GDPR
Who processes your data with us, where, and what protects it when it leaves Europe.
Last updated September 4, 2026
Roles
For your account and your tracking data, HYPER10N TECHNOLOGIES SAS is the controller. When you upload a list of addresses to verify, or when Checky processes the content of emails you send, we act as processor on your instructions, and you remain the controller of that data.
Sub-processors
| Provider | Purpose | Country | Safeguard |
|---|---|---|---|
| Cloudflare | Hosting, API, database | United States, data at rest in Europe | Standard contractual clauses, DPA |
| Clerk | Authentication | United States | Standard contractual clauses, DPA |
| Stripe | Payments and invoicing | United States and Ireland | Standard contractual clauses, DPA |
| Mailgun | Transactional email | European Union region | DPA |
| OVHcloud | Email verification servers | France | Processed in the EU |
| Hugging Face | AI drafting of follow-ups (Checky only) | United States | Standard contractual clauses |
The transfer to be aware of. Only Checky sends the content of your emails outside the European Union, and only for the emails you explicitly mark. The feature is off by default. If you do not turn it on, no message content ever leaves our European infrastructure.
International transfers
Transfers outside the European Union rely on the European Commission's standard contractual clauses, complemented by encryption in transit and at rest. Email content sent for drafting is not retained by the AI provider for training.
Security
- Everything travels over TLS. No mailcheck endpoint accepts plain HTTP.
- Email content captured by Checky is encrypted at rest with AES-GCM, with a key held only by the server.
- API keys are stored hashed. We cannot show you a key again after it is created.
- Open tracking records a truncated one-way fingerprint of the IP address, never the address itself.
- Access to production is limited to the company's legal representative.
Retention
| Data | Retention |
|---|---|
| Account, tracked emails, open events | Life of the account, then deletion on request |
| Email content captured by Checky | 90 days maximum, or immediately on disabling |
| Verification jobs and results | 90 days on the plans that include history |
| Invoices | 10 years, French accounting law |
Exercising your rights
Write to us through our contact form, giving the address of your account. We answer within thirty days. Deletion removes your account, your tracked emails, your open history and any stored email content. Invoices are kept for the legal period.
Data processing agreement
If you need a signed DPA for your own compliance file, ask us at the address above and we will send one.
Your obligations as a sender
You choose which emails to track. Depending on your jurisdiction and your recipients, informing them may be required, and that duty is yours. Tracking is switchable per email and globally.