Privacy Policy

1. Who we are

SkipBounce is operated by Werunads Agency SRL, [Registered address — fill in], Romania (registration no. [Company registration number — fill in]). For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for your account data and the data processor for the email addresses you submit for validation (see section 14).

Contact for privacy matters: privacy@skipbounce.com.

2. Summary

• We never send email to the addresses you validate. Validation opens a conversation with the receiving mail server and stops before any message would be transmitted.
• Validation results are deleted automatically 48 hours after a job completes. You can delete them sooner at any time.
• The servers that perform the mailbox check store nothing. They hold addresses in memory only for the duration of a check and never write them to disk or logs.
• We do not sell personal data, build marketing profiles, or share validated addresses with anyone.
• Klaviyo API keys are stored encrypted and used only for the actions you explicitly trigger.
• Google Sign-In gives us only your name, email address and profile picture — nothing else.

3. Data we process

3.1 Account data (you are the data subject)

• Email address and password hash (email sign-up), or Google account email, name and profile picture (Google Sign-In).
• Plan, usage counters, API keys (stored as one-way hashes), and billing status.
• Payment data is handled by Stripe. We store a Stripe customer reference; we never see or store card numbers.
• Support correspondence you send us.

3.2 Validation data (your contacts are the data subjects)

• Email addresses you submit via the dashboard, file upload, API, or Klaviyo integration.
• Per-address results: status, score, technical checks, the mail server's reply, and typo suggestions.

3.3 Technical data

• Server logs containing IP address, timestamps, request paths and status codes for security and debugging.
• For the free landing-page checker, a salted hash of your IP address to enforce the daily limit — not the IP itself. These rows are purged after two days.

Request bodies containing email addresses are excluded from our logs by design.

4. What happens to an address you validate

1. Your browser or API client sends the address to our application (hosted on Vercel, see section 9).
2. The application forwards it over an encrypted, authenticated connection to our validation server, which checks syntax, DNS records, disposable-domain and blacklist lists, and performs an SMTP-level mailbox check.
3. The validation server returns the result and discards the address. It has no database and does not log request contents.
4. For single checks, the result is shown to you and not stored. For bulk, API batch, and Klaviyo jobs, results are stored in our database so you can view, filter and export them — for a maximum of 48 hours after completion.

The mailbox check contacts the recipient's mail server (for example, Google's servers for a Gmail address). That server sees our sending hostname and the address being checked, exactly as it would during normal email delivery. No message content is ever sent.

5. Purposes and legal bases

6. Google Sign-In

You can create an account or log in with your Google account. When you do, Google shares your email address, name and profile picture with us via OAuth. We request no other Google scopes: we do not access your Gmail, contacts, calendar, Drive or any other Google data, and we do not send email on your behalf.

We use this information solely to create and identify your SkipBounce account. SkipBounce's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke SkipBounce's access at any time from your Google account permissions; you can then still log in with an email and password if you set one.

7. Klaviyo integration

If you connect Klaviyo, you provide a Klaviyo Private API Key. We store it encrypted with AES-256-GCM; the encryption key lives only in our application's server environment. The key is decrypted server-side, only for the actions you trigger:

• Listing your lists and segments (and their profile counts) so you can pick one.
• Reading the email addresses of profiles in a list or segment you choose to analyze.
• Writing back to Klaviyo only when you explicitly confirm a clean action: either suppressing selected profiles, or setting skipbounce_status, skipbounce_score and skipbounce_checked_at properties on them.

We never modify, delete or export anything from Klaviyo automatically, on a schedule, or without a confirmation dialog showing exact counts. Disconnecting Klaviyo deletes the stored key immediately. Analysis results follow the 48-hour deletion rule like every other job.

8. Retention and deletion

To delete your account and all associated data, email privacy@skipbounce.com from your account address. We confirm deletion in writing.

9. Sub-processors

We use the following providers to run SkipBounce. Each is bound by a data processing agreement.

We will update this list before adding a sub-processor that handles validation data.

10. International transfers

Our database, authentication and validation servers are in the European Union. Where a provider processes data outside the EU/EEA (see the table above), transfers rely on the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

11. Security

• All traffic is encrypted in transit (TLS 1.2+), including between our application and validation server.
• Database access is protected by row-level security so a user can only read their own data.
• API keys are stored as SHA-256 hashes; the full key is shown once and cannot be recovered by us.
• Klaviyo keys are encrypted at rest (AES-256-GCM).
• The validation server is stateless, firewalled, and accessible only with a shared secret over HTTPS.
• Access to production systems is limited to the operator and protected by key-based authentication.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and, where required, the supervisory authority within 72 hours.

12. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (“right to be forgotten”);
• restrict or object to processing based on legitimate interest;
• receive your data in a portable format;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with a supervisory authority — in Romania, the ANSPDCP, or the authority in your EU country of residence.

To exercise any right, email privacy@skipbounce.com. We respond within 30 days.

If your address was validated by one of our customers and you have questions, please contact that organisation first — they control the list. We will assist them in fulfilling your request.

13. Cookies

We use only strictly necessary cookies: an authentication session cookie so you stay logged in, and a preference for light/dark mode in the dashboard. We do not use advertising or cross-site tracking cookies, so no cookie banner is required.

14. Controller vs. processor

For your account data, Werunads Agency SRL is the controller. For the email addresses you submit for validation, you (or your organisation) are the controller and we act as your processor, handling the data only to deliver the result you requested. Our Terms of Service include the data processing terms required by GDPR article 28. If you need a signed DPA, email us.

15. Children

SkipBounce is a business tool and is not directed at children under 16. We do not knowingly collect their data.

16. Changes to this policy

We will post changes on this page and update the date at the top. For material changes affecting how we handle validation data, we will notify account holders by email.

17. Contact

Werunads Agency SRL
[Registered address — fill in]
Romania
privacy@skipbounce.com