We keep only what we need to run filtrat for you, and we delete it on a schedule. This page sums up what that means in practice. The Privacy Policy and Security pages are the full, binding versions.
At a glance
| What | Why we keep it | How long |
|---|---|---|
| Account details (email, name) | To run your account | While your account is open, plus 30 days after it's closed |
| Verification results and your verification history | So re-checks within 180 days are free | 180 days from the check, then deleted automatically |
| Your email finder history | So finding the same person again within 180 days is free | 180 days from when the email was found, then deleted automatically |
| Your lists, leads, companies and jobs | They're your work in filtrat | Until you delete them or close your account |
| API keys | To authenticate your requests | Only a fingerprint is kept, never the key. Deleted when you revoke the key |
| Exclusion lists | To keep those contacts out of your lists | Until you delete the list. Stored encrypted |
| Invoices and accounting records | Tax and accounting law | 7 years |
| Server and access logs | Security, troubleshooting, abuse prevention | 90 days |
| Support emails | To help you | 3 years from the last contact |
Email addresses you verify
The addresses you submit, and the people you find, may belong to other people. We use them only to give you results:
- We never sell them, share them with other customers, or use them for marketing.
- Each result is cached for 180 days so that checking the same address again in that time is free. After 180 days it's deleted.
- You can clear your cached results at any time from your Profile. See Delete your data.
For these addresses, you are the controller and we are the processor. See GDPR and the DPA.
Exclusion lists
Customer lists, competitor lists and do-not-contact lists are sensitive, so we store them differently:
- Every value is encrypted. Nothing is kept in plain text.
- Matching works without reading the values back: we compare fingerprints.
- Your lists are only ever used for your account. They're never shared with other customers or used to improve anything else.
API keys and passwords
- Your password is stored as a one-way hash. We can't see it.
- API keys are stored as fingerprints. The full key is shown once when you create it and is never stored or logged. That's why we can't show it again.
When you connect LinkedIn, we don't keep your LinkedIn password or session cookie in our database. See How your LinkedIn access is protected.
Payments
Card payments are handled by our payment provider. We never see or store full card numbers; we keep only what's needed for invoices, such as your billing name and address and the last four digits of the card.
What we don't do
- We don't sell personal data.
- We don't use advertising cookies, marketing pixels or cross-site tracking.
- We don't send marketing emails. Everything we send is about your account: confirmations, receipts, security and service notices.
How it's protected
All connections use HTTPS. Sensitive data is encrypted at rest. Access to production systems is limited to the people who need it, and administrative actions are logged. If a breach ever affects your data, we'll tell you by email without undue delay and notify the supervisory authority within 72 hours, as GDPR requires.
Questions
Email privacy@filtrat.io for anything about your data. To report a security issue, write to the same address; we answer within one business day.