Privacy Policy

This Privacy Policy describes how MonitorDMARC ("we," "us," or "our") collects, uses, stores, and shares information when you use our DMARC monitoring service available at monitordmarc.com and app.monitordmarc.com (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

MonitorDMARC is operated by Mike W Consulting LLC. ("we," "us," or "our"), based in the United States. MonitorDMARC is a Software-as-a-Service (SaaS) product that receives DMARC aggregate (RUA) and forensic (RUF) reports on behalf of our customers, parses and stores them, and presents the data through a web dashboard.

For purposes of applicable data protection laws, we are the data controller for account information and the data processor for DMARC report data you direct us to receive on your behalf.

Contact information:
Email: privacy@monitordmarc.com
Website: monitordmarc.com

We collect the following categories of information:

We use the information we collect for the following purposes:

• To provide the Service — processing and displaying your DMARC reports, monitoring DNS records for your domains, sending email alerts when changes or failures are detected
• To manage your account — authentication, plan management, billing, and subscription renewals via Stripe
• To send transactional emails — welcome emails, trial expiry reminders, alert notifications, and billing receipts (sent via ZeptoMail)
• To provide customer support — responding to questions, troubleshooting issues, and improving the Service based on your feedback
• To ensure security and integrity — detecting fraud, preventing abuse, and protecting the security of our systems and your data
• To improve the Service — analysing aggregate, anonymous usage patterns to understand how features are used and where improvements can be made
• To comply with legal obligations — responding to lawful requests from courts or regulatory authorities where required

DMARC report data is the core of what MonitorDMARC processes. Here is how we handle it specifically:

• Ownership — Your DMARC report data belongs to you. We process it as a service provider on your behalf, not for our own purposes.
• How it arrives — When you update your DMARC DNS record to include our receiving addresses (rua@app.monitordmarc.com and ruf@app.monitordmarc.com), mail providers send reports to those addresses. We receive these via Microsoft 365 shared mailboxes and retrieve them using the Microsoft Graph API.
• Parsing and storage — Reports are parsed from XML format and stored in our database, associated with your account and your domain. We store them for the retention period of your plan (1, 2, or 3 years depending on plan, or custom for Enterprise).
• Isolation — Your data is logically isolated from other customers' data in our database. Enterprise Dedicated customers receive a physically separate database instance.
• No cross-customer analysis — We do not analyse or compare your DMARC data with other customers' data. Reports are displayed only to the account that owns the domain.
• Deletion — When your account is cancelled, your DMARC report data is retained for 30 days (to allow reactivation), then permanently deleted.

We use a small number of carefully selected third-party services to operate MonitorDMARC. Each receives only the data necessary to perform their specific function:

We do not use any advertising networks, social media trackers, or analytics services that share your data with third parties for advertising purposes.

The MonitorDMARC dashboard (app.monitordmarc.com) uses a minimal number of cookies, all of which are necessary to operate the Service:

Our website

Our marketing website (monitordmarc.com) uses Google Analytics to understand how visitors use the site, such as which pages are viewed and how visitors found us. Google Analytics sets cookies and collects information such as your IP address, browser type, and the pages you visit, which is processed by Google on our behalf. We use this information only in aggregate to improve our website.

Google Analytics cookies are only set if you accept them in the cookie banner shown on your first visit. You can change your choice at any time using the "Cookie Settings" link at the bottom of every page. You can also opt out by installing the Google Analytics opt-out browser add-on or by blocking cookies in your browser settings.

We retain your data for as long as your account is active and for a limited period after cancellation as follows:

After account cancellation, all DMARC report data and account information is permanently and irreversibly deleted within 30 days. Billing records are retained for 7 years as required by law.

We take reasonable and appropriate measures to protect your information from unauthorised access, disclosure, alteration, or destruction:

• Encryption in transit — All data is transmitted over HTTPS/TLS. Our SSL certificates are managed via Let's Encrypt.
• Encryption at rest — Database backups stored in AWS S3 are encrypted.
• Authentication — Passwords are stored as salted hashes (never in plain text). Microsoft Graph API access uses OAuth 2.0 — no passwords are stored for email retrieval.
• Access control — SSH key-only access to our servers; password authentication is disabled. Firewall rules restrict access to necessary ports only.
• Automated security updates — Our server is configured to automatically apply security patches.
• Intrusion prevention — fail2ban is deployed to block repeated failed login attempts.
• Minimal data collection — We collect only what is necessary to provide the Service.

Depending on your location, you may have certain rights regarding your personal data. We honour these requests regardless of where you are located:

To exercise any of these rights, email us at privacy@monitordmarc.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

California residents (CCPA): We do not sell personal information. You have the right to know what data we collect and request deletion. Contact us at the email above.

EEA/UK residents (GDPR/UK GDPR): You have the right to lodge a complaint with your local supervisory authority if you believe we have not handled your data lawfully.

MonitorDMARC is a business-to-business service designed for use by adults operating businesses and organisations. We do not knowingly collect personal information from anyone under the age of 18.

If we become aware that we have inadvertently collected data from a child under 18, we will delete it promptly. If you believe we may have such data, please contact us at privacy@monitordmarc.com.

MonitorDMARC is operated from the United States. Our servers are hosted on AWS in the US region. If you are accessing the Service from outside the United States — including from the European Economic Area (EEA), United Kingdom, or other countries — please be aware that your information will be transferred to and processed in the United States.

The United States may not have the same data protection laws as your country. By using the Service, you consent to the transfer of your information to the United States as described in this policy.

For customers in the EEA or UK, we rely on your consent (provided when you sign up) and legitimate interests as the lawful bases for processing your personal data. Where required, we will enter into Standard Contractual Clauses (SCCs) with customers who require them for GDPR compliance — please contact us to discuss.

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal, operational, or regulatory reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send a notification email to all active account holders at least 14 days before the changes take effect
• Require renewed consent where changes materially affect how we use your data

Your continued use of the Service after the effective date of a revised policy constitutes your acceptance of the updated terms. We encourage you to review this policy periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: