Skip to main content

Legal

Privacy policy

Last updated: October 8, 2026

On this page

1. Introduction

Kawaa ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our email verification service.

2. Information we collect

2.1 Account information

When you create an account, we collect:

  • Email address
  • Name (optional)
  • Company name (optional)
  • Password, stored only as a one-way hash (scrypt), never as the password itself

2.2 Usage data

We automatically collect:

  • API usage statistics
  • Verification history (the addresses you submit and their results, keyed by a one-way hash of the address)
  • IP addresses, for rate limiting and security. How long we keep one depends on the record it is in, and each record is deleted automatically when its period ends (deletion can take a few more days):
    • rate-limit counters: up to 2 days
    • a signed-in session: 7 days
    • our service logs, which record the IP address each request came from: up to 30 days
    • sign-in history and security events: 90 days
    • support chat: each message 90 days after it was sent, and the conversation's record of the IP address it came from 90 days after its last message
    • your account's audit log, which records the IP address of sign-ins and other account changes: 90 days, unless the account has set a different period (30, 60, 180 or 365 days; changing it is part of the Enterprise plan)
  • Browser and device information
  • Website analytics: the pages you open on kawaa.com and app.kawaa.com, the page title, time on page, scroll depth, the site that linked you to us and any campaign tags on that link. This runs on our own servers, sets no cookies and is not shared with any advertising or analytics company. On kawaa.com a visit is identified only by a random number your browser discards when you close the tab. The cookie policy lists exactly what is recorded.

2.3 Payment information

Payment processing is handled by Stripe. We do not store credit card numbers. We only receive transaction confirmations and billing addresses from Stripe.

3. How we use your information

We use collected information to:

  • Provide and maintain our service
  • Process transactions and send billing notifications
  • Send service updates and security alerts
  • Improve our service and develop new features
  • Prevent fraud and abuse
  • Comply with legal obligations

4. Data retention

We retain your account information for as long as your account is active. If an account's email address is never verified, we begin deleting the account and its sign-up data 30 days after sign-up, and deletion completes within the following few days. Verification results are encrypted at rest and retained according to your plan's data retention period (7-365 days), then deleted. The result of a check made with the free email checker without an account is retained for 7 days and then deleted automatically, which can take a few more days. You may request deletion of your account and associated data at any time. When you ask us to delete your account, we email you a link to confirm the request. Once you confirm, you have 30 days to cancel. After that, our deletion run, which runs once a day, removes the account and the data stored for it from our live systems, apart from the records listed next. For most accounts this takes two runs and is complete about 31 to 32 days after you confirmed. Each run deletes a limited amount, so an account with a lot of stored data or many white-label sub-accounts takes more runs (an account with 100 sub-accounts takes at least five, about 34 to 35 days after you confirmed), and the runs continue every day until all of it is deleted. Some records are kept after the account is deleted: billing and credit records, which we keep for accounting and legal reasons; audit log entries and support chat messages, until the periods in section 2.2 end; and the email tracking activity your account recorded (opens and clicks, and totals per address and per domain), which is deleted automatically 90 days after each event and 2 years after a total was last updated.

A newsletter sign-up stores the address you entered and the IP address it was sent from. If the address is not confirmed within the seven days its confirmation link lasts, both are deleted automatically once that window has passed, unless the confirmation email bounced or was reported as spam, in which case we keep the sign-up so that we do not email that address again. When you confirm, we delete the IP address and keep your address to send the newsletter; if you later unsubscribe, we keep a record of the address so that we do not email it again.

Our databases are backed up continuously and once a day, in two AWS regions in the United States. When data is deleted from our live systems, whether at the end of one of the periods above or at your request, copies of it can remain in these backups for up to 35 days after it was deleted. The backups are then deleted automatically.

5. Data security

We implement industry-standard security measures including:

  • TLS 1.2 or later on every connection to our website (kawaa.com), dashboard (app.kawaa.com), API (api.kawaa.com) and status page (status.kawaa.com)
  • AES-256 encryption at rest for account data, verification results and uploaded lists, in our databases, file storage, job queues and results cache
  • Automated dependency and security scanning on every change
  • Two-factor authentication option
  • Rate limiting and abuse prevention

Some of the traffic involved in verifying an address is not encrypted:

  • Checking whether a mailbox exists is an SMTP conversation between our verification servers and the mail server that receives mail for the address. That conversation is not encrypted, so the address being checked is sent to that mail server in plain text.
  • Looking up the address's domain (the part after the @) uses ordinary DNS queries, which are not encrypted. We send them through Google Public DNS. They carry the domain only, not the full address.
  • Our verification servers keep recent results, including the address, in a cache inside our private AWS network. The cache is encrypted at rest, but the traffic between our servers and the cache is not encrypted. Only our verification servers can connect to it.

6. Data sharing

We do not sell your personal information. We may share data with:

  • The service providers that process it for us to run Kawaa (AWS, Stripe, Cloudflare, Google and Slack):
    • Amazon Web Services (AWS) hosts the service in the United States and sends our email (Amazon SES). AWS includes Amazon Bedrock, which runs the AI analysis of the addresses you submit, writes the support chat's replies and drafts text in the AI email composer.
    • Stripe processes payments. It receives your account email and, if you enter them, your billing name, address, company name and tax ID. Card numbers are entered on Stripe's own pages and go to Stripe directly.
    • Cloudflare runs Turnstile, the bot check on our sign-up, sign-in, password reset, free email checker, support chat, newsletter and status subscription forms. It receives the IP address of the browser that completes the check.
    • Google hosts our email (Google Workspace). The messages you send to any @kawaa.com address, your replies to our emails, and the notices we receive when an email we sent you bounces or is reported as spam, which include your email address, are stored there. Our verification servers also look up the domain of each address you verify through Google Public DNS (the domain only, as described in section 5).
    • Slack, the messaging service our team works in. When you use the support chat, we post your message, the assistant's reply, the email address you gave (if any) and, if you are signed in, your account email, plan and credit balance to our team's Slack so we can follow up. When you sign up for the newsletter, we post a masked form of your email address that shows no more than its first character and the part after the @, where you signed up, and that you have not confirmed yet. Once you confirm, we post your full email address and where you signed up. We do this so we can see new subscribers.
  • The mail server that receives mail for an address you verify, which is sent that address during the mailbox check described in section 5
  • Law enforcement when required by law
  • Successors in case of merger or acquisition

7. Your rights

You have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your data
  • Export your data
  • Withdraw consent
  • Lodge a complaint with a supervisory authority

8. International transfers

Your data may be processed in the United States where our servers are located. We ensure appropriate safeguards are in place for international transfers.

9. Children's privacy

Our service is not intended for users under 18 years of age. We do not knowingly collect information from children.

10. Changes to this policy

We may update this policy periodically. We will notify you of significant changes via email or through our service.

11. Contact us

For privacy-related questions, and to access, correct, export or delete your data, contact us by email at: privacy@kawaa.com

Our postal address is Kawaa, 548 Market St, San Francisco, CA 94104, United States.