rate.email
Get an API key
Draft under legal review, effective date to be set.

Data Processing Agreement

Template under Article 28 GDPR. This annex applies whenever a customer (the "controller") uses the rate.email API to process personal data of its own end users, and rate.email (the "processor") processes that data on the controller's behalf and instructions.

Effective date: [CONFIRM: EFFECTIVE DATE]

Parties

  • Controller: the customer identified at account signup, or in the applicable order form.
  • Processor: @lbajsarowicz Łukasz Bajsarowicz, Polish sole trader, NIP 9111960653, REGON 021046365, address for correspondence ul. Hoża 86, lok. 410, 00-682 Warszawa, Poland, trading as rate.email.

This DPA is incorporated into and governed by the Terms of Service. Where this DPA conflicts with the Terms of Service on a data protection matter, this DPA controls.

1. Subject matter

The processor provides an API that rates a submitted email address for deliverability and abuse risk, at the controller's instruction, for use in the controller's own systems (for example, at checkout or account signup on the controller's website).

2. Duration

This DPA remains in effect for as long as the processor processes personal data on the controller's behalf under the Terms of Service, and terminates automatically when that processing ends, subject to section 10 (deletion at termination).

3. Nature and purpose of processing

  • Nature: automated, real-time or near-real-time rating of a single data point (an email address, or a hashed local part plus domain) per API call, with short-term caching.
  • Purpose: to return a deliverability and risk score to the controller so the controller can decide how to treat a submission (e.g. block, flag, or accept) in its own system. The processor does not use the data for any purpose of its own except as described in section 6.

4. Types of personal data

  • Email address submitted by the controller's end user, or in privacy mode, a SHA-256 hash of the normalized local part together with the plaintext domain.
  • The requesting IP address, Origin header, and user agent string, captured as part of the HTTP request and used for rate limiting, abuse prevention, and (hashed) short-term logging.
  • The controller's API key (used to identify and meter the controller's account; not personal data of the end user, but identifying data about the controller).

5. Categories of data subjects

End users of the controller: individuals whose email address the controller submits to the API, typically shoppers or account registrants on the controller's own website or application.

6. Processor obligations

The processor:

  • Processes personal data only on the controller's documented instructions, as expressed through use of the API and its documented parameters, unless required to do otherwise by EU or Polish law, in which case the processor informs the controller before processing, unless that law prohibits such notice.
  • Ensures that any person authorised to process the data is bound by confidentiality.
  • Implements the security measures described in the annex below.
  • Assists the controller, taking into account the nature of processing, in responding to data subject requests under GDPR Chapter III, to the extent the processor holds data responsive to such a request. Because the processor does not store plaintext addresses at rest (see retention below), most such requests must in practice be answered by the controller from its own records; the processor will confirm what, if anything, it holds.
  • Assists the controller with its obligations under GDPR Articles 32 to 36 (security, breach notification, impact assessments, prior consultation), taking into account the nature of processing and the information available to the processor.
  • Notifies the controller of a personal data breach affecting the controller's data without undue delay and in any case within 48 hours of the processor becoming aware of it, per section 8.
  • Makes available to the controller the information necessary to demonstrate compliance with this DPA and allows for audits per section 9.
  • Does not engage a sub-processor without informing the controller per section 7.

7. Sub-processors

Current sub-processors, listed in full in sub-processors.md:

  • Cloudflare, Inc.: Workers, KV, D1, Analytics Engine, Turnstile (infrastructure hosting, edge compute, caching).
  • Deliverability verification provider (Verifalia or Clearout, [CONFIRM: final provider selection]): plaintext address verification, paid slow-path only, only invoked if the controller's request opts into deliverability checking with a secret key.

Polar.sh and Google Workspace process the controller's own account and billing data, not the end user's submitted email address, and are listed for transparency in sub-processors.md but do not process end-user data under this DPA's subject matter.

