# Data rules

The API follows exactly the same rules as the app. There is no way around them with an API key.

- **Opt-outs:** people and businesses who asked us not to process their data are never found, checked, delivered or charged, whatever the request.
- **Deletion:** when someone asks us to delete their data, it is removed from every list, including lists made with the API. A deleted list (in the app or with `DELETE /lists/{id}`) is gone for good.
- **30 days:** stored results follow the same retention as the app. The free 30-day reuse only uses your own account's results.
- **Owner names** come only from the business's own website. We never take a person's name from a company register or another source to find or guess their email. Company-register facts (Deep Search) are never linked to finding emails, and find results never include them.
- **US state rules:** for businesses in Vermont, Oregon and Connecticut we deliver owner emails only when the business prints them on its own website, never guessed ones. Business emails (info@, office@ …) are fine everywhere. Everything delivered through the API counts toward the same yearly limits as the app.
- **Your use:** you send to these emails under the laws of your country (CAN-SPAM, CASL, GDPR …) and our [terms](/terms): a clear sender, an unsubscribe link, no purchased-list spam.

We do not tell you which outside services we use for a result, in the app or in the API.