Privacy Policy
Last updated 30 October 2026
How ZBounce handles verification, accounts, campaigns and recipient data, including what remains stored after processing.
1. Who processes your data
ZBounce provides email verification, campaign tools and related software. This policy explains how personal data is handled when you use these products or your information is processed through them.
ZBounce determines the purposes of account administration, billing, security and support. For customer recipient lists and campaigns, the customer generally determines the purposes and ZBounce processes data on their instructions. Any required data-processing agreement governs that processing; this policy explains our practices and does not replace that agreement.
2. Verification and browser imports
The website trial and list tool read your import file in the browser and send selected email addresses for verification. They do not intentionally save the source file or report in browser storage. Verification contacts domain and recipient mail services as needed to perform your request. Processing also generates results, usage information and technical records.
Paid verification can use a purchased API key without a mailer account. Your connected key stays in the list-tool tab’s memory until disconnect or page closure; this does not remove records held by the API or payment service.
3. Accounts, campaigns and payments
An optional campaign account stores your verified email, protected password information, sign-in records, workspace membership and roles. We also store connected keys, saved recipient lists and their fields, templates, campaign content and history, sending-domain information, uploaded media and message archives. These records support the features you choose to use.
Stripe processes checkout data. ZBounce stores payment and subscription references, purchases, balances and related key records. WordPress licensing may store site identifiers and callback details. Data supplied to an integration is also subject to that provider’s handling.
4. Email events and unsubscribe
Sent campaign HTML can include a tracking pixel. Loading it records the recipient address, campaign, event and time; events may be sent to a customer-configured webhook. Image proxies and automated scanners can affect these signals. Senders must provide appropriate notice and obtain consent where required.
An unsubscribe link records an opt-out against the sending API key, and campaign events can update workspace recipient status. This is not automatically a block across every key or sender. Contact the sender, or support with the message details, if a link fails or messages continue. Minimal suppression records may need to remain so an opt-out is respected.
5. Purposes and legal grounds
Where the UK GDPR or EU GDPR applies, the legal grounds for our own processing include performing our agreement with you, meeting legal obligations and legitimate interests in security, fraud prevention and support, subject to your rights and the required balancing. We rely on consent where required. Customers are responsible for a lawful basis and the marketing permissions needed for their own campaigns.
Data is used to provide, bill, secure and support the service. This policy does not authorise selling recipient lists, unrelated advertising or training AI models on customer content.
7. Retention, deletion and backups
Addresses submitted only for verification and the resulting reports are processed temporarily and are not included in ZBounce backups. Technical and security records may be kept separately where needed to operate and protect the service.
Contact lists that you choose to save in a campaign workspace, templates, campaign history and uploaded content are stored for ongoing use. Account, billing and suppression records may remain where needed to provide the service, respect unsubscribe requests, resolve disputes or meet legal obligations. You can contact support about access or deletion.
Encrypted backups protect stored account and campaign data and related business records. These copies rotate over time, so deleting information from the active service does not necessarily remove it immediately from every backup. Retention depends on the purpose of the information and applicable legal requirements.
8. Browser storage and security
The website and campaign application use browser storage for language preferences and cookies needed for sign-in and security. Outside the EEA, the United Kingdom and Switzerland, the other website pages also load the Google Ads tag, which can set advertising cookies to count purchases that follow an ad click; in those regions it sets none. These legal pages contain no advertising trackers. Payment providers and integrations have their own privacy information. We use access controls and safeguards for credentials and stored data; absolute security cannot be guaranteed.
9. Your choices and rights
Where applicable, you can request access, correction, deletion, restriction or portability, object to processing, withdraw consent and complain to a data-protection authority. Withdrawal does not invalidate earlier lawful processing. Direct-marketing objections must be respected. We may reasonably verify your identity and handle requests within applicable legal timeframes.
If a customer uploaded your data, contact that sender/controller first; support can help route the request. Necessary account, security and billing messages are distinct from marketing preferences.
This policy provides information about processing; using the service does not by itself constitute consent to optional processing or a waiver of privacy rights. Material changes will be communicated as required by law.
The English text is the primary version of this policy. Translations assist understanding; English prevails in a discrepancy only to the extent permitted by law. This does not change actual processing or limit mandatory data-protection rights or language requirements. Our service agreements are governed by the law of England and Wales as described in the Terms of Service; this does not displace applicable data-protection law or the rights of data subjects.
Contact and requests
Use this address for privacy requests, billing questions or abuse reports. Include only what is necessary to identify the request; never send your password, API key or payment confirmation link.