Privacy Policy

Last updated: 5 September 2026

1. Introduction & Roles

DMARCify (“we”, “our”, or “us”) provides email authentication monitoring, automated DMARC report ingestion, and DNS diagnostic tools via our website (dmarcify.top) and application portal (/app).

We take a clear approach to data protection:

  • Data Controller: For registered account credentials, workspace profile details, subscription and invoicing records, direct support communications, and website visitor telemetry, DMARCify acts as the Data Controller under the UK Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR), and the EU GDPR. For payment card processing, identity verification, and statutory financial compliance, our payment gateway partner, Stripe Payments Europe, Ltd., acts as an independent Data Controller. DMARCify never collects, processes, or stores raw payment card numbers (PANs) or card verification values (CVVs).
  • Data Processor: When you configure your domain DNS records to point DMARC aggregate reports (RUA) or deliverability checks to our ingestion servers, you remain the Data Controller of that email authentication telemetry. We process that data solely as a Data Processor on your behalf to generate your deliverability reports and alerts.

2. Information We Collect & Process

We process distinct categories of information depending on how you interact with our platform:

A. Account, Organisation & Billing Data

  • Email Address: Used to identify your workspace account, deliver security notifications, and send single-use recovery codes.
  • Passkey Credentials (FIDO2 / WebAuthn): DMARCify operates on a modern passkey-first architecture. When you enrol a passkey (such as Touch ID, Face ID, Windows Hello, or a hardware security key), we store only your public key credential, credential ID, and counter. Your private keys never leave your secure authenticator hardware and are never transmitted to our servers.
  • Emergency Backup Recovery Keys: If you generate a 28-character emergency backup recovery key, we store only a secure cryptographic hash of the key (using industry-standard password hashing functions). We never store or log plaintext recovery keys. If you lose your recovery key, we cannot view or restore it for you.
  • Workspace & Organisation Data: Organisation names, invited member email addresses, and assigned role permissions (such as Super Admin, Domain Manager, Analyst, or Observer).
  • Billing & Subscription Records: When you subscribe to a paid tier, we store customer account details including your plan selection, billing contact email, postal address, tax identifiers, and Stripe customer tokens. Credit and debit card numbers are submitted directly to Stripe via secure, encrypted form elements and never touch our servers.

B. DMARC Aggregate Telemetry (RUA Reports)

When mailbox providers (such as Google, Microsoft, Yahoo, and Apple) deliver DMARC aggregate XML reports to your assigned ingestion address (ingest+token@dmarcify.top), our ingestion engine parses the technical metadata:

  • Sending mail server IP addresses and reverse DNS hostnames.
  • Message volume counts.
  • SPF authentication results and domain alignment.
  • DKIM selector names, authentication results, and signature alignment.
  • DMARC policy evaluation results and disposition actions (none, quarantine, or reject).

Important note regarding message content: Under RFC 7489, standard DMARC aggregate reports contain zero email body content, zero subject lines, and zero individual recipient addresses. They contain only aggregated technical delivery metadata.

C. Ephemeral Deliverability & Header Testing

When you use our Email Deliverability Tester by sending a test message to a generated session address (delivery+token@dmarcify.top) or pasting raw email headers:

  • We inspect technical headers to evaluate SPF, DKIM, DMARC, ARC alignment, and TLS cipher strength.
  • Test payloads and headers are processed in isolated, access-controlled temporary storage.
  • Automated Hard Purge: All temporary test emails and associated diagnostic files are automatically and permanently purged from our servers within 3 hours. We do not retain, index, or sell test email contents.

D. Public DNS Diagnostic Lookups & Domain Verification

When you register a domain in your workspace or use our public DNS diagnostic tools (such as our DMARC Checker, SPF Validator, DKIM Lookup, or BIMI Inspector), the submitted domain name is queried in real time against authoritative public nameservers. These queries inspect publicly published DNS resource records (such as TXT and CNAME) to confirm domain ownership and routing integrity. We do not attach public lookup queries to personal user profiles, and public DNS records contain zero personal data.

E. Technical Logs & Security Shield

To defend our infrastructure against automated attacks, denial of service, and brute-force abuse, our systems log standard request telemetry:

  • Client IP address, HTTP request method, request URI, and response status codes.
  • Cloudflare Turnstile challenge tokens and verification outcomes.
  • Outbound transactional email delivery attempts, transport drivers used, and provider response codes.

