Privacy and activity scoring

Effective: August 5, 2026

What the optional feature does

Customers can enable activity-derived scoring for an individual API key. It uses normalized delivery and engagement events to return an advisory engagement rating, delivery-outcome signal, or conservative catch-all result. It is off by default. Sharing outcome data is a separate choice.

Data and purpose

We process a pseudonymous email hash, event type, provider, event time, domain, and derived score. We do not need email bodies or raw provider payloads. The purpose is to reduce bounces and improve B2B email-deliverability decisions.

Lawful basis and safeguards

Where Email Intel acts as controller, the basis is legitimate interests under GDPR Article 6(1)(f). Customers remain responsible for their own lawful basis and notices. Scores are advisory and must not be used as the sole basis for a legal or similarly significant decision.

Retention

• Normalized activity and derived history: 365 days.
• Engagement cache: 24 hours.
• Deletion audit: 1,095 days using a random request reference and aggregate counts.
• Database backups: seven daily backups; deletion tombstones are retained for 30 days.

The email pattern library

To verify addresses without sending test emails, Email Intel learns the email naming convention companies use (for example, “first.last”) from pages those companies publish — team pages, press releases, public filings. What we keep is the format per company domain and a confidence score. We do not keep directories of people: no employee names or example addresses are stored in the pattern library, and we do not crawl login-gated networks.

When a customer asks us to suggest a likely address for a person at a company, the derived address is cached for at most 30 days and then deleted.

Your choices and rights

Customers can disable scoring per API key. Individuals may request access, correction, objection, restriction, or erasure where applicable. Use the contact form and write “Privacy Request” in the message. We may need enough information to verify and route the request without exposing another person’s data.

Takedown: if you ask us to remove your email address, we acknowledge within 7 days and complete within 30 days (typically 24–72 hours). Removal erases the address from our stores, severs it from verification history, and adds it — as an irreversible hash — to a suppression list so our systems will not re-derive it later.

Automated decisions

Email Intel does not authorize activity scoring for solely automated decisions that create legal or similarly significant effects. Customers must provide human review for consequential uses.