Privacy Policy

Two hats — read this first

Engage processes personal data in two roles: (a) as a controller for your account data (name, email, billing, usage) to run your account; (b) as a processor / limited controller for the business-contact data our Service finds & verifies (a target person’s professional email at their employer), processed for the legitimate interest of B2B communication, minimized to what’s needed to verify deliverability.

What we collect

Account: name, email, password hash, company, billing details (via our payment processor — we do not store full card numbers), API keys, usage logs.

Service inputs: the names/domains/lists you submit.

Service-derived: verification verdicts, MTA/provider signals (O365 vs Google), catch-all/DMARC/SPF/DKIM facts about domains (not persons), pattern observations.

Technical: IP, device, cookies.

Why (legal bases, GDPR Art. 6)

Contract (run your account), legitimate interests (B2B contact verification, security, fraud prevention, product improvement), legal obligation (tax, compliance), consent (marketing emails — opt-out anytime).

How we verify

To verify some mailboxes we perform a lightweight existence check with the mail provider. We do not send email to the target during verification, and we do not store message content.

Retention

Account data: while active + as legally required. Verification observations: cached for a bounded TTL to avoid re-probing, then expired. Erased observations are never resurrected (a delete = a real suppression, no re-probe).

Your rights

Access, rectification, erasure, restriction, portability, objection (GDPR); know/delete/opt-out of "sale" (CCPA — we do not sell personal data). Exercise via privacy@lrm.theplaybutton.dev or the suppression form.

Data-subject suppression (Art. 17 / CCPA delete)

If you are a person whose email was verified and you want it removed, submit the suppression form. We suppress and do not re-probe.

Sub-processors & security

Cloud hosting, payment (Stripe), transactional email, analytics. A DPA is available to business customers on request (dpa@lrm.theplaybutton.dev). Encryption in transit, secrets in a vault (no card storage), least-privilege access, audit logging. International transfers under Standard Contractual Clauses where applicable.