Change notification: the processor will notify the controller at least 30 days before adding or replacing a sub-processor that will process end-user data under this DPA, by posting the change to sub-processors.md and, where the controller has provided a contact email, by email. The controller may object on reasonable data protection grounds within that 30-day window; if the parties cannot resolve the objection, the controller may terminate the affected processing without penalty.

8. Security measures

See the annex below. In summary: encryption in transit (TLS) for all API traffic; the plaintext email address is never written to persistent storage, only a SHA-256 hash of the normalized address is stored, keyed for cache lookups; access to infrastructure is restricted to the processor (a sole trader with no employees, so no internal third-party access exists beyond the processor and its named sub-processors); request logs retain only hashed addresses; Cloudflare's platform-level security controls (DDoS protection, TLS termination, WAF) apply to all traffic.

9. Breach notification and audit rights

  • Breach notification: the processor notifies the controller without undue delay and no later than 48 hours after becoming aware of a personal data breach affecting the controller's data, describing the nature of the breach, the categories and approximate number of data subjects and records affected (to the extent known), the likely consequences, and the measures taken or proposed.
  • Audit rights: the controller may request information reasonably necessary to demonstrate the processor's compliance with this DPA, including responses to a written questionnaire, no more than once per 12 months absent a specific incident or regulatory request. Given the scale of the processor (a sole trader), an on-site audit is not offered as standard; the parties will agree a proportionate alternative (documentation review, a call, or a third-party attestation if one exists) on request. [CONFIRM: whether the controller base requires a contractual right to a more formal audit, e.g. for enterprise customers, and whether that needs a separate addendum.]

10. Deletion at termination

On termination of the processing relationship, or on the controller's written request, the processor deletes or ensures the deletion of all end-user personal data it holds within [CONFIRM: deletion period, e.g. 30 days], except data it is required to retain by law, subject to the retention periods already described in the privacy policy (7-day per-address and per-domain cache, 30-day hashed request logs). Because plaintext addresses are not stored at rest, in practice "deletion" for most data means the existing 7-day and 30-day retention windows are allowed to lapse; the processor will confirm on request when a specific hashed record has expired.

11. International transfers

Data processed under this DPA may be transferred to and processed in countries outside the EEA where a sub-processor operates there, specifically:

  • Cloudflare: [CONFIRM: whether the controller's traffic is configured for EU-only data residency or processed on Cloudflare's global edge network by default]. Where data leaves the EEA, the transfer relies on Standard Contractual Clauses under Cloudflare's Data Processing Addendum, and the EU-U.S. Data Privacy Framework where the relevant Cloudflare entity is self-certified. [CONFIRM: current certification status at time of signature.]
  • Deliverability provider: if Verifalia (Italy), no transfer outside the EEA. If Clearout or another non-EU provider, [CONFIRM: transfer mechanism per that provider's own DPA].

The processor will update this section and sub-processors.md if the set of sub-processors or their processing locations changes.

Annex: Security measures

  • Encryption in transit: all API traffic is served over TLS. No unencrypted HTTP endpoint is offered for the rating API.
  • Hashing at rest: the plaintext email address is not stored at rest. Per-address cache entries are keyed by SHA-256 of the normalized address; the plaintext value is not recoverable from the stored key.
  • Access control: the processor is a sole trader with no employees; access to production infrastructure (Cloudflare account, D1, KV) is limited to the processor. API keys are stored hashed, not in plaintext, in the same manner as the address cache.
  • Logging: request logs retain a hashed form of the submitted address, not the plaintext value, and are retained for 30 days per the retention table in the privacy policy.
  • Cloudflare platform security: TLS termination, DDoS mitigation, and (where enabled) Turnstile bot-challenge verification are provided by Cloudflare's platform for all traffic to the API.
  • Quota and abuse controls: per-key daily quotas and per-IP rate limits are enforced before a request reaches the rating pipeline, limiting the blast radius of a compromised key.

[CONFIRM: whether a more detailed technical and organisational measures (TOM) annex is required for specific enterprise customers, beyond the summary above.]