Privacy Policy

How RatifAi handles personal data — yours, and that of the people in the lists our customers check. Last updated 7 October 2026.

1. Who we are

RatifAi is operated by BetterClosure Inc., a Florida corporation doing business as FlowClick, of 2125 Biscayne Blvd, Ste 204 #10484, Miami, Florida 33137, United States.

Data protection enquiries: privacy@ratifai.app. We aim to respond within 5 business days and, for a formal data-subject request, within one month.

2. The three roles we play — read this first

Most privacy policies have one role. We have three, and conflating them is how these documents become misleading. So:

• Controller, for account data. Your name, email, password hash, usage and billing. We decide why and how we process it.
• Processor, for the contact data you submit. The email addresses, names, companies and other fields you upload or send to the API. You are the controller; we act on your documented instructions under our Data Processing Addendum. If you are one of those contacts and want your data erased, contact the company that holds your details — they instruct us, and the erasure then reaches every store we have, including the shared corpus.
• Controller, for the pseudonymised corpus. We decide to keep pooled, non-attributable observations to improve the service for everyone. This is our own purpose, under legitimate interests, and we describe it fully in section 5.

3. Account data we collect, and why

We never store your card number. Card details are entered at Stripe’s hosted checkout. We never store your API key, only a one-way hash — which is why a lost key cannot be recovered, only replaced.

4. Contact data our customers submit

When a customer checks a list, we process the fields they send — typically email address, and optionally name, phone, company, website and address — plus everything we derive: verdicts, reasons, evidence, provenance, enrichment, duplicate clusters, golden records and quality scores.

To verify an address we connect to the mail server responsible for its domain and conduct a protocol-level conversation. This discloses the address being checked to that mail provider, which is inherent to how email validation works and is the same disclosure that occurs when anyone sends mail to that address. We never send a message in the process.

This data is tenant-scoped and isolated. We use it only to provide the service to the customer who submitted it. We do not sell it, and we do not use it to build profiles of individuals.

5. The pseudonymised corpus

To make validation, catch-all detection and the email finder work, we keep a cross-customer corpus holding a keyed HMAC-SHA256 pseudonym of each address observed, together with domain-level intelligence. The keying secret is held separately from the data.

The corpus never contains the plaintext address, and it carries no customer identifier.

Our legitimate interest is providing accurate verification: an observation that a mailbox rejected mail yesterday is what lets us tell the next customer not to send to it today, which prevents messages to dead and trap addresses and protects people from receiving mail they never asked for. We have weighed this against the interests of the individuals concerned, and the safeguards are that the data is pseudonymised at the point of collection, holds no plaintext address, carries no attribution to any customer, and is subject to the individual erasure right in section 8.

Two consequences we state plainly rather than bury:

• We cannot isolate and remove one customer’s entire historical contribution. Observations are pooled and keyed only by address hash or domain, with no customer identifier, so there is no way to select “everything this account ever contributed”. We do not pretend otherwise.
• We can erase every trace of a named individual. Given the plaintext address we recompute the same keyed hash and delete that row, along with everything derived from it. The unit of erasure is a person, which is what the law actually requires.

6. The suppression list, and why erasure does not remove it

We keep a suppression list of hard bounces, complaints, spamtraps and abuse reports. It holds only a one-way hash of the address and a reason category — never the plaintext address.

It is retained through erasure, deliberately. Removing a suppression entry would make the address sendable again, so someone could mail a person who had already complained. Erasing it would cause the harm it exists to prevent. We rely on legitimate interests, and we keep the entry as narrow as it can be: a pseudonym and a category, nothing more.

This is the one thing an erasure does not remove, and we would rather say so here than have you discover it.

7. Who we share data with

We do not sell personal data and we do not share it for cross-context behavioural advertising.

RatifAi and the FlowClick platform it runs on are both operated by BetterClosure Inc. — the same legal entity — so FlowClick is not a third party and not a sub-processor. A current sub-processor list with entity details and locations is maintained in Annex III of the DPA. We may also disclose data where legally required, and will give notice where we are permitted to.

8. Your rights

Depending on where you live you may have rights to access, correct, delete, restrict or object to processing, to portability, and to withdraw consent. For account data, exercise them at privacy@ratifai.app.

If you are a contact in a customer’s list, that customer is the controller. Ask them. They can erase you from Settings → Data & privacy or via POST /v1/erasure, and that erasure removes your record, validations, evidence, scores, any golden record derived from you, and your row in the shared corpus. It is immediate, irreversible and costs the customer nothing. If you cannot reach them, write to us and we will make reasonable efforts to help.

Three honest limits:

• Your suppression entry survives, for the reason in section 6.
• Erasure is not a permanent block. If your address is submitted again later it will be validated and observed afresh. We deliberately keep no do-not-observe list, because such a list would have to retain the very pseudonym it was meant to remove.
• A customer can only erase addresses their own account submitted. This stops one customer degrading the shared corpus with observations they never made.

Every erasure is logged for accountability — timestamp, requesting account and counts removed per store — without retaining the address or its hash.

If you are in the EEA or UK you may complain to your supervisory authority. In the US, California, Virginia, Colorado, Connecticut and other state residents have rights under their own statutes; we treat all such requests under this section and do not discriminate against anyone for exercising them.

9. International transfers

We are based in the United States and process data there. Where we receive personal data from the EEA, the UK or Switzerland, transfers are made under the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum where the UK GDPR applies. These are incorporated into our DPA and are available on request.

10. How long we keep things

Full detail, store by store, is in Data retention & privacy.

11. Security

Production runs in a Heroku Shield Private Space, which provides network isolation, encryption of data at rest and enhanced audit logging. Passwords are stored as salted hashes and API keys as one-way hashes; neither can be recovered, only reset. Address pseudonyms are produced with a keyed HMAC whose secret is held separately from the data and is version-controlled with a documented custody and rotation process. Data is encrypted in transit. Access to production data is limited to personnel who need it. Tenant data is isolated and that isolation is tested.

No system is perfectly secure. If a breach affects your personal data we will notify you and any regulator as required, without undue delay.

12. Cookies

We use a session cookie to keep you signed in, and nothing else. No advertising cookies, no third-party analytics trackers, no cross-site tracking. There is no consent banner because there is nothing to consent to.

13. Children

RatifAi is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child’s data has reached us, write to privacy@ratifai.app and we will delete it.

14. Automated decision-making

RatifAi produces verdicts and quality scores automatically. These are assessments of an address or a record, not decisions about a person, and we do not use them to make decisions producing legal or similarly significant effects. Our Acceptable Use Policy prohibits customers from using a verdict as the sole basis for such a decision.

15. Changes

We may update this policy. For material changes we will notify account holders by email before they take effect. The date at the top always reflects the current version.

16. Contact

BetterClosure Inc. d/b/a FlowClick, 2125 Biscayne Blvd, Ste 204 #10484, Miami, Florida 33137, United States. Privacy: privacy@ratifai.app. Security: security@ratifai.app. Legal: legal@ratifai.app.

See also: Terms of Service · Data Processing Addendum · Acceptable Use Policy · Data retention & privacy