Legal
Privacy Policy
What we collect, why we collect it, who helps us process it, and how long we keep it.
Last updated: October 19, 2026
VerifiedInbox is a business service. This policy explains what information we handle when your company uses our website, API or MCP server, and why.
What we collect#
- Account information — your name, work email, organization, role and sign-in details.
- Domain information — the domains you check and their public DNS records (SPF, DKIM, DMARC, BIMI, MX, nameservers), website information, and public web-archive history.
- Logos — files you upload or that we find on your website, the converted versions, and their analysis.
- Business details — legal company name, registration number, address, and the applicant's name, title, email and phone, plus trademark records we look up.
- Payment information — handled by Stripe. We see the payment status and basic billing details, not your full card number.
- Messages — support requests, feedback, and test emails you send to our test address (headers and authentication results).
- Usage information — logs of requests to our website, API and MCP server (IP address, browser or client, actions taken), used for security, rate limiting and improving the service.
Why we use it#
- To provide the service: run checks, prepare your application, order and manage certificates, host your logo and certificate, monitor your setup and send renewal reminders.
- To verify your business and your authority, as the certificate issuer requires.
- To process payments and refunds.
- To answer support requests and keep you informed about your domains.
- To secure the service, prevent abuse and improve the product.
We don't sell your information.
Sub-processors#
We use these service providers to run VerifiedInbox:
| Provider | Purpose |
|---|---|
| Railway | Hosting of our application, database and files |
| WorkOS | Sign-in and organization management |
| Stripe | Payments and billing |
| DigiCert | Certificate validation and issuance |
| Resend | Sending email (notifications and reminders) |
| Postmark | Receiving test emails |
| Browserbase | Automated browsing for public trademark and business-registry lookups |
| Anthropic | AI analysis, such as comparing your logo with trademark records |
| OpenCorporates | Company registry lookups |
Public information about your domain, logo and trademarks is also checked against public sources such as DNS, the US Patent and Trademark Office and the Internet Archive.
Certificates are public#
Mark certificates are public by design: they include your company name, domain and logo, and the certificate issuer may publish them in public certificate logs. Your BIMI DNS record and hosted logo are publicly accessible so that inboxes can display them.
Retention#
- Account, application, certificate and billing records: for as long as your account is active, and afterwards as needed for legal, tax and audit purposes.
- Anonymous drafts (no account): deleted after the guest session expires, at most about 90 days.
- Logs: kept for a limited period for security and troubleshooting.
You can ask us to delete your account and data; we'll do so unless we must keep certain records by law.
Security#
We protect information with encryption in transit, access controls, tenant isolation between organizations, and scoped API keys. No system is perfectly secure; tell us right away if you suspect a problem.
Your choices#
You can view and update your account information in the dashboard, revoke API keys at any time, and contact us to access, correct, export or delete your information.
Contact#
Privacy questions: support@getverifiedinbox.com.