AuthFlame
Home Documentation Contact Pricing
Log in

Privacy Policy

How AuthFlame collects, uses and protects your data.

Last updated October 06, 2026

This Privacy Policy explains how AuthFlame ('we', 'us', or 'our') handles personal data when you use authflame.com, our API and our customer dashboard (the 'Services'). It forms part of our Terms of Service, and terms defined there have the same meaning here.

We handle two kinds of data, and our role is different for each. This matters, so we explain it first.

TABLE OF CONTENTS

  1. 1. OUR ROLE: CONTROLLER AND PROCESSOR
  2. 2. WHAT WE COLLECT
  3. 3. HOW WE USE IT AND OUR LEGAL BASIS
  4. 4. EMAIL ADDRESSES YOU SEND TO THE API
  5. 5. HOW LONG WE KEEP DATA
  6. 6. WHO WE SHARE DATA WITH
  7. 7. INTERNATIONAL TRANSFERS
  8. 8. SECURITY
  9. 9. YOUR RIGHTS
  10. 10. CHILDREN
  11. 11. CHANGES TO THIS POLICY
  12. 12. CONTACT US

1. OUR ROLE: CONTROLLER AND PROCESSOR

Our account holders and website visitors. For information about you as a customer or visitor (your account, billing and use of our website), we are the controller. We decide why and how that data is used, and this policy describes it.

The people behind email addresses you send to the API. When a customer sends us an email address to check, the customer decides to do so and is the controller of that data. We are the customer's processor, and we handle it only to provide the Services and on the customer's instructions. If you are one of those people (for example, you signed up to a website that uses AuthFlame), your relationship is with that website. Section 9 explains how to exercise your rights.

2. WHAT WE COLLECT

Account information

When you register, we collect your email address, your password (stored in a protected form, not as plain text), your name if you give it, and details of your plan and team members.

Billing information

Payments are handled by our payment provider, Stripe. We do not store your full card details. We receive information about your subscription and payment status, such as the plan you are on and whether a payment succeeded.

API data

When you use the API, we process the email addresses you send for checking and the details of each request, such as when it was made, which account and API key made it, and the result returned. We also keep running totals of how many checks you make so that we can apply plan limits and billing. These totals do not contain email addresses.

Website and technical data

When you visit the site, our servers record standard technical information, such as your IP address, browser type and the pages requested, which we use to run and secure the Services. We use cookies and similar technologies that are needed to run the site and keep you signed in. If we add analytics or other non-essential cookies in future, we will update this policy.

Communications

If you contact us, for example at [email protected], we keep your messages and our replies so we can help you and keep a record.

3. HOW WE USE IT AND OUR LEGAL BASIS

Under UK data protection law we need a lawful basis for using personal data that we control. These are ours:

  • To provide the Services (creating your account, issuing API keys, applying plan limits, taking payment and supporting you). Basis: performing our contract with you.
  • To keep the Services secure and prevent abuse (detecting misuse of API keys, protecting our systems, fixing faults and investigating incidents). Basis: our legitimate interests in running a secure and reliable service.
  • To communicate with you about your account, billing, security and changes to the Services. Basis: performing our contract, and our legitimate interests.
  • To meet legal obligations, such as keeping accounting and tax records. Basis: legal obligation.

We do not sell personal data. We do not use it for advertising and we do not send marketing to anyone without a lawful basis for doing so.

4. EMAIL ADDRESSES YOU SEND TO THE API

To produce a result for an email address, we analyse it using methods such as checking its domain and mail servers, matching it against lists of disposable and risky domains, and statistical analysis of the address itself. We return a risk score, classifications and a suggested action to the customer who sent it.

We do not contact the email addresses we are sent, we do not use them for marketing, and we do not sell or share them with other customers. We keep them only for the period set out in section 5, so that we can operate, secure and troubleshoot the Services.

We may also produce statistics about how the Services are used and how accurate they are, which do not contain email addresses.

5. HOW LONG WE KEEP DATA

  • Checked email addresses and request details: kept for 14 days for logging, and then deleted.
  • Account information: kept while your account is active. If you close your account, we delete it within a reasonable period, except for what we must keep for the purposes below.
  • Billing and accounting records: kept for as long as tax and accounting law requires.
  • Support messages: kept for as long as needed to resolve your query and keep a record of it.
  • Usage totals without email addresses: kept for as long as needed to apply plan limits and billing and to understand how the Services are used.

We may keep information for longer where we need it to deal with a legal claim or comply with the law.

6. WHO WE SHARE DATA WITH

We share personal data only with organisations that help us run the Services, and only what they need:

  • Stripe, our payment provider, to take payments and manage subscriptions.
  • Hosting and infrastructure providers, who run the servers the Services are hosted on.
  • Email delivery providers, to send account and billing emails.

These providers act on our instructions or are independent controllers of their own processing, and are bound by their own data protection obligations. We may also disclose data where the law requires it, to respond to valid legal requests, or to protect our rights, our systems and other people from fraud or abuse. If we transfer the business to a company we incorporate, or sell it, the data would transfer with it and this policy would continue to apply.

7. INTERNATIONAL TRANSFERS

The Services are hosted in the United Kingdom. Some of our providers, including Stripe, may process data outside the UK. Where that happens, we rely on safeguards recognised by UK data protection law, such as an adequacy decision or approved standard contractual terms.

8. SECURITY

We use appropriate technical and organisational measures to protect personal data, including encrypted connections to the Services and restricted access to our systems. No system is completely secure, so you should also keep your password and API keys safe, as set out in our Terms of Service. If a personal data breach affects you, we will notify you and the regulator where the law requires us to.

9. YOUR RIGHTS

Under UK data protection law you have the right to:

  • ask for a copy of your personal data;
  • ask us to correct data that is wrong or incomplete;
  • ask us to delete your data;
  • ask us to restrict how we use your data, or object to our use of it;
  • ask for your data in a portable format, where this applies; and
  • complain to the Information Commissioner's Office (ICO) at ico.org.uk. We would appreciate the chance to put things right first.

To use these rights for your account or website data, email [email protected]. We will respond within one month.

If your email address was sent to our API by a website or service you use, that website or service is the controller. Please contact them directly. We will help them respond to your request, and because we delete checked email addresses after 14 days, we may no longer hold the data.

10. CHILDREN

The Services are for businesses and are not intended for anyone under 18. We do not knowingly collect personal data from children for our own purposes.

11. CHANGES TO THIS POLICY

We may update this policy from time to time. The date at the top shows when it was last changed. If we make a significant change, we will tell account holders by email or in the dashboard.

12. CONTACT US

For any question about this policy or how we handle personal data, or to request our data processing agreement, please contact us at:

AuthFlame
United Kingdom
[email protected]