Privacy Policy

How we handle personal data in PECR Check

Last updated: 22 October 2026

Who we are

PECR Check is operated by Emailmovers Limited (“we”, “us”), a company registered in England and Wales with company number 05046417. Our registered office is C/O Jackson Robson Licence, 33-35 Exchange Street, Driffield, East Yorkshire, YO25 6LL, England. Our trading office is Suite 4, William Street Business Centre, 7A Lower Clark Street, Scarborough, North Yorkshire YO12 7PP. For any data protection question, email compliance@emailmovers.com.

What PECR Check does

PECR Check is a service for businesses. A customer sends us an email address, through our API, dashboard or the free checker on our website, and we return whether it can receive mail, whether it is a free webmail address, the UK registered company behind the domain, and a PECR subscriber verdict. Each check made through the API or the dashboard creates a stored evidence record.

Our role for the addresses you check

When a customer checks email addresses through the API or the dashboard, the customer decides which addresses to check and why. The customer is the controller of those addresses and we act as its processor, processing them only on its instructions to provide the service. If your address was checked by one of our customers and you want to exercise your rights, please contact that organisation. We will help them respond.

When someone uses the free checker on our website without an account, we process the address they enter only to return the result. The address is sent to MillionVerifier for the mailbox check, a daily limit is applied using a cookie and a hashed IP address, and no evidence record is kept.

We never add the email addresses you check to Emailmovers’ marketing database, and we never use them to market to the people they belong to.

Our role as a controller

We are the controller of:

  • account data for our customers and their users (name, email address, login details and settings);
  • billing and transaction records;
  • website, security and usage data, such as IP addresses, request logs and the free check counter;
  • messages you send us;
  • our own UK business reference data, which is about organisations and is used to identify the company behind a domain.

What we store about each check

We do not store the plaintext email address you check. The address is used to run the check, and the evidence record keeps a SHA-256 hash of it instead. Each evidence record holds:

  • an audit ID and the time of the check;
  • the SHA-256 hash of the address and its domain;
  • the verdict, recommended action, confidence, reason codes and policy version;
  • the company number and status returned, if any;
  • the customer account, the API key used, any reference the customer supplied and the IP address of the request.

Evidence records are kept for 3 years by default, so customers can show how they classified an address. Suppression list entries are stored as a SHA-256 hash for email addresses and as plain text for domains.

How and why we use data

  • To provide the service and manage your account and subscription (performance of our contract with you).
  • To keep the service secure, prevent abuse and enforce usage limits (our legitimate interests in running a safe and reliable service).
  • To send service emails such as sign-in links, password resets and billing notices (contract and legitimate interests).
  • To keep financial records (legal obligation).
  • To understand how our website is used with analytics, only if you consent (consent).

Who we share data with

We use these sub-processors and service providers:

  • Vercel: website and API hosting.
  • Supabase: database and authentication, hosted in an EU/UK region.
  • MillionVerifier: the mailbox check. It receives the email address being checked.
  • Companies House: public register lookups. We send only search terms derived from the domain, never the email address.
  • Stripe: billing and payments. We do not store your card details.
  • Resend: transactional email.
  • Google Analytics: website analytics, only if you accept analytics cookies.

We do not sell personal data. We may disclose data where the law requires it.

International transfers

Some of these providers may process limited data (such as a web request or an email in transit) outside the United Kingdom. Where that happens, the transfer is covered by appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep data

  • Evidence records: 3 years by default (hash only).
  • Account data: for as long as your account is open, then deleted or anonymised, except where we must keep records by law.
  • Billing records: as long as tax and accounting law requires.
  • Free checker limits: the browser cookie lasts 48 hours, and the daily counter is keyed to a hashed IP address.

Cookies

We use essential cookies for sign-in and for the free checker, and analytics cookies only with your consent. See our cookie policy.

Your rights

Under UK GDPR you can ask to access, correct or delete your personal data, restrict or object to our processing, and receive your data in a portable format. You can withdraw consent at any time. You can object to direct marketing at any time. To use any of these rights, email compliance@emailmovers.com. If we process your address as a processor for a customer, we will pass your request to that customer.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the UK data protection regulator, the Information Commission (which took over from the Information Commissioner’s Office on 30 September 2026).

Changes to this policy

We may update this policy. We will change the date above and, where the change is significant, tell account holders.

Contact

Emailmovers Limited, Suite 4, William Street Business Centre, 7A Lower Clark Street, Scarborough, North Yorkshire YO12 7PP. Email compliance@emailmovers.com. Registered office: C/O Jackson Robson Licence, 33-35 Exchange Street, Driffield, East Yorkshire, YO25 6LL, England. Company number 05046417.