Privacy Policy

Last updated: 21 October 2026

Who we are

Domailfix is an email verification service run by Achivix, 69, Mayur Vihar Phase III, Kondli, New Delhi, Delhi 110096, India. In this policy "we" and "us" mean Achivix.

For the personal information described below we are the party that decides how it is used (the "data controller" under the EU and UK GDPR, and the "data fiduciary" under India's Digital Personal Data Protection Act, 2023).

Questions or requests: email privacy@achivix.com.

The short version

• We collect only what is needed to run your account and take payments.
• We do not sell personal information, and we do not use advertising or tracking cookies.
• Email addresses you ask us to check are used only to run the check. We do not send them any message, and we do not save them, except that a business address found written on public web pages is kept with the links to those pages (see "Public web sources").
• Anyone can have their address removed from our public web sources at https://domailfix.com/remove-email.
• You can download or delete your account data yourself from your account page.

What we collect

When you create an account: your name, your email address and your password. The password is stored only as a one-way hash, so nobody here can read it. We also record the date you accepted these terms.

When you buy credits: your phone number, because our payment provider requires one, and a record of the order (the pack, the amount, the currency, the status and the payment reference). Your card, UPI or bank details are entered on the payment provider's page. We never receive or store them. If you add invoice details (a company or personal name, a billing address and a tax ID), we store them and show them on your invoices.

When you use the service: how many credits were added or used and when, and, if you create one, a hash of your API key. If you connect an app such as Claude, the app's name, when it was connected and last used, and hashes of its sign-in tokens. You can disconnect it at any time on your account page.

If you use the site without an account: a one-way hash of your internet (IP) address and a count of the free checks used this month, so the free limit can work. The hash is removed after the month ends.

Technical logs: our web server records the IP address, time and page of each request for security and fault-finding. These logs are kept for about 14 days. Email addresses you check are not written to these logs.

Cookies: one cookie that keeps you signed in. It is strictly necessary and is not used for advertising or analytics. Fonts and scripts are served from our own server, except the payment page, which is loaded from the payment provider when you choose to pay.

Signing in with Google

If you choose "Continue with Google", Google tells us your name and your verified email address, and nothing else. We use them only to create your account or log you in. We do not receive your Google password, and we do not get access to your emails, contacts or files.

Email addresses you ask us to verify or find

To check an address, we contact the email system of the address's domain. That system sees the address and our server's IP address. No email is sent. We may also use Achivix's own records of business email addresses (see the next section).

Finding an address: when you enter a person's name and a company website, we check possible addresses at that company in the same way. We show an address when it is confirmed, or a likely match labelled as an estimate. The names and websites you enter are not stored.

Company email formats: we keep general information about how companies format their email addresses (for example "abc.com uses first.last"), never the address or the person's name. A format on its own does not identify anyone.

We do not store the addresses you check in our database (the only exception is a business address found on public web pages, see "Public web sources"). Results of a bulk list are held in the server's memory so you can download them, and are deleted within 2 hours. To answer repeat checks faster, the answer for an address (for example "does not exist") is also kept in the server's memory for up to 2 hours and then forgotten; it is never written to disk.

Website form widget and integrations: if you add the Domailfix widget or plugin to your website, or connect Domailfix to other tools (such as Google Sheets or Zapier), the email addresses typed into your forms or sent by those tools are checked in the same way and are not stored. You should tell your visitors, for example in your own privacy policy, that addresses entered in your forms are checked by a verification service. If you connect an email, outreach or CRM tool (such as Mailchimp, Brevo, ActiveCampaign, Klaviyo, MailerLite, Instantly, lemlist, Smartlead or Pipedrive) to clean a list, we use the API key you paste only during that check, to read the list's addresses and, if you ask, to mark the results there; the key is not stored.

For these addresses we act on your instructions (as a "processor"). You are responsible for having a lawful reason to hold and check them. See the Terms of Use.

Achivix's own records of business email addresses

Achivix provides business contact data services and keeps a list of business email addresses whose status it has already established. When an address being checked is on that list and no direct answer is available, the answer may come from the list and says so. The list may also be used to estimate whether an address at the same company is likely to be valid; such results are always labelled as estimates. Records are no longer used once they are older than the period we set.

Addresses are added to this list only by our staff. Addresses that customers check are never added to it.

We hold these business contact details on the basis of our legitimate interest in providing accurate verification. If your address is in our records and you want it removed, or want to know what we hold, contact us: email privacy@achivix.com. We will act on it within 30 days.

