Privacy Policy

1. Who we are and our role

Proshark is a business based in California, United States. For account, website, billing, security, and business-administration information, Proshark generally decides why and how that information is used and acts as a controller or business under applicable privacy law.

Customers decide which lists to upload and why to verify them. For personal information in customer uploads and resulting verification records, Proshark generally acts for the customer as a processor or service provider. The customer remains responsible for its collection, lawful use, notices, permissions, and instructions. This distinction does not limit rights available under applicable law.

2. Information we collect

• Account data: name, email address, password hash, email-verification status, account status, and sign-in timestamps.
• Session and technical data: session tokens, IP address, user agent, request and security logs, device/browser information, and timestamps.
• Uploaded and generated data: file name, raw CSV and headers during the upload draft, mapped email column, original imported rows, email addresses, normalized addresses, domains, verification results, scores, reasons, diagnostics, job status, counts, and exports. Because original rows are retained with results, uploads may include fields beyond email addresses.
• Free-check data: the checked address, result, score, confidence, reason, account claim and retry status, and relevant timestamps.
• Billing and transaction data: selected package, checkout and order identifiers, amount, currency, payment status, credit balance and ledger, invoices, and payment/audit event records. Card entry occurs on Square's hosted payment page; VXSentry does not ask you to enter full card details into VXSentry.
• Communications: messages and information you send when requesting support, billing help, or exercising privacy rights.
• AI help and support requests: messages you type into the AI assistant and the recent conversation needed to answer you. If you choose to email support, we collect your name (if provided), reply email, subject, message, request reference, send status, and any chat transcript you explicitly choose to attach. Do not include passwords, API keys, payment-card details, or full email lists in the assistant or a support request.

3. How and why we use information

We use information to:

• create, verify, secure, and support accounts and sessions;
• parse uploads, perform requested checks, show results, and create exports;
• process purchases, grant and debit credits, keep financial records, and address disputes;
• send transactional account, verification, password-reset, and service emails;
• detect abuse, enforce rate limits, troubleshoot, audit, and protect the service and its users;
• maintain and improve reliability and explain aggregate job results; and
• comply with law, respond to valid legal process, and establish or defend legal claims.

Where a law requires a legal basis, these activities rely as appropriate on performing our contract with you, our legitimate interests in operating and securing the service, compliance with legal obligations, or consent where requested and legally required. Customers are responsible for the legal basis for personal information they upload.

4. How verification works

Checks may use syntax, domain and DNS information, known-risk signals, and SMTP recipient probes. During an SMTP probe, the relevant DNS operators and recipient mail servers receive technical connection details and the probed recipient address through SMTP envelope commands. VXSentry may also probe a random, likely nonexistent address at the same domain to evaluate catch-all behavior. The probe stops before the SMTP DATA stage: no email body or message content is sent.

Mail and DNS operators may independently log and process these requests under their own policies. VXSentry records domain and SMTP diagnostics, which may include mail-server host, response code and response text, timing, and success status.

5. Service providers and other disclosures

We disclose information as needed to operate VXSentry, including to:

• Replit (hosting and database): hosts the application and database and therefore processes account, session, uploaded, result, log, and transaction data used by the service.
• Postmark (transactional email): receives recipient address and transactional message details needed to send account emails such as verification and password-reset messages. When you confirm a support request, Postmark also processes the reviewed message and any transcript you choose to include, sends it to support@vxsentry.com, and uses your email address as the reply-to address.
• Square (hosted payments): processes payment information on its hosted checkout and provides us order, payment status, amount, currency, and related transaction data.
• OpenAI (optional result summaries): when an AI summary is requested and available, receives aggregate job statistics and the uploaded file name. It does not receive row email addresses through this summary feature, but a file name itself may contain personal or confidential information.
• OpenAI (AI help assistant): receives the messages you submit to the assistant, a limited recent chat history, general page context, and platform guidance needed to generate replies. The assistant connects directly to OpenAI; it does not automatically retrieve your private verification jobs, uploaded lists, account balances, or payment details. OpenAI processes this information under its applicable API data-handling terms. You can choose Email support without using the AI chat.
• DNS operators and recipient mail servers: receive the limited verification-probe information described above.

