Privacy policy
Effective from November 7, 2026
Analytics information updated October 24, 2026
1. Data controller and contact
ByeBouncer is operated by PARABACUTO GUERRERO FIDEL DILLINGER, CUIT 20-19147887-9, located at GUEMES 3221, PALERMO, CIUDAD AUTONOMA DE BUENOS AIRES, postal code 1425, ARGENTINA. For personal data questions or rights requests, email hello@byebouncer.com.
We are responsible for account, security, support and billing data. When a customer submits third-party email addresses, IPs or phone numbers for validation, that customer decides whether it may process those data and how to use the result; ByeBouncer processes them to provide the service. If your organization requires a data processing agreement, contact us before submitting personal data subject to that requirement.
2. Data and purposes
- Account: email address, internal identifier and password stored as a hash by Supabase Auth for access, security and service communications.
- Purchases: Paddle transaction and customer identifiers, the pack and credits added. Paddle directly processes card and billing address details; ByeBouncer does not receive the card number or CVV.
- Legal acceptance: user ID, terms version, server timestamp and acceptance source to document the accepted conditions.
- Withdrawal requests: email address, optional transaction ID, date, case number and status to locate the purchase, respond and document its resolution. You can submit a request without an account.
- API use: technical logs may include IP address, User-Agent, endpoint, status and duration for troubleshooting and abuse prevention.
- Website analytics: we use Google Analytics 4 to measure visits, pages viewed, traffic sources and site interactions and improve our content and usability. It may collect page URL and title, referring page, browser and session identifiers, language, device information and approximate location. Data do not become anonymous simply because reports present them in aggregate.
- Vercel statistics: we also use Vercel Web Analytics for aggregate statistics on visits, pages, sources, approximate location, browser and device. This measurement does not use cookies; Vercel distinguishes visits using a summary of request data whose identifier is discarded after 24 hours. Before sending a page URL, we remove its query parameters, fragments and bulk job identifier.
- Website performance: we use Vercel Speed Insights to measure loading times, interaction response and visual stability. It may collect page route and URL, connection type, browser, device, operating system, country and references to page elements associated with those metrics. We apply the same URL filter as in Web Analytics.
Email verification
We process the submitted email address to produce the result. We do not retain the readable email address in the individual record. We store a SHA-256 digest of the normalized address, domain, verdict, signals, cache indicator, duration, date and API key. The digest may be susceptible to dictionary attacks and is not equivalent to anonymization. The Redis cache uses that digest and does not store the readable email address.
IP verification
For public IPs we store an HMAC of the normalized address, version, scope, ASN, organization, country, checks, signals, blocklists, duration, date and API key. Records from the previous format may include scores. We do not store an individual record for private, reserved or non-routable IPs. We may query reverse DNS and DNSBL lists; ASN, country and Tor exits come from local datasets.
Phone verification
We normalize the number to E.164 and store an HMAC in the summary record, along with country, prefix, line type, carrier and MCC/MNC codes where available, check results, signals, date, duration, cache indicator and API key. Records from the previous format may include verdicts and scores. The readable number is not retained in that summary record. We send the number to specialized services for carrier information. Only if you request line status do we also send it to a network lookup service; that lookup does not call or message the subscriber. If you use the blocklist, we store the HMAC and optional note until you delete them or close the account.
Separately, we retain original responses received from phone data services, including error responses and lookups that do not produce a billable result, for technical traceability, diagnostics and incident review. These responses may contain the readable number, carrier data and network or subscriber identifiers if returned by the source. Some responses or their fields may also form part of the cache and the results delivered to the customer who requested the lookup. Using an HMAC as an index does not anonymize those contents. The original-response archive and raw metadata are deleted under the 30-day period below; the cache has its own shorter retention period.
Bulk jobs
For bulk email jobs, we temporarily retain the submitted list and results file to process them and make them available for download. Job files and metadata are deleted after the period stated below.
3. Grounds for processing
We process data to perform the contract and provide the API; to protect the service and prevent abuse; and to meet legal obligations, including accounting and responding to requests. For EEA users, these purposes are based, as applicable, on GDPR Articles 6(1)(b), 6(1)(f) and 6(1)(c). The customer submitting third-party data must have its own legal basis.
Browsing analytics is a separate purpose and is not necessary to provide the API. Accepting the terms does not constitute consent to analytics cookies or replace any consent requirements under applicable law.
4. Providers and transfers
We use Supabase for the database and authentication, Upstash for caching and rate limits, Vercel for the website, Netcup for the API, Resend for email, Cloudflare for DNS and Turnstile, and specialized services for carrier data and line status on request. Paddle processes payments as merchant of record and may act as an independent controller for those data. These providers may process data outside Argentina. The legal mechanism for each transfer depends on the provider, destination and data involved; contact us about a specific case.
Phone data services receive the queried number and the technical data needed to handle the request. Their data protection role may vary by service and purpose: not all of their processing takes place exclusively on ByeBouncer’s instructions. If you need to identify specific recipients, their roles or transfer safeguards to meet transparency obligations or enter into a data processing agreement, request that information before sending data. Describing provider categories in this policy does not replace specific identification where legally required.
Turnstile may process browser signals to distinguish people from automated traffic. See Cloudflare’s policy.
Google provides Google Analytics and receives site browsing data. Its processing may involve international transfers, including to the United States. See Google’s privacy policy and its explanation of how it uses data from sites that use its services.
Vercel also receives data for Web Analytics and Speed Insights, in addition to hosting the website. Its processing may involve international transfers, including to the United States. See its privacy information for Web Analytics and Speed Insights. The visit identifier’s 24-hour lifetime is not the retention period for aggregate statistics.
5. Retention
- Individual summary records for email, IP and phone validation: 90 days. Separate archive of original phone-service responses and raw metadata: 30 days.
- Email cache: up to 1 hour. DNSBL cache: up to 15 minutes. Phone cache: from a few minutes to 48 hours, depending on the lookup.
- Bulk job inputs and results: up to 7 days after completion.
- Phone blocklist: until you remove each entry or close your account.
- Account: while active; after closure, deletion is planned within 30 days, except for records subject to legal retention.
- Credit transactions: during the account’s lifetime and for the applicable accounting or tax retention period. Acceptance and withdrawal records are kept for as long as needed to document and resolve legal obligations or claims.
- Server logs: operating system rotation, approximately 30 days.
Analytics cookie lifetimes are described in section 8. Google Analytics event and identifier retention depends on the property configuration and differs from cookie lifetimes. You can ask us about the applicable retention period at hello@byebouncer.com.
6. Your rights
Depending on your jurisdiction, you may request access, rectification, erasure, portability or objection to processing and lodge a complaint with the competent authority. Email hello@byebouncer.com from your account’s email address, or explain how to verify your identity if you no longer have access. We will respond within the applicable legal period. Erasure may be limited by retention obligations.
7. Security and automated decisions
We use TLS, API keys stored as hashes, database access controls, rate limits and server security measures. No system guarantees absolute security; we will communicate incidents as required by applicable law.
The current API format returns checks and data for each field, without an overall score or a decision about a contact’s authenticity or fraud. Earlier interfaces and records may retain verdicts, scores or recommendations for compatibility. ByeBouncer does not independently make decisions with legal effects on the individuals concerned. Customers decide how to use results and must meet applicable transparency and human-review obligations.