Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you (the customer, "Controller") and MailQuell ("Processor"), operator of MailQuell. It applies to personal data contained in the email lists and addresses you submit for verification, through the dashboard or the API. It applies automatically when you use the service; contact [email protected] for a countersigned copy.

2. Details of the processing

• Subject matter and purpose: checking whether email addresses are valid and deliverable, and, when you use AI Lead Qualification, judging from each company's public website whether it matches the customer profile you describe, on your instructions.
• Nature: storage, DNS lookups on the address's domain, and an SMTP connection to the recipient's mail server that stops before any message is sent. For AI Lead Qualification: reading the public home and About pages of the company domain (robots.txt respected) and sending that text (email addresses printed on the site removed; never the addresses or names in your list) to the AI sub-processor listed in section 7.
• Data: email addresses and, if you include them, names and company names.
• Data subjects: the people whose addresses are on your lists (your contacts, leads, customers or subscribers).
• Duration: as long as you use the service, within the retention limits in section 6.

3. Your responsibilities

You are responsible for having a lawful basis to process the addresses you submit and to have them verified, and for the lists you upload. Don't submit special categories of personal data.

4. Our commitments as processor

• We process your list data only to provide verification to you, following your documented instructions (your use of the service and these terms).
• We never sell it, use it to build our own lists, or send any email to the addresses.
• Anyone with access to it is bound by confidentiality.
• We help you answer data-subject requests and meet your obligations (security, breach notification, impact assessments) as far as our role allows.
• We notify you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data.
• On request, we provide the information needed to show compliance with this DPA.

5. Security measures

• Encryption in transit (HTTPS/TLS) and data hosted in the United Kingdom.
• Accounts protected by scrypt-hashed passwords, optional two-factor authentication, temporary lockouts and rate limits.
• API keys and session tokens are stored only as hashes. Two-factor and webhook secrets are encrypted at rest.
• Strict separation between customer accounts, tested automatically against unauthorised-access attempts.
• Administrative actions require two-factor authentication and are recorded in an audit log.
• Database not exposed to the internet, regular backups, and security updates.

6. Retention and deletion

• The uploaded list itself is deleted as soon as its verification task finishes or is cancelled.
• Per-address results are deleted automatically 20 days after the task finished. Only anonymous totals (e.g. "812 valid, 40 invalid") are kept.
• AI Lead Qualification: the contacts of a run and its results are deleted 20 days after the run ended; only totals (e.g. "12 good fit") are kept. Website text is kept only in memory, for about 6 hours, and never written to the database.
• A task left paused for 20 days is cancelled, unused credits are refunded, and its data is deleted.
• Webhook delivery records, which contain results, are deleted after 20 days.
• You can delete a task, and its results, at any time. Deleting your account deletes all of your lists and results.
• Backups roll over within 30 days.

7. Sub-processors

You authorise the sub-processors below. We impose data-protection obligations on them equivalent to this DPA. We will announce any new sub-processor on this page at least 30 days in advance; you may object by contacting [email protected], and if we can't resolve it, you may close your account.

Verification itself necessarily contacts the recipient domain's own mail server. It sees the address being checked, our server's IP and our domain, never your identity.

8. International transfers

Your list data is stored and processed on servers in the United Kingdom, a country the European Commission recognises as giving adequate protection (adequacy decision). MailQuell is operated from Morocco. Where personal data from the European Economic Area is accessed from outside it, the EU Standard Contractual Clauses (Commission Decision 2021/914) apply as appropriate safeguards; a copy is available on request. AI Lead Qualification sends public company website text (never the addresses in your list) to TypeSafe (Jev model) in the United States, under its data processing agreement with the EU Standard Contractual Clauses and zero data retention.

9. Law

This DPA follows the EU General Data Protection Regulation (GDPR) and Moroccan Law 09-08. If it conflicts with the Terms of Service, this DPA prevails for data protection matters. See also our Privacy Policy.