Skip to main content

Legal

Privacy policy

Last updated: October 15, 2026

On this page

1. Introduction

Kawaa ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our email verification service.

2. Information we collect

2.1 Account information

When you create an account, we collect:

  • Email address
  • Name (optional)
  • Company name (optional)
  • Password, stored only as a one-way hash (scrypt), never as the password itself
  • How you arrived, kept with your account: the site that linked you to the sign-up page (its name only, such as chatgpt.com, never the page on it) and any utm_source, utm_medium or utm_campaign tag on the sign-up page's link. If you came from a sign-up link on kawaa.com, we also keep the random visit number the cookie policy describes, link that visit's analytics record to your account, and keep from it the first page you opened on kawaa.com with its campaign tags and the site that linked you to it, in place of the sign-up page's.

2.2 Usage data

We automatically collect:

  • API usage statistics
  • Verification history (the addresses you submit and their results, keyed by a one-way hash of the address)
  • IP addresses, for rate limiting and security. How long we keep one depends on the record it is in, and each record is deleted automatically when its period ends (deletion can take a few more days):
    • rate-limit counters: up to 2 days
    • a signed-in session: 7 days
    • our service logs, which record the IP address each request came from: up to 30 days
    • sign-in history and security events: 90 days
    • support chat: each message 90 days after it was sent, and the conversation's record of the IP address it came from 90 days after its last message
    • your account's audit log, which records the IP address of sign-ins and other account changes: 90 days, unless the account has set a different period (30, 60, 180 or 365 days; changing it is part of the Enterprise plan)
  • Tracking pixels and links. When an email carrying one of our customers' tracking pixels is opened, or one of their tracking links is followed, we count the visit. To count unique visitors, the pixel or link keeps a one-way hash of the visitor's IP address, made with a secret key we hold, and never the address itself. The hash is different for every pixel and link, so the stored hashes on their own do not show that the same visitor opened more than one of them. It is deleted with the pixel or link: when the customer deletes it or their account, and at the latest one year after the pixel or link was created (deletion can take a few more days).
  • Browser and device information
  • Website analytics: the pages you open on kawaa.com and app.kawaa.com, the page title, time on page, scroll depth, the site that linked you to us and any campaign tags on that link. This runs on our own servers, sets no cookies and is not shared with any advertising or analytics company. On kawaa.com a visit is identified only by a random number your browser discards when you close the tab. The cookie policy lists exactly what is recorded.

2.3 Payment information

Kawaa plans and credit packs are sold through Link, LLC ("Link"), a Stripe company, and payments are processed by Stripe. We do not store card numbers. We receive transaction confirmations and the name and billing address you give at checkout.

3. How we use your information

We use collected information to:

  • Provide and maintain our service
  • Process transactions and send billing notifications
  • Send service updates and security alerts
  • Improve our service and develop new features
  • Prevent fraud and abuse
  • Comply with legal obligations

4. Data retention

We retain your account information for as long as your account is active. If an account's email address is never verified, we begin deleting the account and its sign-up data 30 days after sign-up, and deletion completes within the following few days. Verification results are encrypted at rest and retained according to your plan's data retention period (7-365 days), then deleted. The result of a check made with the free email checker without an account is retained for 7 days and then deleted automatically, which can take a few more days. You may request deletion of your account and associated data at any time. When you ask us to delete your account, we email you a link to confirm the request. Once you confirm, you have 30 days to cancel. After that, our deletion run, which runs once a day, removes the account and the data stored for it from our live systems, apart from the records listed next. For most accounts this takes two runs and is complete about 31 to 32 days after you confirmed. Each run deletes a limited amount, so an account with a lot of stored data or many white-label sub-accounts takes more runs (an account with 100 sub-accounts takes at least five, about 34 to 35 days after you confirmed), and the runs continue every day until all of it is deleted. The email tracking activity your account recorded (opens and clicks, and totals per address and per domain) is deleted with the account. Some records are kept after the account is deleted: billing and credit records, which we keep for accounting and legal reasons; and audit log entries and support chat messages, until the periods in section 2.2 end.

