Privacy Policy

What We Collect

We collect your email address when you create an account. We collect the domain names you add to the service for monitoring. We collect and parse the DMARC aggregate reports that are delivered to your per-domain inbound address. This includes IP addresses, message counts, authentication results, and policy evaluations contained in those reports. We also collect standard server logs including IP addresses and request metadata.

How We Use It

Your email address is used to authenticate your account, deliver digest emails, and send alerts when monitoring conditions are met. Parsed report data is used to compute alignment metrics, detect policy drift, identify unknown senders, and populate your dashboard. We do not use your data to train machine learning models, sell it to third parties, or use it for any purpose other than operating the service you signed up for.

Data Retention

We store parsed authentication metadata from your DMARC reports: sender IPs, alignment results, and message counts. We do not store email content or subject lines. This data is kept for up to 365 days and then permanently deleted. Your plan tier controls your dashboard view window (how far back you can see), not how long we physically retain the data. Upgrading expands your view instantly; downgrading narrows it, but the data remains until the 365-day limit. If you delete your account, all your data is permanently deleted within 30 days.

Third-Party Services

We use the following third-party services to operate DMARCdrift:

• Supabase: database and authentication. Your account data and parsed report records are stored in a Supabase-hosted PostgreSQL database.
• Stripe: payment processing for paid plans. We do not store card numbers; Stripe handles all payment data under their own privacy policy.
• Resend: inbound email routing for DMARC reports and outbound delivery for digest and alert emails.
• PostHog: product analytics. We collect anonymized usage events (page views, feature interactions) to understand how the product is used. No DMARC report contents are included in analytics events.

Your Rights

You can delete your account and all associated data at any time from account settings.

Contact

For privacy-related questions or requests, contact privacy@dmarcdrift.com.