Data and privacy
What spamex stores for each submission, what it never stores, how retention is controlled, and how deletion requests work.
This page is written so that you can lift it into your own privacy documentation. The legal text is in the privacy policy.
What is stored by default
For every classification spamex keeps:
| stored | form |
|---|---|
| Verdict, score, stage, reason codes, timestamp | as returned to you |
| The message text | a SHA-256 hash and a similarity fingerprint (SimHash); the text itself is discarded once the verdict is returned |
| Sender identifiers: IP address, email address, email domain | SHA-256 hashes, used for reputation counters |
| Your key id and the month | for usage and quota |
A hash cannot be turned back into the message. A fingerprint allows “is this nearly the same text as one seen before” and nothing else.
What is never stored
- Raw message text, unless the key has opted in (below).
- Names, subjects, user agents or any field other than the message, in any form.
- Cookies, device fingerprints or anything collected from the visitor’s browser. spamex never talks to the browser at all.
Retaining raw text
A key can set retain_raw_text to true. From then on the full submission text is stored with the verdict so that verdicts can be reviewed in context and corrections can improve your site’s memory with the original wording. Retention is off by default, and platform keys set it per customer form. Retained text is deleted when the record is deleted.
Deletion requests
When a person asks for their data to be removed, call DELETE /v1/submissions/{id} with the verdict id you stored next to the message. It removes retained text, the sender identifiers and your site’s fingerprints for that record. A hashed audit row remains so that usage counts and the shared index stay consistent; it contains nothing that identifies the person.
Revoking a key does not delete its records. Ask us through the contact page for bulk deletion when a customer leaves.
Reputation and the shared index
Sender reputation and the near-duplicate index are shared across sites, which is what makes spamex better at catching campaigns than a filter that only sees one form. Two rules limit the blast radius.
- Reputation earned on one site affects only that site until at least two independent sites agree.
- Counters halve every 14 days, so a sender is not marked indefinitely.
Feedback from you marking a message legitimate removes it from the shared spam index immediately.