2026-09-10

See what we parsed before you pay for it

A bulk upload is two steps now: parse, price and show the column mapping, then start it. Auto-recharge with a ceiling you set. A trust page with the questionnaire answers and no certification we have not had. A route for people who never signed up to be forgotten. And a page per country for the address formats we hold.

Choosing a file used to be starting a paid run. Upload, and the list was parsed, the columns guessed, the job created and the work queued in one request — the first time you saw what we made of your file was on the invoice. It is two steps now. The first parses the list and shows you the delimiter we read, which column filled which field and whether a heading named it or we guessed, the first rows as we parsed them, the repeats, your balance and the most the run can cost. The second starts it, and takes corrections.
That matters most for addresses. The column headings we recognise are English, so a German or French export fell through to a heuristic that picks "the column with the most address-shaped values" — and a wrong guess on forty thousand rows was a wrong guess you paid for. Every column now has a select beside it with its first value, and correcting one re-reads the file through the corrected mapping.
The cost is called an upper bound, not an estimate, everywhere it appears — rows come back free for reasons no preview can know in advance, so the real figure is always the one on the finished job. Two ways that promise was wrong when it landed, both caught in review: correcting a column changed which values repeat, and the ceiling was still quoting the guess; and a privacy IP run writes no repeat marker at all, so the repeats it was subtracting as free were going to be billed. A draft you never start is deleted after a day, and every read path enforces that whether or not the sweeper has reached it.
Automatic top-ups, with a ceiling you set. Running out of credits means your own signup form starts rejecting people, and until now the only warning was the balance email. You can now have a pack bought automatically when the balance falls below a line you choose — strictly opt-in, off by default, and hard-capped by a monthly ceiling we never exceed. Reach the ceiling and the answer is the ordinary out-of-credits refusal, not one more charge: "a hard stop, never a surprise bill" is a promise this site makes in four places and it still holds.
Every automatic charge is on the usage page as its own ledger entry and confirmed by email. It is charged straight to the card rather than invoiced, unlike a pack you buy yourself, and both the email and the page now say so — they had said the opposite.
A trust page. The data processing addendum was a bullet under an unrelated heading, subprocessor disclosure was one vague sentence, and there was no questionnaire answer set, no security.txt and no statement about encryption, backups, access or breach notification. /trust carries all of it: the subprocessors by role and region, a standing DPA, the answers a security review actually asks for, and an RFC 9116 security.txt with a response window. It holds no certifications and says so plainly rather than implying an audit that has not happened.
A way to be forgotten for people who never signed up. Abuse reports about a number or an address raise the risk other customers see, which means this service holds data about people who have no account here — and the only "forget" in the whole codebase was a cache invalidation. There is a form under /privacy now, verified by email so it cannot be used against somebody else's data, an admin action, and a command behind both that sweeps every table holding that identifier and leaves an audit row proving it happened.
One thing it deliberately does not delete: a suppression entry a customer imported themselves. That is their own do-not-mail list, and erasing it would do the opposite of what the person asking wants — it would un-suppress them and the next campaign would reach them again. The first version deleted those; the rule against it has been written down since the feedback system shipped.
The link the form emails is now one per mailbox rather than one per spelling. Keyed on what was typed, mia+1@, mia+2@ and m.i.a@ each opened their own window on the same inbox — so the only thing standing between a public form and a way to mail a stranger repeatedly was not standing anywhere.
A page per country for the address formats we hold. Two hundred and seven countries of write order, local terminology, required fields and postcode shape had been sitting in a data file, published nowhere. Each country that has enough to say now has its own page, gated by a catalog so the ones that do not are left out rather than filled with prose. Every page says what this service can actually check there, which for most of them is the format and the postcode and not a register lookup.

markdown version: /changelog/2026-09-10-see-what-you-bought-before-you-buy-it.md · atom feed: /changelog.atom

All releases