Public web sources

When an address's own email system cannot say whether it exists, we may look for public web pages where the address is written (for example a company website, a press release or an event page). To do this we send the address, or the person's name and the company website, to a web search service (Tavily, or Google's Gemini API with Google Search). Every page it suggests is opened by our server, and a page is used only if the address is really written on it.

When an address is found this way we keep the address, the links to the pages and the pages' dates, so the answer and its sources can be shown again later. We do not keep the names or websites people search for: searches are remembered only as a one-way code for up to 30 days, so the same search is not repeated.

We hold these public business contact details on the basis of our legitimate interest in providing accurate verification. To have your address removed, enter it at https://domailfix.com/remove-email. It is removed at once and never saved or shown again. You can also contact us: email privacy@achivix.com.

Public profiles and sending results

Public profiles. When a company accepts every address, we may check whether a person works at that company by searching public professional profiles (such as LinkedIn) through our web search service, using the name in the address and the company's name. We keep only the result (whether a matching profile was found, and its link) for up to 30 days.

Sending results. If you report that an address bounced, or clean a list from Mailchimp or MailerLite with "Use this list's bounce and open history" ticked, we keep the address and whether emails to it bounced or were delivered, for up to 12 months, to make answers more accurate for all customers. Nothing else from your list (names, other fields, messages) is kept. You can untick the box, and you can ask us to delete these records at any time.

Why we use your information

• To provide the service you asked for (run your account, count credits, deliver what you bought). Under the GDPR this is performance of a contract.
• To take payments and keep accounts, which the law requires of us (legal obligation).
• To keep the service safe and prevent abuse, for example the free-use limit and sign-in protection (our legitimate interests).
• With your consent, given when you create an account. You can withdraw it at any time by deleting your account.

We do not use your information for automated decisions that have legal effects on you.

Who we share it with

• Our hosting provider, which runs the server the service lives on.
• Our payment providers: Razorpay or Cashfree Payments (for payments in Indian rupees) and PayPal (for payments in other currencies). The provider you pay with receives your name, email, phone number (where it asks for one) and the order amount, and handles your payment details under its own privacy policy.
• The email system of an address you check, as described above.
• Our web search service (Tavily or Google), when we search for public web sources (the address, or a name and a company website), as described above.
• Authorities, when the law requires it.

We do not sell or rent personal information to anyone.

Where your information is kept

Our server and our payment provider may be located in a country other than yours. Where the GDPR applies and information is moved outside the European Economic Area or the UK, we rely on the safeguards the law allows, such as standard contractual clauses.

How long we keep it

• Account details and credit activity: until you delete your account.
• Payment records: kept after an account is deleted, without your name, email or phone number, for as long as tax and accounting law requires (currently up to 8 years in India).
• Bulk verification results: up to 2 hours.
• Public web sources: until the address is removed at your request, or the pages are more than 3 years old.
• Free-use counter for visitors: until the month ends.
• Technical logs: about 14 days.

Your rights

Depending on where you live, you have the right to:

• see the personal information we hold about you and get a copy of it;
• have it corrected or updated;
• have it erased;
• object to or restrict some uses, and move your data elsewhere (GDPR);
• withdraw consent at any time;
• nominate someone to exercise your rights if you die or become incapacitated (India);
• complain to us, and to a regulator if you are not satisfied.

How to use them. Sign in and open your account page: "Download my data" gives you a copy, and "Delete my account" erases it. For anything else, contact us: email privacy@achivix.com. We answer within 30 days.

Regulators. In India you may complain to the Data Protection Board of India after first raising the matter with us. In the EU or UK you may complain to your local data protection authority.

Security

The site is served only over an encrypted connection (HTTPS). Passwords, API keys and sign-in tokens are stored as hashes. Access to the server is limited to the people who run the service. No system is perfectly secure; if a breach affects your personal information we will tell you and the relevant authority as the law requires.

Children

Domailfix is a business tool and is not meant for anyone under 18. We do not knowingly collect information from children. If you believe a child has created an account, contact us and we will delete it.

Grievance officer and contact

Grievance officer: Privacy & Grievance Team. Achivix, 69, Mayur Vihar Phase III, Kondli, New Delhi, Delhi 110096, India.

Contact: email privacy@achivix.com.

Changes to this policy

If we change this policy we will update the date at the top. If a change is significant we will tell account holders by email or on the site before it takes effect.