A newsletter sign-up stores the address you entered and the IP address it was sent from. If the address is not confirmed within the seven days its confirmation link lasts, both are deleted automatically once that window has passed, unless the confirmation email bounced or was reported as spam, in which case we keep the sign-up so that we do not email that address again. When you confirm, we delete the IP address and keep your address to send the newsletter; if you later unsubscribe, we keep a record of the address so that we do not email it again.

Our databases are backed up continuously and once a day, in two AWS regions in the United States. When data is deleted from our live systems, whether at the end of one of the periods above or at your request, copies of it can remain in these backups for up to 35 days after it was deleted. The backups are then deleted automatically.

5. Data security

We implement industry-standard security measures including:

  • TLS 1.2 or later on every connection to our website (kawaa.com), dashboard (app.kawaa.com), API (api.kawaa.com) and status page (status.kawaa.com)
  • AES-256 encryption at rest for account data, verification results and uploaded lists, in our databases, file storage, job queues and results cache
  • Automated dependency and security scanning on every change
  • Two-factor authentication option
  • Rate limiting and abuse prevention

Some of the traffic involved in verifying an address is not encrypted:

  • Checking whether a mailbox exists is an SMTP conversation between our verification servers and the mail server that receives mail for the address. That conversation is not encrypted, so the address being checked is sent to that mail server in plain text.
  • Looking up the address's domain (the part after the @) uses ordinary DNS queries, which are not encrypted. We send them through Google Public DNS. They carry the domain only, not the full address.

Our verification servers keep recent results, including the address, in a cache inside our private AWS network. The cache is encrypted at rest, and the traffic between our servers and the cache is encrypted in transit and needs a password. Only our verification servers can connect to it.

6. Data sharing

We do not sell your personal information. We may share data with:

  • The service providers that process it for us to run Kawaa (AWS, Stripe, Cloudflare, Google and Slack):
    • Amazon Web Services (AWS) hosts the service in the United States and sends our email (Amazon SES). AWS includes Amazon Bedrock, which runs the AI analysis of the addresses you submit, writes the support chat's replies and drafts text in the AI email composer.
    • Stripe processes payments. It receives your account email and, if you enter them, your billing name, address, company name and tax ID. Card numbers are entered on Stripe's own pages and go to Stripe directly.
    • Cloudflare runs Turnstile, the bot check on our sign-up, sign-in, password reset, free email checker, support chat, newsletter and status subscription forms. It receives the IP address of the browser that completes the check.
    • Google hosts our email (Google Workspace). The messages you send to any @kawaa.com address, your replies to our emails, and the notices we receive when an email we sent you bounces or is reported as spam, which include your email address, are stored there. Our verification servers also look up the domain of each address you verify through Google Public DNS (the domain only, as described in section 5).
    • Slack, the messaging service our team works in. When you use the support chat, we post your message, the assistant's reply, the email address you gave (if any) and, if you are signed in, your account email, plan and credit balance to our team's Slack so we can follow up. When you sign up for the newsletter, we post a masked form of your email address that shows no more than its first character and the part after the @, where you signed up, and that you have not confirmed yet. Once you confirm, we post your full email address and where you signed up. We do this so we can see new subscribers.
  • Link, LLC, a Stripe company, which sells Kawaa plans and credit packs to you as the merchant of record. When you buy, Link receives your email, name, billing address and payment details, and uses them under its own privacy policy to take the payment, calculate and pay the tax due, prevent fraud, send your receipts and invoices and answer questions about your payments
  • The mail server that receives mail for an address you verify, which is sent that address during the mailbox check described in section 5
  • Law enforcement when required by law
  • Successors in case of merger or acquisition

7. Your rights

You have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your data
  • Export your data
  • Withdraw consent
  • Lodge a complaint with a supervisory authority

8. International transfers

Your data may be processed in the United States where our servers are located. We ensure appropriate safeguards are in place for international transfers.

9. Children's privacy

Our service is not intended for users under 18 years of age. We do not knowingly collect information from children.

10. Changes to this policy

We may update this policy periodically. We will notify you of significant changes via email or through our service.

11. Contact us

For privacy-related questions, and to access, correct, export or delete your data, contact us by email at: privacy@kawaa.com

Our postal address is Kawaa, 548 Market St, PMB 214637, San Francisco, CA 94104, United States.