Privacy Policy
DRAFT: needs legal review. This text has not been approved yet and is not in force.
Last updated: [date of publication].
1. Who is responsible
[Company legal name pending], [registered address pending]. Contact: [contact e-mail pending]. We are the controller for the data about your account. For the content of DMARC reports about your domains, you are the controller and we are your processor (see the Data Processing Agreement).
2. What we collect and why
| Data | Why | Legal basis (UK/EU GDPR) |
|---|---|---|
| E-mail address | Sign-in, service e-mails, alerts and weekly summary | Contract |
| Consent records (terms version, date, age confirmation, optional marketing choice) | Proof of what you agreed to | Legal obligation, legitimate interest |
| Session cookie and sign-in links (stored only as hashes) | Keeping you signed in securely | Contract |
| Domains and DKIM selectors you add, DNS check results | Providing the monitoring | Contract |
| DMARC report content: IP addresses and host names of sending servers, message counts, authentication results | Showing who sends e-mail as your domain | Processed on your instructions |
| Subscription status and payment provider customer ID (no card data) | Granting access to paid features | Contract |
| Technical logs without personal data in their content (request id, timing, errors) | Security and reliability | Legitimate interest |
We do not use analytics, advertising or tracking tools, and we do not sell or share data for advertising.
3. Who processes data for us
- Hosting: Hostinger (servers in Germany, European Union).
- DNS, inbound e-mail and file storage: Cloudflare.
- Outgoing e-mail: Amazon Web Services (Amazon SES).
- Payments: Creem, as merchant of record (it is the controller for payment data).
[Legal review: confirm regions, transfer mechanisms (Standard Contractual Clauses / UK Addendum) and links to each provider's terms.]
4. How long we keep data
- Account data: while your account exists.
- Accounts that never confirmed their e-mail: 7 days.
- Raw report e-mails: 90 days [pending final decision]; processed report data: about 13 months.
- Records of e-mails we sent you: 30 days. Sign-in links: until expiry plus 1 day.
Deletion runs automatically every day.
5. Your rights
You can download all your data and delete your account at any time from your Account page. You can also ask us to access, correct, restrict or object to processing by writing to the contact above, and you can complain to your data protection authority (for example the ICO in the UK).
6. Security
Connections are encrypted (HTTPS), sign-in tokens and session ids are stored only as hashes, reports are processed as untrusted input, and access to production systems is limited.
7. Changes
We will tell you by e-mail before any material change to this policy.