rate.email
Get an API key
Draft under legal review, effective date to be set.

Privacy Policy

Effective date: 2026-09-16

This policy explains how rate.email processes personal data. It covers two separate roles. For traffic to the rating API, the customer (the shop or website operator who holds an API key) is the controller and rate.email acts as processor. For visitors to the rate.email website and for account holders, rate.email is the controller. Both roles are described below.

1. Controller identity and contact

Controller (for the website and for account data):

  • Firm name: @lbajsarowicz Łukasz Bajsarowicz
  • Legal form: sole trader (jednoosobowa działalność gospodarcza), registered in CEIDG (Central Register and Information on Economic Activity, Poland)
  • NIP: 9111960653
  • REGON: 021046365
  • Address for correspondence: ul. Hoża 86, lok. 410, 00-682 Warszawa, Poland
  • Business registered since: 2017-01-04, per CEIDG
  • Registration status: Aktywny (active), per CEIDG
  • Contact email: lukasz@lbajsarowicz.me

No data protection officer is appointed. Data protection questions go to the contact email above.

2. Scope: two processing relationships

2.1 API traffic (rate.email as processor)

When a customer's shop or website calls the rate.email API to rate an email address, the customer decides why and how the address is checked. Under GDPR Article 28, the customer is the controller of that end-user data and rate.email is the processor. The terms for this relationship are in data-processing-agreement.md, not in this policy. This policy still lists, for transparency, what rate.email receives and does with it as a processor.

2.2 Website visitors and account holders (rate.email as controller)

For people who visit the rate.email marketing site, sign up for an account, or manage billing, rate.email is the controller. The rest of this policy is written from that role, with section 3 also covering the processor-role data for completeness.

3. What data is processed, for what purpose, and on what legal basis

Activity Data categories Purpose Legal basis (GDPR)
API rating request (processor role) Email address submitted by the customer's end user, or in privacy mode a SHA-256 hash of the local part plus the plaintext domain; requester API key; requesting IP address; Origin header; user agent Return a deliverability/risk score for the submitted address Performed on the customer's instructions under the DPA; the customer's own legal basis toward its end user applies. Article 6(1)(b) or (f) as between rate.email and the customer under the service contract.
Account creation and API key management Name, email address, billing identifiers, usage history Provide the service, issue and manage API keys, respond to support requests Article 6(1)(b), contract
Dashboard login and registration (account data) Email address, a hashed password or a magic-link token (no plaintext password is stored), API keys, usage records Authenticate an account holder, maintain the dashboard session (re_session cookie), issue and revoke API keys, protect the login form (re_csrf cookie) Article 6(1)(b), contract. Retention: until account deletion, plus 30 days.
Security and abuse prevention Request metadata (IP address, timestamps, rate-limit counters, hashed API keys), Turnstile challenge results where enabled Detect and block abuse, enforce quotas, protect the service and other customers Article 6(1)(f), legitimate interest
Billing Name, billing address, transaction identifiers, invoice data (handled by Polar.sh as merchant of record; see section 5) Process payment, issue invoices, comply with tax law Article 6(1)(b) contract, and Article 6(1)(c) legal obligation for tax and accounting records
Website analytics cookies Pseudonymous identifiers, page interaction events, routed through a first-party Google Analytics 4 gateway Understand website usage, improve the service Article 6(1)(a), consent. Not set before consent is given.
Account correspondence Google Workspace mailbox contents for support and account emails Operate the account relationship Article 6(1)(b), contract, and Article 6(1)(f) for routine service correspondence

4. Categories of data subjects

  • End users of a customer's shop or website whose email address is submitted to the API (processor role, customer is controller).
  • Visitors to the rate.email website.
  • Account holders and their nominated contacts (customer role, controller relationship with rate.email).

