Legal · Email Validation

Email Validation Privacy Notice

Last updated: May 29, 2026

This notice explains what we collect, why we collect it, how long we keep it, who we share it with, and what choices you have. It is written in plain English on purpose. If anything is unclear, email yo@publishnow.app.

1. Who we are

The data controller for this Service is Driven Success LLC ("Publish Now", "we", "us"), 160 Greentree Drive, Suite 101, Dover, Delaware 19904, United States. Contact for privacy enquiries: yo@publishnow.app.

2. What we collect

Category	What it is	How we get it
Uploaded email lists	The CSV (or XLSX-converted-to-CSV) file you upload, including every column you chose to include — typically email addresses, sometimes names, companies, tags, custom fields	From you, directly, when you submit the form
Notification email address	The email address you provide so we can send you results	From you, directly, on the upload form
Connection metadata	IP address, user-agent string, Cloudflare Turnstile challenge result, UTM parameters from the referring URL (where present)	Automatically, from your browser / HTTP headers
Marketing preference	Whether you ticked the "Send me occasional PublishNow product updates" checkbox at upload	From you, directly. Default is unchecked.
Derived data	The verdicts and scores we computed for each address you submitted	Produced by us from your uploaded list
Account data (authenticated users only)	Email, profile, organisation membership	From the main Publish Now app — see the main privacy policy

3. Why we collect it

• Uploaded email lists — to run the validation you requested (regex syntax check, MX record lookup, scoring, output CSV generation). We do not enrich, sell, or share the addresses with anyone other than the Sub-processors listed at /legal/subprocessors and only to the extent strictly necessary to deliver the result.
• Notification email — to deliver your results and, where you opted in, to send infrequent product updates about Publish Now. The notification email is also the lead-capture event for our funnel — we will say so clearly on the upload form.
• IP, UTM, user-agent — anti-abuse (rate-limiting, recon detection), debugging, and very-coarse attribution (which marketing channel sent you).
• Turnstile challenge — to prevent automated abuse of a free tool.
• Derived data — same as the uploaded list above.
• Authenticated account data — to associate jobs with your workspace and surface them in your history.

Lawful bases (GDPR)

• Contract (Art. 6(1)(b)): processing the uploaded list and sending the result email are necessary to provide the Service you asked for.
• Legitimate interest (Art. 6(1)(f)): anti-abuse, security logging, fraud prevention.
• Consent (Art. 6(1)(a)): marketing emails — only if you tick the checkbox. You can withdraw consent any time via the unsubscribe link in any marketing email.
• Controller-to-processor (Art. 28): when you upload a list, you are the controller for the addresses in it and we are the processor — governed by the DPA.

4. How long we keep it

Data	Retention
Anonymous (no-account) job — input CSV, output CSVs, per-row records	7 days from completion, then permanently deleted
Authenticated job — input + output CSVs	30 days from completion, then permanently deleted
Authenticated job — per-row records	90 days, then aggregated to counts only
Notification email as a marketing lead	Up to 24 months from last activity; withdrawing marketing consent triggers 30-day audit retention then permanent purge
Anti-abuse counters (rate buckets)	Rolling windows of 24 hours / 7 days as documented in PRD §7.4
Domain MX cache	Indefinitely — contains no personal data, just public DNS records
Structured request and workflow logs	30 days
Notification delivery audit log	12 months

You can request earlier deletion at any time — see §6 below.

5. Who we share it with

We share data only with the Sub-processors listed at /legal/subprocessors, and only to the minimum extent needed to deliver the Service. Key points:

• We do not sell your data. Period.
• We do not share uploaded email addresses with advertising or analytics providers. The tool runs no ad-tech, no tracking pixels, no analytics scripts.
• DNS-over-HTTPS providers (Cloudflare 1.1.1.1, Google fallback) only see the domain portion of an address (e.g., example.com) — never the local-part, never the notification address, never the list as a whole.
• The email provider sees only the notification address and the result summary, not your uploaded list.
• Law enforcement / legal compulsion — we will disclose data only when required by valid legal process, and where lawful, we will notify you before doing so.

6. Your rights

Subject to applicable law (GDPR, UK GDPR, CCPA, FADP), you have the right to:

• Access — request a copy of the personal data we hold about you. Authenticated users: download via GET /api/email-validation/jobs/:id/records. Anonymous users: request a JSON export by clicking the link in any result email or by emailing yo@publishnow.app from the address that owns the data.
• Delete — request erasure of any job and its files. Anonymous users: click the "delete my data" link in any result email (gated by your signed lookup token). Authenticated users: DELETE /api/email-validation/jobs/:id or the delete button in the UI. Bulk / organisation-wide erasure: email yo@publishnow.app.
• Rectify — correct inaccurate data we hold about you. Since the tool processes data you upload, the simplest path is to delete the affected job and re-run with the corrected file.
• Object — object to processing based on legitimate interest (e.g., anti-abuse counters). Email us.
• Withdraw marketing consent — click "unsubscribe" in any marketing email, or email us. Withdrawing consent does not affect transactional emails (the result email itself).
• Restrict — request restriction of processing while we evaluate a dispute or correction request.
• Portability — receive your data in a machine-readable format (CSV / JSON). Use the access mechanisms above.
• Complain to a supervisory authority — if you are in the EEA, UK, or Switzerland, you can complain to your local data-protection authority. We would prefer to fix the problem first — please give us a chance.

We aim to action requests within 30 days. We will ask for proof of identity before granting access or deletion that affects more than one address.

7. Cookies and tracking

The Email Validation tool sets no first-party tracking cookies. The only third-party cookie that may be set on the upload page is the Cloudflare Turnstile challenge cookie, which exists solely to determine whether the visitor is a human — see Cloudflare's privacy policy. The result-detail page sets a short-lived session cookie only when you are signed in; anonymous result-detail pages set no cookies. We do not use Google Analytics, Meta Pixel, Hotjar, Segment, or any comparable analytics or fingerprinting product on this surface.

Anonymous result-detail URLs contain a signed lookup token in the path. We instruct search engines not to index these URLs (noindex on the page and in the X-Robots-Tag response header). Still, treat the URL like a password — anyone with the link can view the result until the retention window expires.

8. International transfers

The Service runs on Cloudflare's global edge network and stores result files on Backblaze B2 in the United States. Personal data may therefore be transferred to and processed in the United States and any other country where our Sub-processors operate. Transfer mechanisms are described in DPA §10 (Standard Contractual Clauses, UK Addendum, etc.).

9. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has used the Service to upload data, contact us and we will delete it.

10. Changes to this notice

We will update the "Last updated" date at the top of this page whenever we change it. For material changes, we will additionally notify recent users by email where we have an address on file. Continued use after a change constitutes acceptance.

11. Contact

• Email: yo@publishnow.app
• Postal: Driven Success LLC, 160 Greentree Drive, Suite 101, Dover, Delaware 19904, United States
• See also: Data Processing Agreement · Sub-processor list