Privacy Policy

The data controller is Eruditejasmine Unipessoal Lda, VAT PT518021475, Rua do Campo Alegre, 1517, 4150-182 Porto, Portugal.

Privacy requests: privacy@validmail.online. Legal requests: legal@validmail.online.

We process account data (name, email, authentication identifiers), billing data (transactions, tax details), operational logs, and validation job metadata.

Uploaded raw lists are processed for validation and then deleted according to retention rules below.

We process data to deliver the contracted service, secure the platform, prevent abuse, and meet legal accounting obligations.

Legal bases include contract performance, legal obligation, and legitimate interests in platform security and service integrity.

We use vetted subprocessors to operate the service: Supabase (database/auth), Vercel (application hosting), Revolut (payments), and Google Analytics (aggregated usage analytics).

A Data Processing Agreement (DPA) is available on request for business customers.

• Supabase: data storage and authentication (EU infrastructure).
• Vercel: application hosting and delivery.
• Revolut: payment processing and transaction data.
• Google Analytics: product usage measurement, enabled by default and user-disableable.

Raw uploaded email lists are deleted after processing completion and no later than 30 days in recovery/error scenarios.

Validation results and account operational data are retained while the account is active; after closure, data is deleted or anonymized according to legal obligations.

• Security logs: up to 12 months.
• Billing and accounting records: up to 10 years when legally required.
• Backup lifecycle follows infrastructure retention windows and secure deletion procedures.

You may request access, rectification, erasure, restriction, portability, and objection, subject to legal limits.

You may lodge complaints with the Portuguese supervisory authority (CNPD).

• CNPD: https://www.cnpd.pt
• Requests are handled through verified ownership and identity checks.

We apply encryption in transit, access controls, least-privilege policies, and audit logging to protect personal data.

No system can guarantee absolute security, but we continuously improve controls and incident response.

Cookie usage is detailed in our Cookie Policy. Analytics is enabled by default and can be disabled by the user at any time.

Disabling analytics does not block account access or core validation features.