5. Recipients and processors, with countries and transfer mechanisms

Recipient Role Data involved Country / region Transfer mechanism
Cloudflare, Inc. (Workers, KV, D1, Analytics Engine, Turnstile) Sub-processor / infrastructure processor All API request data in transit and cache; hashed address and domain in KV; abuse-signal data The D1 database, the only persistent store of record, was created with a Western Europe location hint, a preference Cloudflare honours on a best-effort basis, not a guarantee. Edge compute and the KV cache run on Cloudflare's global network with no data residency control. Standard Contractual Clauses under Cloudflare's Data Processing Addendum. Cloudflare self-certifies to the EU-U.S. Data Privacy Framework where the underlying entity is US-based; confirm current status at the time of publication. [CONFIRM: current DPF certification status for the specific Cloudflare entity processing this data]
Polar.sh Merchant of record, payment and billing processor Name, billing address, payment metadata (never full card data; card data is handled by Polar's own payment processor) United States (Polar Software, Inc., Delaware). Polar holds an EU One-Stop-Shop (OSS) VAT number and issues VAT-compliant invoices for EU sales. Standard Contractual Clauses (EU SCCs, Module 2) per Polar's Data Processing Addendum
DeBounce Sub-processor, paid slow-path only Plaintext email address, only for customers on the paid tier who request deliverability verification. Unlike every other recipient in this table, DeBounce receives the address unhashed; no equivalent statement to the retention note in section 6 exists for this recipient because DeBounce has not published one for its REST validation API. [CONFIRM: DeBounce's country/region for its validation API; DeBounce's privacy policy names no data-center country]. [CONFIRM: transfer mechanism, pending disclosure of DeBounce's processing location].
Google LLC / Google Ireland Limited (Google Analytics 4) Processor, website analytics, consent-gated Pseudonymous website usage data; Consent Mode default denies analytics_storage on every page load, the analytics tag is not loaded until the visitor consents to the analytics category, and requests are then routed through a first-party server-side gateway United States (Google LLC) and/or EU (Google Ireland Limited depending on configuration) Google self-certifies to the EU-U.S. Data Privacy Framework. [CONFIRM: current DPF certification status for the specific Google entity]
Google Workspace Processor, account and support email Account correspondence content EU Google Workspace's own Data Processing Amendment; Google self-certifies to the EU-U.S. Data Privacy Framework. [CONFIRM: current status at publication]

No personal data is sold. No recipient outside this table receives personal data as a matter of course.

6. Retention

Data Retention period Notes
Per-address rating result 7 days Cached in Cloudflare KV, keyed by SHA-256 hash of the normalized address. The plaintext address is never stored at rest by rate.email; it exists only in transit during the request and, briefly, in server memory while the score is computed.
Per-domain rating result 7 days Cached in KV, keyed by domain.
Request logs (hashed address) 30 days Address is hashed before it is written to any log. IP address and other request metadata may also be hashed or truncated; see the security measures annex in the DPA for detail.
Billing records Per statutory retention period under Polish tax and accounting law 5 years from the end of the tax year
Account data (login, registration, API keys, usage records) Until the account is deleted, plus 30 days, or a longer period required to resolve open disputes or comply with law Deletion requests are honoured per section 8.

7. Data subject rights

Any data subject (website visitor, account holder, or a customer's end user for the processor-role data) has the right to:

  • Access their personal data (Article 15).
  • Rectify inaccurate data (Article 16).
  • Erasure, subject to legal retention obligations (Article 17).
  • Restriction of processing in defined cases (Article 18).
  • Data portability, where processing is based on consent or contract and carried out by automated means (Article 20).
  • Object to processing based on legitimate interest (Article 21).
  • Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3)).

For end users of a customer's API integration, the request should first go to that customer, since the customer is the controller of that data. If the customer cannot be identified or does not respond, contact rate.email at the address in section 1.

To exercise a right, write to the contact email in section 1. A response is provided within one month of a verified request, extendable by two further months for complex requests, per Article 12(3).

8. Right to lodge a complaint

Every data subject has the right to lodge a complaint with the Polish supervisory authority:

Urząd Ochrony Danych Osobowych (UODO) ul. Stanisława Moniuszki 1A 00-014 Warszawa, Poland Email: kancelaria@uodo.gov.pl Phone: +48 22 531 03 00

A data subject resident in another EU/EEA member state may instead lodge a complaint with their own national supervisory authority.

9. Cookies and similar technologies

9.1 Purpose of the banner

The rate.email website uses a cookie banner shown on first visit. It lets a visitor accept or decline non-essential cookies before they are set, and it records the choice so the banner does not reappear on every page load. Two categories are offered.

