Security and data handling

Last updated: 2 November 2026

In short

Precleared checks whether a business email address may be sent cold email, using public records and the recipient's own website. It never contacts the recipient. Card details are collected by Stripe and never reach Precleared. For questions, security reports or deletion, email support@precleared.dev. We don't sell data, share it with advertisers or use it to train AI models.

What we receive

The REST API and the MCP tool accept the same fields. You must send a recipient email address or a recipient domain. Everything else is optional.

• Recipient email address (max 254 characters) or recipient domain (max 253). One of these is required.
• Sender country: GB, US, AE or CA. Defaults to GB.
• Pitch (max 2,000 characters).
• Address source: published, bought, scraped, given or unknown. Defaults to unknown.
• Recipient country and a fallback recipient country, as two-letter codes.
• Company name (max 160) and company number (max 12).
• Recipient's name (max 120).
• Three yes or no flags: pitch relevant, existing customer, suppressed.
• A draft email, if you want its footer checked: subject (max 300 characters), body (max 20,000, plain text or HTML), sender name (max 120) and sending address (max 254). The draft is not stored. The receipt carries a SHA-256 hash of it, so you can show later which draft was checked.

The A2A endpoint accepts the same fields except company name and recipient's name.

What we look up

• Companies House: company profiles, name searches and officer lists.
• The recipient domain's public website: the home page and common legal, contact and about pages, over HTTPS with an HTTP fallback, following redirects. These are ordinary page requests; your email address and pitch are not sent.
• DNS: the domain's mail (MX) records, with an address record fallback.

Nothing is sent to the recipient. We do not send email or probe their mail server. A check does not send data to an AI model.

What we keep and for how long

For each check we store:

• The check: the email address and domain, sender country, pitch, address source, company name if sent, the facts found (country, legal form, company details from the register including a director's first name, mail records) and the verdict with its reasons. The recipient's name is used during the check and is not saved as its own field.
• A signed receipt: hashes of the request and response, and the signature.
• The draft email, if sent, is not stored; only its hash is on the receipt.
• A request log: channel, outcome, client name, user agent, key prefix and a salted SHA-256 hash of the caller's IP address. The IP address itself is not stored.
• For API keys: the details you give when you create a key and a SHA-256 hash of the key. The key itself is not stored.

Periods the system enforces:

• Per-minute rate limit counters: deleted after 2 hours.
• Claude sign-in requests and codes: deleted after 1 day. Sign-in tokens: deleted 7 days after they expire.
• Campaign gate lead results: deleted 30 days after the job finishes.
• Internal accuracy replay reports: deleted after 30 days.
• Opt-out list entries: kept until you remove them.
• Cached lookups are refreshed after 30 days (1 day after an error, 7 days for register name searches). The cached rows are not deleted.

Checks, receipts, request logs, API key records and the lookup cache have no end date. They are kept until you ask us to delete them. A record we delete at your request can persist in Lovable's backups for up to about 14 days afterwards. To ask, email support@precleared.dev with the receipt id or key prefix.

Public receipt pages show only the first character of the address, three asterisks and the domain. For example, jane@example.com is shown as j***@example.com. Receipt pages ask search engines not to index them.

Where it's stored

The website, servers and database are hosted by Lovable. The database runs on Lovable Cloud, Lovable's backend built on Supabase's open-source foundation, in Lovable Cloud's Americas region: Amazon Web Services servers in the United States (US East, Northern Virginia). The region was fixed when the backend was set up. Lovable serves the website from locations around the world and backs the database up every day, keeping about 14 days of backups. Because the database is in the United States, data you send us is stored outside the UK. Our privacy page says how that transfer is covered.

AI training

Precleared does not send check data to an AI model and does not use it to train one. Lovable, our host, states in its privacy policy that the records in a project's database and data about a project's users are not used to train its models.

Suppliers

Integrations you choose to connect: HubSpot, Apollo, Instantly, Smartlead, Woodpecker, Apify, Zapier, Make, n8n, Clay and Claude. Data goes to them only when you connect them.

How it's protected

• All traffic uses HTTPS.
• API keys are stored as SHA-256 hashes.
• IP addresses in logs are stored as salted hashes.
• Each receipt is signed with Ed25519. The public key is published at /api/v1/public-key, so anyone can verify a receipt.
• Each key has a rate limit, 60 checks a minute by default.
• The database is backed up daily by Lovable, with about 14 days of backups kept.
• The Claude connector signs in with OAuth and PKCE. Its access and refresh tokens are stored as hashes, and refresh tokens are replaced on each use.
• Campaign gate provider API keys are encrypted with AES-256-GCM, using a key derived for that purpose and bound to the job. They are deleted when the job finishes or fails, or when a stalled job is stopped after 30 minutes.
• Card payments are taken on Stripe's own checkout. Precleared keeps only Stripe's customer and payment references.

Data processing agreement

Businesses that need a data processing agreement under UK GDPR can ask for one at support@precleared.dev.

Status

The live health check is at /api/v1/health. A health pulse runs every 5 minutes.

Who we are

Precleared is run by Gabriel Imevbore, trading as Precleared, a sole trader based in England. 82A James Carter Road, Mildenhall IP28 7DE, United Kingdom.

For security reports, deletion and data processing agreement requests, email support@precleared.dev. See also our privacy page.