verification, an HMAC-SHA256 hash of the address and one of its domain, computed with a secret key, together with the result described in section 4. These hashes cannot be turned back into the address, but PricklyMails, which holds the key, can check whether a given address appears in the history: they are therefore pseudonymized data, which remain personal data within the meaning of the GDPR. The mail server names kept may reveal the domain of an address, never the part before the at sign; any text shaped like an address is removed from server replies before they are stored. Technical logs, kept for 28 days, and traces, kept for 8 days, do not contain the addresses (at most, on an error, the name of a mail server). The website analytics mask input fields, including the one where a list can be pasted. Finally, for a batch submitted from the dashboard, the list stays in the Customer's browser, in local storage and for the 16 most recent batches at most, so the downloadable report can be rebuilt; it is never sent back to PricklyMails. Likewise, an address verified on its own from the dashboard stays in that browser's local storage, for the 256 most recent at most, so the history can show it. Both are erased from the browser at sign-out and when the account is deleted.
6. Recent results shared between customers
Before querying a server, PricklyMails checks whether the same address, recognized by its hash, has been verified recently, whichever customer requested that verification. If so, it reuses that result instead of running the checks again, free of charge. How long a result is reused depends on its nature: 4 days for an inconclusive result, 28 days for a server response about the mailbox itself, 88 days for a finding that does not depend on the mailbox (syntax, domain, disposable or role address, for example). A customer who receives a reused result sees its verdict and original date, never the identity of the customer who obtained it, nor any other data from that customer's list. This pooling works both ways, and by accepting this agreement the Customer instructs PricklyMails to operate it.
7. The Customer's instructions
PricklyMails processes the entrusted data only on the Customer's documented instructions: this agreement, the terms of service and of sale, and the choices the Customer makes when using the service (addresses submitted, active checks, erasure requests). It does not use the Customer's lists for its own purposes: it does not sell, rent or enrich them, never writes to the addresses they contain and, without the Customer's written consent, does not use them to tune its verification engine. Apart from the verification itself, the only other processing is the pooling described in section 6 and aggregate counts, such as the total number of verifications, which identify neither an address nor a person. If PricklyMails considers that an instruction infringes the GDPR or another data protection rule, it informs the Customer immediately. Were it required by European Union or Member State law to carry out other processing, it would inform the Customer beforehand, unless that law prohibits it.
8. Confidentiality
PricklyMails guarantees the confidentiality of the entrusted data. To date, only Hugo Deltour, who operates the service, has access to the production systems; anyone who gains access in the future would be bound to confidentiality in writing, and trained in data protection rules. Support access to a customer account, from the service's administration, is reserved for support and leaves an audit trail. Data protection by design guides how the service is built, as the absence of address storage shows.
9. Security measures
PricklyMails implements technical and organizational measures appropriate to the risk, including: hosting exclusively with Hetzner, in Germany; TLS encryption of all exchanges with the service (API, dashboard, MCP server), reinforced by HSTS; pseudonymization of addresses, replaced in the database by one-way hashes; per-account data isolation; internal services unreachable from the internet and restricted, authenticated administrative access; secrets kept in an encrypted vault and never written to logs; API keys stored as hashes and revocable at any time; hashed passwords, two-factor authentication, lockout after repeated failed sign-ins, and request rate limiting; automatic security updates and automated checking of software dependencies; daily backups copied off the server; continuous monitoring with alerts. The details of these measures are provided to the Customer on request, under section 17. PricklyMails holds no security certification.
10. Sub-processors
The Customer grants PricklyMails a general authorization to engage sub-processors. The only one processing the entrusted data today is Hetzner Online GmbH (Germany), which hosts the server, its storage volumes and the backups within the European Union. PricklyMails also relies on Stripe Payments Europe, Limited (Ireland), for payments, and on Plus Five Five, Inc. (United States), which operates Resend, for account emails (confirmation, password reset, receipts); both may process data in the United States, but neither receives the Customer's lists or their results, and both are covered by the Privacy Policy. PricklyMails informs the Customer by email, at least 28 days in advance, of any addition or replacement of a sub-processor, stating its identity, its location and the processing entrusted to it, and updates this page. The Customer may object in writing within that period; failing a solution, it may end the service and obtain, under article 9 of the Terms of Sale, a refund of the unconsumed part of what it paid; tokens given for free are never refunded. PricklyMails enters into a contract with each sub-processor that imposes, in terms of data protection, obligations equivalent to those of this agreement, and remains fully liable to the Customer for their performance.
11. Technical exchanges inherent in verification
Verifying an address requires exchanges with outside services with which PricklyMails has no processing contract. The domain name of the address, never the part before the at sign, is resolved by a DNS resolver that PricklyMails runs on its own server, which queries the DNS servers that domain designates directly, without going through a public DNS service. When the SMTP check is active, the full address is presented to the mail server the domain itself designates, that is to the provider that already hosts that mailbox, wherever it is located; no message is sent, and this exchange, on port 25, is not encrypted. PricklyMails does not open it with Google, Microsoft, Yahoo and AOL, whose replies to such requests are not reliable. These connections leave from dedicated IP addresses hosted by Hetzner in Germany.