9.2 The two categories

  • Strictly necessary: cookies needed to operate the dashboard (keeping a logged-in session, protecting forms against cross-site request forgery, and passing Cloudflare's bot-management and Turnstile checks). These are set regardless of the banner choice, because the service cannot function without them.
  • Analytics: cookies used to understand website usage (Google Analytics 4). These are set only after the visitor accepts the analytics category in the banner.

The banner choice itself is not stored in a cookie. It is stored in the browser's localStorage under the key re-consent, on the rate.email domain, and never leaves the browser as part of that record.

9.3 Cookie table

Name Provider Purpose Category Lifetime First or third party
re_session rate.email Keeps a dashboard user logged in between requests Strictly necessary 30 days, sliding (renewed on activity) First party
re_csrf rate.email Cross-site request forgery protection for dashboard forms Strictly necessary Session (deleted when the browser closes) First party
cf_clearance Cloudflare Records that a visitor passed a Cloudflare Turnstile or challenge check, so the check is not repeated on every request Strictly necessary 30 minutes Third party (Cloudflare, first-party domain)
__cf_bm Cloudflare Bot detection and mitigation (Bot Fight Mode or Bot Management), distinguishes automated traffic from human visitors Strictly necessary 30 minutes from the last request Third party (Cloudflare, first-party domain)
_ga Google (Google Analytics 4) Distinguishes unique visitors for analytics measurement Analytics, consent required 2 years First party, routed through a same-origin analytics gateway
_ga_<container-id> Google (Google Analytics 4) Persists session state for analytics measurement Analytics, consent required 2 years First party, routed through a same-origin analytics gateway
re-consent (not a cookie) rate.email Records the visitor's cookie banner choice N/A, governs both categories Until cleared by the visitor or their browser Stored in localStorage, not a cookie, first party

cf_clearance and __cf_bm are set by Cloudflare on the rate.email domain as part of the zone's edge security (available on Free and Paid Cloudflare plans; Bot Management proper is an Enterprise feature, but Bot Fight Mode and Turnstile challenge cookies apply on lower tiers too). They are classified as strictly necessary because they gate access to the service itself, not because they are exempt from disclosure; they are listed here for transparency even though they do not require consent.

9.4 Changing the choice

The cookie choice can be changed at any time from the "Cookie settings" link in the website footer. Changing the choice from accepted to declined stops new analytics cookies from being set on future page loads; it does not retroactively delete analytics data already sent to Google before the change. Declining or later withdrawing analytics consent does not affect the strictly necessary cookies, which remain necessary for the dashboard and security functions to work.

9.5 Legal basis per category

  • Strictly necessary cookies: Article 6(1)(b) GDPR (necessary to perform the contract with a logged-in account holder) and Article 6(1)(f) GDPR (legitimate interest in securing the service against abuse), together with the exemption for cookies strictly necessary to provide a service explicitly requested by the user under Article 173(3)(2) of the Polish Act on Electronic Communications Law (ustawa Prawo komunikacji elektronicznej, which replaced the former Telecommunications Law in scope for cookie rules; [CONFIRM: cite the current article number and confirm no further amendment before publication]). No consent is required for this category.
  • Analytics cookies: consent under Article 6(1)(a) GDPR, obtained through the cookie banner before the cookie is set, per the ePrivacy-derived storage-and-access rule implemented in the same Polish Act on Electronic Communications Law. Consent can be withdrawn at any time per section 9.4, without affecting the lawfulness of processing before withdrawal.

9.6 Where the consent record is stored

The accepted or declined choice is stored client-side in localStorage under the key re-consent, as described in section 9.2. It is not transmitted to or stored by rate.email's servers unless the visitor also creates an account, in which case account-level preferences (if any are offered) are handled separately and described in the account data activity below.

10. Children

The service is a B2B API and a business website. It is not directed at children, and account holders must be adults acting for a business or professional purpose. rate.email does not knowingly collect personal data from children. If a parent or guardian believes a child's data has been submitted, contact the address in section 1 for erasure.

11. Changes to this policy

This policy may be updated to reflect changes in the service, in applicable law, or in the list of processors. Material changes are announced on the website or by email to account holders. The effective date at the top of this document indicates the last update.

12. Effective date

2026-09-16