Privacy Policy

01Who we are

DMARCmetric ("we", "us") operates the DMARC monitoring service at dmarcmetric.com. We are the data controller for the personal data described in this policy.

The data controller is Digiport OÜ, registered at Viru väljak 2, Tallinn 10111, Estonia. Estonia is a member state of the European Union, so the GDPR applies directly. The accountable contact for any privacy question is [email protected].

02What data we process

Account data

When you create an account we process the information you give us:

• your name and email address;
• your workspace / organisation details and the domains you add to it;
• a hashed password (we never store or log your password in plain text — it is hashed by our authentication library).

Billing data. Payments for paid plans are processed by Stripe; card details are entered on Stripe's hosted checkout and billing pages and never touch our servers — we never see, transmit or store a card number. We hold only billing metadata: your workspace's plan, its Stripe customer and subscription identifiers, and subscription status.

DMARC aggregate-report data

The core of the service is parsing the aggregate (RUA) DMARC reports that mail providers send about messages claiming to be from your domains. These reports are third-party-generated telemetry — we do not create them; receiving mail operators (Google, Microsoft, Yahoo and so on) generate and send them. For each sending source in a report we store the structured rows:

• the sender IP address and the message count it sent;
• the authentication results — SPF and DKIM outcomes and the DMARC disposition applied;
• the domains involved — the header-from and envelope-from;
• the reporter and reporting period — which operator sent the report and the date range it covers;
• derived fields we compute ourselves: the sending country resolved from the IP inside our own database, and the provider grouping shown under sending sources.

Aggregate reports carry no message content — no bodies, no subject lines, no recipient addresses. This is a property of the RUA format itself: reporters never send that data, so it never reaches us. See also Security and privacy at DMARCmetric and How long is my data kept?

03Why we process it & legal basis

We process the data above only to provide the service you signed up for:

• Account data — to create and secure your account, authenticate you, and send you essential transactional email (email verification, password reset, and any digests you opt into).
• Aggregate-report data — to parse, store and visualise your DMARC reports so you can monitor authentication and improve your email security posture.

We frame this policy around the GDPR and rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR) — for your account data and for providing the DMARC monitoring service you signed up for, including authenticating you and delivering essential transactional email.
• Legitimate interests (Art. 6(1)(f) GDPR) — for processing the aggregate-report telemetry to detect spoofing and abuse and to secure the service. This telemetry is third-party-generated and carries no message content, so this processing does not override your interests or fundamental rights.

04Sub-processors

We use a small set of infrastructure providers to run the service. We do not sell your data or share it with advertisers.

Cloudflare Turnstile (a bot-challenge widget) is integrated in our codebase but currently dormant, so no data flows to it today. If we re-enable it, it operates under the Cloudflare entry above and we will update this note accordingly.

05Data retention

Report data is retained according to your workspace's plan. Since the launch of paid plans (reflected in the "last updated" date above), dashboards and exports read at most your plan's retention window — currently 30 days of history on the Free plan and one year on Starter — and a scheduled job physically deletes stored report data only once it is older than your plan's window plus a 60-day grace period (roughly 90 days of storage on Free, about 14 months on Starter). The grace period means upgrading immediately reveals still-stored history. The purge covers report rows, the plain-English summaries derived from them, and alerts; forensic failure samples have their own fixed 30-day window.

Existing workspaces are notified before the first scheduled deletion runs — nothing quietly vanishes from accounts that predate these windows.

Deletion on request is always available:

• Removing a domain removes its data. Deleting a domain from your workspace hard-deletes its stored reports and rows from the application database immediately.
• Everything else: just ask. Self-service account deletion is not in the product yet, so it is handled by hand — email [email protected] from your account's address and we will delete your account and its data.

For the full detail, see How long is my data kept?

06International transfers

Your account and report data are hosted in Germany (EU) on Hetzner infrastructure. Web requests are served through Cloudflare's global edge network, which may route or terminate TLS at edge locations outside your country; report processing and storage remain on our EU hosting.

Our primary hosting is in the EU (Hetzner, Germany). Where a sub-processor (for example Cloudflare or Postmark) may process personal data outside the EEA, such transfers are governed by the European Commission's Standard Contractual Clauses (SCCs) and equivalent safeguards. As noted under Sub-processors, sender IP addresses are never sent to MaxMind — IP-to-country resolution is a local lookup inside our own database, so no IP data is transferred to a geolocation service.

07Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectification — correct inaccurate data;
• erasure — have your data deleted (see Data retention above);
• portability — receive your data in a portable form (you can also export report data yourself via CSV export);
• objection — object to certain processing.

To exercise any of these, email [email protected] from your account's address and a human will handle it.

08Cookies

We use one first-party cookie: an essential session cookie set when you sign in. It is flagged Secure (only ever sent over HTTPS) and is backed by a server-side session record, so signing out revokes it immediately. There is no token stored in your browser for a rogue script to steal.

We use no analytics, advertising or tracking cookies. Because the only cookie we set is strictly necessary to run the service, no cookie-consent banner is required — there is nothing non-essential to consent to.

09Security

• Server-side, revocable sessions. Sessions live in a server-side record referenced by a Secure cookie, not as a token in your browser; signing out invalidates the session immediately.
• Email verification is required before you can sign in, and authentication endpoints (sign-in, sign-up, password reset) are rate-limited.
• Passwords are hashed and never stored or logged in plain text.
• Encrypted transport. Web traffic is TLS-encrypted between your browser and the service via Cloudflare.
• EU hosting in Germany, with tenant-scoped data access — every query that reads report data is scoped to your workspace using your server-side session, never anything the browser merely claims.

We describe only what is true today. DMARCmetric does not currently hold SOC 2 or ISO 27001 certification, and we make no such certification claims. See Security and privacy at DMARCmetric for the fuller picture.

10Changes & contact

We may update this policy as the product evolves; the "last updated" date at the top reflects the current version. For any privacy question, to exercise your rights, or to request deletion, contact [email protected].