12. Transfers outside the European Union
The entrusted data are processed on a server located in Germany and kept within the European Union, and PricklyMails transfers them to no sub-processor established outside the Union. The only flows that may leave it are the exchanges inherent in verification described in section 11. Transfers to the United States related to payment and account emails concern account data, not the lists, and are safeguarded as described in the Privacy Policy. Any other transfer would be announced under section 10 and safeguarded in accordance with Chapter V of the GDPR.
13. Data subject rights
It is for the Customer to inform data subjects and to respond to their requests. PricklyMails assists it where possible, within time frames compatible with those the GDPR imposes on the Customer: from an address the Customer provides, it recomputes the hash to find the results attached to the Customer's account, then sends them to the Customer or erases them. If a person contacts PricklyMails directly, PricklyMails does not answer in the Customer's place: it forwards the request to the relevant customer when it can identify it, and otherwise invites the person to contact the organization that holds their address. The score assesses an address, not a person, and does not in itself amount to an automated decision within the meaning of article 22 of the GDPR; how the Customer uses it is the Customer's responsibility.
14. Personal data breaches
PricklyMails notifies the Customer of any personal data breach affecting the entrusted data, by email to the account address, without undue delay and no later than 48 hours after becoming aware of it; it aims to do so within 4 hours. The notification describes, as far as possible, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed to address it, and the contact point; what is not known at once is provided in phases, without undue delay. It is for the Customer, as controller, to notify the breach to the competent supervisory authority (the CNIL in France) and, where required, to the data subjects; PricklyMails provides the relevant documentation and records every breach.
15. Impact assessment and prior consultation
When the Customer carries out a data protection impact assessment, or consults the supervisory authority beforehand, PricklyMails assists it by providing the information it holds on the processing and on its security measures, starting with this agreement.
16. Data at the end of the service
As PricklyMails does not keep the addresses, it has none to return: results are delivered to the Customer as verifications complete, and remain available in its account for as long as the account exists. When the Customer deletes its account, the account is deactivated immediately, then PricklyMails permanently erases, once 28 days have passed, the history attached to it, hashes included, and confirms this in writing on request; the account is then anonymized, and only the billing and token entries PricklyMails must keep for its accounting obligations remain, with no name or address. The Customer may also request this erasure in writing at any time without deleting its account. Copies of this history held in backups disappear as the backups rotate, at the latest about eight months after the erasure; they are used only to restore after an incident, after which erased data would be erased again. Only aggregate counts then remain, which identify neither an address nor a person. Results that another customer obtained for the same address under section 6 belong to that customer's own account.
17. Documentation and audits
PricklyMails makes available to the Customer, on request, the documentation needed to demonstrate compliance with this agreement, first of all a description of its security measures and written answers to the Customer's reasonable questionnaires. It keeps the record of processing activities carried out on behalf of its customers required by article 30 of the GDPR. If this documentation is not sufficient, the Customer may have an audit carried out, including on site, by itself or by an independent auditor bound by confidentiality who is not a competitor of PricklyMails: at most once a year, except after a data breach or at the request of a supervisory authority, with at least 28 days' notice, during business hours, without disrupting the service or accessing other customers' data. The audit is at the Customer's expense, including the time PricklyMails spends on it beyond providing the documentation, based on a prior quote. Hetzner's facilities fall outside its scope; PricklyMails passes on the documentation Hetzner makes available to its customers.
18. The Customer's obligations
The Customer undertakes to have a legal basis for the addresses it submits, to inform the data subjects, to submit only the addresses needed for its purpose, to use as free-form references (row identifier, batch name), which are kept as provided, only opaque identifiers containing no email address, name or other information that directly identifies a person, to document any additional instruction in writing, and to ensure GDPR compliance throughout the processing, including through the audits provided for in section 17. It uses the results under its sole responsibility, in accordance with the Terms of Service.
19. Liability
The parties' liability under this agreement is governed, to the extent permitted by law, by article 11 of the Terms of Sale and by article 11 of the Terms of Service. It is without prejudice to the rights data subjects hold under article 82 of the GDPR.
20. Changes to this agreement
PricklyMails may update this agreement, in particular to follow changes to the service or to the regulations. Any substantial change is announced by email at least 28 days before it takes effect, and no change may reduce the protection of the entrusted data without the Customer's consent. The current version is published on this page.
21. Governing law
This agreement is governed by French law. Failing an amicable settlement, the competent courts are those provided for by the applicable rules, as in the Terms of Sale.
22. Contact
For any question about this agreement, to exercise a right it provides or to obtain a signed copy, write to legal@pricklymails.com.