We may also disclose information to professional advisers and authorities when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or complete a merger, financing, reorganization, or sale of relevant business assets subject to appropriate protections.

We do not sell personal information or share it for cross-context behavioral advertising as part of the service. We do not use advertising pixels, cross-site advertising trackers, or session-recording tools in VXSentry. If those practices change, we will update this policy and provide legally required choices.

6. Retention

Retention varies by record and operational need. Upload drafts become inaccessible through the upload flow after 24 hours, but that access expiry is not presently a guarantee of scheduled deletion at 24 hours. Verification jobs and their row-level results have a default 30-day purge threshold; the purge is manually initiated by an administrator, not an automatic daily deletion process. Data may therefore remain beyond those thresholds until a purge or other deletion occurs.

Purging a job does not necessarily remove related credit-ledger, checkout, payment, webhook, invoice, audit, security, or aggregate operational records. The free-check record is stored separately to enforce the lifetime allowance of 10 free email checks per verified active account and is not removed by a job purge. We retain these records as reasonably needed for accounting, fraud prevention, allowance and balance integrity, dispute handling, legal compliance, and security. Backups and logs may persist for their normal lifecycle.

The assistant keeps the visible conversation in page memory while you browse; it is cleared when you reload or start a new chat. We do not save ordinary AI chat history in VXSentry's database. The AI provider may retain submitted messages under its own API policies. Confirmed support requests, any voluntarily attached transcript, and email delivery records are retained in our support records and mailbox as reasonably needed to respond, follow up, prevent duplicate submissions, resolve disputes, and meet legal obligations. These are separate from verification-job retention.

You may request deletion using the contact method below. We assess each request based on identity, applicable law, customer instructions, legal obligations, and legitimate operational needs; we do not promise immediate deletion or a fixed completion period beyond what law requires.

7. Security

We use reasonable administrative and technical measures appropriate to the service, such as access controls, password hashing, expiring session and account-action tokens, and restricted server-side processing. No internet service or storage system is completely secure, and we cannot guarantee absolute security. Please use a unique password and contact us if you suspect unauthorized account activity.

8. Cookies and local storage

VXSentry uses an essential, HTTP-only session cookie to keep signed-in users authenticated and protect account access. Its normal maximum duration is 30 days, though a session may end sooner. VXSentry also uses browser local storage to remember the user's light or dark theme preference. These technologies are used for service functionality, not advertising. Blocking the session cookie may prevent account features from working; local storage can be cleared through browser settings.

9. Your privacy rights

Depending on where you live and subject to exceptions, you may have rights to access, know about, correct, delete, restrict or object to processing, withdraw consent, or receive a portable copy of personal information. You may also have a right to complain to a privacy regulator.

Email inquiries@vxsentry.com with your request and the account email involved. We may ask for information reasonably necessary to verify identity, authority, and scope. If VXSentry processes uploaded data for a customer, we may refer the request to that customer or assist it in responding.

10. California disclosures

California residents may, where applicable, request access to or knowledge of categories and specific pieces of personal information, sources, purposes, and recipients; correction; deletion; and portability, and may exercise applicable opt-out rights without unlawful discrimination. We do not sell personal information or share it for cross-context behavioral advertising as those terms are defined by California law. If a practice that triggers an opt-out right begins, we will provide the required method.

An authorized agent may submit a request. We may require signed authorization, proof of the agent's authority, and direct identity verification with the resident, as permitted by law. Our categories of collection and disclosure are described in Sections 2 and 5. We do not unlawfully discriminate for exercising privacy rights.

11. International users

VXSentry is operated from the United States. If you use it from another country, information may be transferred to and processed in the United States and other locations where providers operate, whose laws may differ from yours. We do not claim that every jurisdiction's privacy law applies to every user or that a particular transfer certification covers all processing. Where legally required, we will use an appropriate lawful basis or contractual safeguard and honor applicable local rights.

12. Minors

VXSentry is intended for adults age 18 and older and is not directed to children. If you believe a minor has provided account information to us, contact us so we can investigate and take action appropriate under law. Customer-uploaded lists must also be lawfully collected and submitted.

13. Changes and contact

We may update this policy as VXSentry, our providers, or legal requirements change. We will post the revised version here, update the date above, and provide additional notice when legally required or when a change is material in context.