Email discovery for B2B contact addresses relies on the legitimate interest of professional prospecting towards publicly published company information. No consumer data is collected, and no personal mailbox is verified or contacted by the service.
Public company websites, DNS records (MX, SPF, DMARC), and the French registry API
"API Recherche d'Entreprises" (DINUM). Names sent to /email-verify and
/enrich are used only to match a published address pattern.
The credit ledger and per-request usage records are kept for 13 months, then deleted by a daily cleanup job. Suppression-list entries are kept indefinitely (they only hold a domain or an HMAC hash, never a clear-text name). Request logs follow the Cloudflare Workers Logs retention configured for the account, which is below 30 days.
Send POST /privacy/opt-out with {"domain": "example.com"} to stop
email discovery for a whole domain, or with a domain plus first_name and
last_name to stop it for one person (stored as an HMAC-SHA256 hash). Matching
/email-verify and /enrich requests then return no contact address with
status: "suppressed".