Privacy

The short version: we never store the emails you send us. Before any analysis we remove your own identifying details (your name and email, and the name and email of the person the message was originally sent to). The suspicious email's own contents (the sender, the links, the bank details) are what we analyse and report back to you. The only data we keep is your account email and billing identifiers, encrypted.

What we do with a forwarded email

When you forward an email to check@islegit.email, we process it entirely in memory: we parse it, run safety checks, and redact your identity (the name and email address of the forwarder and of the original recipient) before sending the analysis to our AI classifier. We deliberately do not hide the suspicious email's own details (the sender address, footer, links, IBANs, amounts), because those are exactly what need to be examined and shown to you, and they are not your personal data. The email and any attachments are discarded immediately after we reply, never written to a database, disk or log.

What we store

Account data only: your email address (encrypted, with a hashed lookup key), Stripe billing identifiers (encrypted), your plan, and monthly usage counts. We also keep a short-lived cache that maps a one-way hash of an email's structure to its verdict, so identical mass-scam campaigns can be recognised cheaply. That cache never contains your content.

Third parties

We use Stripe for billing, an email provider (Resend) for sign-in links and verdict delivery, DeepSeek as our AI classifier, and Brave Search so the AI can verify a company's real domain. The email-derived data that leaves our system (the analysis sent to the AI, the search queries used to verify it, and the verdict we email you) always has your identity (your name and email, and the original recipient's) redacted first. It may contain the suspicious email's own details (its sender, domains and links) so the check is useful, but never your personal identifiers.

Your rights

You can cancel and delete your account at any time from your account page or by emailing us. Because we don't store your scanned emails, there is nothing of that kind to export or delete.