3. Lawful Bases for Processing

Under Article 6 of the UK GDPR and EU GDPR, we process your personal data under the following lawful bases:

  • Performance of a Contract (Article 6(1)(b)): Providing your workspace, authenticating your access, parsing your domain DMARC reports, and delivering account notifications.
  • Legitimate Interests (Article 6(1)(f)): Protecting our systems against abusive bots, enforcing rate limits, maintaining server stability, and investigating security incidents.
  • Consent (Article 6(1)(a)): Running optional analytics telemetry (Google Analytics 4, Microsoft Clarity) and optional marketing cookies. You can grant or revoke consent at any time via our Cookie Preferences Centre.
  • Legal Obligation (Article 6(1)(c)): Retaining transaction and billing records where required by applicable taxation and corporate accounting laws.

4. Infrastructure & Subprocessors

We work with trusted third-party technology providers to deliver our services. Each provider is bound by data processing agreements and strict confidentiality obligations:

  • Stripe Payments Europe, Ltd. (Ireland & Global): Provides payment processing, payment method tokenisation, subscription lifecycle management, and fraud mitigation (Stripe Radar). Stripe operates as an independent Data Controller for payment card handling, identity verification, and statutory financial compliance, and as a processor for subscription management. Review the Stripe Privacy Policy.
  • Cloudflare, Inc. (United States & Global Edge): Provides DNS management, DDoS mitigation, Edge CDN acceleration, and Turnstile bot protection. Cloudflare processes incoming web requests and evaluates security tokens. Review the Cloudflare Privacy Policy.
  • Resend, Inc. & Postmark (ActiveCampaign, LLC): Provide transactional email routing for account recovery codes, passkey alerts, and critical system notifications.
  • Google LLC (Google Analytics 4 & Google AdSense): Provides aggregated audience telemetry under Google Consent Mode v2. Optional advertising scripts are used on public pages only when marketing consent is granted. Accounts on active ad-free plans are completely exempt from advertising tags. Review the Google Privacy Policy.
  • Microsoft Corporation (Microsoft Clarity & Microsoft Advertising): Provides session heatmaps and usability telemetry to improve user experience. Review the Microsoft Privacy Statement.

5. Data Retention & Automated Deletion

We do not keep data longer than necessary for its intended purpose:

  • Account Data: Retained for the lifetime of your workspace. Upon verified account deletion, account records and enrolled passkey credentials are permanently removed within 30 days.
  • DMARC Aggregate Telemetry: Stored according to your active plan retention schedule (typically 30 to 365 days). Older records are automatically pruned by our database maintenance jobs.
  • Deliverability Test Inboxes: Test emails sent to ephemeral addresses are permanently wiped within 3 hours of receipt.
  • System Event Logs: Diagnostic delivery and security audit logs are retained on a rolling 90-day window to allow operational troubleshooting before automated purging.

6. Security Architecture

We implement high security standards to protect your workspace:

  • Transit Encryption: All platform communications require HTTPS with modern Transport Layer Security (TLS 1.3 and TLS 1.2).
  • Passkey-First Authentication: Eliminating shared passwords protects against credential stuffing, phishing, and password reuse vulnerabilities.
  • Cryptographic Salting: Emergency backup keys are hashed with slow, memory-hard cryptographic algorithms before storage.
  • Role-Based Access Control (RBAC): Multi-tenant isolation guarantees that domain metrics and reports are accessible only to authorised workspace members.

7. International Data Transfers

Where data is processed by subprocessors located outside the United Kingdom or the European Economic Area, transfers are governed by appropriate legal safeguards, including the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses (SCCs), and applicable adequacy regulations.

8. Your Rights Under UK GDPR

As a data subject, you have enforceable statutory rights under the UK Data Protection Act 2018 and UK GDPR:

  • Right of Access: Request a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate or incomplete information.
  • Right to Erasure (“Right to be Forgotten”): Request permanent deletion of your account and personal data.
  • Right to Restriction: Ask us to pause processing your personal data under certain conditions.
  • Right to Data Portability: Request your data in a structured, commonly used, and machine-readable format.
  • Right to Object: Object to processing based on legitimate interests.
  • Right to Withdraw Consent: Where processing relies on consent, you may withdraw it at any time without affecting previous processing.

To exercise any of these rights, email our team at support@dmarcify.top. We respond to all verified requests within one calendar month, free of charge.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk.

9. Managing Cookies & Tracking

For detailed information about individual cookies, lifespans, and categories, please read our dedicated Cookie Policy.

You can modify your cookie choices at any time using our preference centre:

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us:

Email: support@dmarcify.top
Website: https://dmarcify.top