Privacy policy

Effective date: 28 October 2026

Who we are

The ZKemail website (www.succorleadscloudsolutions.com) and the ZKemail application are operated by Succor Leads Cloud Solutions LLC ("we", "us"), a Delaware limited liability company (file number 7401147). ZKemail is an email deliverability and per-ISP warm-up platform.

Registered office: 3422 Old Capitol Trail, Suite 700, Wilmington, DE 19808, United States. Questions about this policy or your data: privacy@succorleadscloudsolutions.com.

This website

When you visit the website, our servers receive the technical data every web request carries: your IP address, your browser's user agent, the page requested, the referring page and the time. We use it to deliver the pages, to keep the site secure and to investigate faults. These logs are kept for 90 days.

Google Analytics, only with your consent

We use Google Analytics 4, a service of Google, to count visits and see which pages are useful. A banner asks for your choice the first time you visit:

• Accept: Google Analytics may set its cookies (named _ga and _ga_ followed by an identifier) to recognise repeat visits. Google sets their lifetime; it can be up to two years.
• Decline, or no choice yet: Google's tag is not loaded at all, so nothing is sent to Google and no analytics cookie is set.

We use Google's Consent Mode in its basic form: the analytics tag loads only after you accept. Advertising features are never enabled: advertising storage, ad user data and ad personalisation are always denied, and Google signals are switched off. We do not send Google your name, your email address or anything you type into a form.

Your choice is stored in your browser (local storage, under the name zk-analytics-consent). You can change it at any time with the "Cookie settings" link at the bottom of every page; declining after you accepted removes the analytics cookies this site set. Google processes this data under its own terms and may process it outside your country, including in the United States.

Other things stored in your browser

• Your light or dark theme preference (local storage, ops-theme and zk-theme).
• In the application only: a session cookie that keeps you signed in. It is strictly necessary, is set when you sign in and is not used for analytics.

When you contact us or request a trial

If you write to us or ask for a trial, we receive what you send: typically your name, email address, company, the plan you chose and your message. We use it to reply, to set up access you asked for and to keep a record of the conversation. We do not sell it and do not add it to marketing lists without your agreement.

When you start a 7-day trial, you enter your card on Stripe's own checkout page. Your card details go to Stripe, never to our servers; we receive from Stripe your name, email address, the plan and the status of the subscription.

The ZKemail application

Customers use the application to warm up sending domains, test inbox placement and check DNS authentication. To do that it holds:

• Account data: the name, email address and role of each user, and the second-factor (TOTP) secret when two-factor sign-in is enabled.
• Workspace data: sending domains, server and mailbox settings (credentials are encrypted at rest), recipient and seed lists, delivery results and logs of privileged actions.
• Sign-ups collected for customers: some pages on our customers' own sending domains post sign-ups (a name and an email address) to ZKemail. For these the customer decides why the data is collected; we process it on the customer's behalf. An opt-out removes the address and suppresses it from further sending.

For data that customers put into the application, the customer is responsible for having a lawful basis to process it, and we process it on their instructions. A data-processing addendum is in preparation. Each customer workspace is isolated from the others in the database.

Google user data

Some features ask you to connect a Google account through Google's own consent screen. You choose which account to connect and Google shows you exactly what you allow. What the application then does with it depends on the feature:

• Gmail Postmaster Tools (permissions to view your Postmaster Tools domains and their email traffic metrics): the application lists the domains you registered in Postmaster Tools and reads their daily statistics and compliance status (spam rate, SPF, DKIM and DMARC success, encryption, delivery errors, sender-requirements status), and shows them to you next to your sending domains. It saves copies you ask it to keep in your workspace's history.
• Site Verification (permission to manage the list of sites and domains you control): when you ask the application to verify one of your sending domains with Google, it requests a verification token, publishes it in that domain's DNS at your request, and asks Google to confirm it.
• Gmail mailboxes you connect as test inboxes ("seed" mailboxes) (permission to access Gmail): these are mailboxes you set up for deliverability testing. The application reads the message headers in their inbox and spam folders (sender, subject, date, the servers a message passed through and its authentication results), not the message bodies, to measure where mail lands and which senders reach the mailbox. On the test messages that the platform itself sent, and only on those, it acts like a real recipient: it moves them out of spam, marks them as read and sends short replies. It does not change, delete or send any other message.
• Your Google account's email address (openid and email): to show which Google account is connected.

We store the access granted by Google (the refresh token) encrypted on our servers, and keep only the data described above. You can disconnect a Google account in the application at any time, which deletes its stored token, and you can also remove ZKemail's access at myaccount.google.com/permissions.

ZKemail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data obtained through Google APIs is used only to provide the features described above to the user who connected the account; it is not sold, not used for advertising, not used to build user profiles, and not used to develop, improve or train generalised artificial-intelligence or machine-learning models. It is never sent to the AI model providers listed below. No person at ZKemail reads it unless you ask us to, unless it is needed for security purposes (such as investigating abuse) or to comply with the law, or unless it is aggregated and anonymised for internal operations.

Who else receives data

• Hetzner Online GmbH (Germany), our hosting provider, which runs the servers the website and the application run on.
• Stripe, which processes trial card verification and subscription payments.
• Google, for website analytics, only after you accept, as described above.
• AI model providers (Google Gemini and OpenRouter), which receive the instructions used to write warm-up message text. They never receive data obtained from your Google account.
• The DNS registrar of a customer's domain (Namecheap or NameSilo), only when the customer asks the application to apply a DNS change.
• Anyone we are legally required to disclose data to.

This list is complete on the effective date above; we update this page when it changes.

How long we keep data

Contact and trial-request data: while we are in contact with you, and deleted within 30 days after you ask us to or after your account closes. Account and application data: kept while the account is active, available for export for 30 days after it closes, then deleted. Server and security logs: 90 days. Billing records: as long as tax and accounting law requires.

Your choices and rights

Depending on the law that applies to you, you may be able to ask for a copy of your data, its correction or its deletion, or object to its use. Write to privacy@succorleadscloudsolutions.com. If your data is in a customer's workspace, we will pass your request to that customer.

Security

Two-factor sign-in, role-based access, audit logs of privileged actions, database-level tenant isolation and encryption of stored credentials. No system is perfectly secure; report a vulnerability through security.txt.

Changes

We will update the effective date above when this policy changes, and announce material changes on this page.