Skip to main content
ShieldMarc

Privacy Policy

Last updated: 1 May 2026

1. Who We Are

ShieldMarc ("we", "us", or "our") is a UK-based business operating shieldmarc.com and is the data controller for personal data collected through the ShieldMarc platform.

For data protection enquiries, contact us at open a privacy ticket or email privacy@shieldmarc.com.

2. What Data We Collect

We collect the following categories of personal data:

  • Account information: email address and hashed password when you create an account.
  • Organisation data: organisation name, domain names you add for monitoring, and team member email addresses you invite.
  • DMARC report data: aggregate DMARC reports (RUA) and forensic reports (RUF) sent to your ShieldMarc reporting address. Aggregate reports contain sender IP addresses, domain names, and authentication results. Forensic reports may additionally contain sender and recipient email addresses and message headers - but never email body content.
  • Monitoring data: SSL certificate details (issuer, expiry, SANs), DNS record snapshots, SPF/DKIM verification results, and uptime check results for domains you register with the Service.
  • Payment information: billing details are collected and processed by Stripe. We store only your Stripe customer ID and subscription ID - never your card number.
  • Audit logs: records of significant account actions (logins, configuration changes, member invites) including timestamps and IP addresses, for security and accountability purposes.

3. How We Use Your Data

We use your personal data to:

  • Provide, maintain and improve the Service.
  • Process payments and manage subscriptions.
  • Send transactional emails (account confirmation, password resets, billing receipts).
  • Send alert and notification emails (SSL expiry warnings, DNS changes, uptime incidents, DMARC policy issues).
  • Monitor domain security on your behalf (SSL, DNS, DMARC, uptime).
  • Respond to support requests.
  • Comply with legal obligations.

4. Legal Basis for Processing

Under the UK GDPR, we process your data on the following lawful bases:

  • Contract: processing necessary to perform our contract with you (providing the Service).
  • Legitimate interest: improving the Service, preventing fraud, and ensuring security.
  • Legal obligation: complying with applicable laws and regulations.

5. Data Sharing

We share personal data only with the following sub-processors:

  • Supabase (EU, database and authentication): the managed PostgreSQL platform that hosts our primary application database, account records, organisation data and authentication tokens. Processing occurs in the European Union under our instructions.
  • Cloud infrastructure (EU, primarily Frankfurt): the application servers, monitoring pipelines, search / analytics data stores and Redis-backed queues that power the Service run on EU-hosted virtual private servers, principally in Frankfurt (Germany), with redundant capacity in supporting EU regions. Specific provider, region and instance details are documented to procurement teams under NDA on request.
  • Hetzner (EU, offsite backups): encrypted offsite backups of the Supabase database, Elasticsearch indices and configuration are stored on Hetzner Storage Box within the European Union. Backups are encrypted with keys held by ShieldMarc; Hetzner has no access to plaintext contents.
  • Stripe (US, payments): processes payment data under their own privacy policy. PCI-DSS Level 1 certified.
  • Microsoft (EU, email delivery): processes recipient email addresses and message content to deliver transactional and alert emails on our behalf via Microsoft Graph API.
  • Zammad (EU, support helpdesk): processes support-ticket content (subject, body, and any attachments you submit) when you contact us through the support form or email. Zammad is a self-hosted instance running on the same EU infrastructure as the rest of the platform.
  • Cloudflare (global, edge network): routes all public traffic to the Service, providing DDoS mitigation, web application firewall, bot scoring, the authenticated edge tunnel to our origin, and Turnstile CAPTCHA during login and sign-up. Also operates the AI Gateway that proxies requests to large-language-model providers when you invoke AI-assisted features.
  • Anthropic (US, optional AI features): when you invoke an AI-assisted feature such as AI review, the relevant domain context is sent to Anthropic to generate the analysis. Anthropic does not train on API inputs or outputs and retains data only for short-term abuse monitoring.
  • OpenAI (US, optional AI features):when you invoke the Explain with AI feature on certain tools, or the onboarding wizard's AI analysis, the relevant record is routed to OpenAI via the Cloudflare AI Gateway. OpenAI does not train on API data by default and retains data only for short-term abuse monitoring.
  • Google (US, optional AI features):when you invoke the Explain with AI feature on the DMARC checker, the record is routed to Google's Gemini API via the Cloudflare AI Gateway. Google does not use paid API prompts or responses to train its models.

AI-assisted features are always triggered explicitly by a user action. No personal or monitoring data is sent to any LLM provider unless you invoke one of these features. Enterprise customers with strict EU data residency requirements can request EU AI routing as part of a custom plan; see our Trust page for details.

We do not sell your personal data. We do not share data with advertisers or data brokers.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your individual account, your personal data and organisation membership are removed immediately. If an organisation subscription is cancelled or an organisation is deleted, the organisation's data is retained for a 30-day grace period to allow export and recovery, then permanently deleted. DMARC report data is retained for 365 days, then automatically purged; Enterprise customers may negotiate extended retention as part of a custom plan. Audit logs are retained for 12 months. Residual data in backups is overwritten within the normal backup rotation cycle (up to 30 days). LLM provider logs held by Anthropic, OpenAI and Google for abuse monitoring are governed by those providers' own retention policies (typically 30 days) and are not accessible to us.

7. Your Rights

Under the UK GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or incomplete data.
  • Erase your data ("right to be forgotten").
  • Restrict processing of your data.
  • Port your data to another service. Open a privacy ticket to request a machine-readable export of your data.
  • Object to processing based on legitimate interest.

To exercise any of these rights, contact us at open a privacy ticket. We will respond within 30 days.

8. Cookies

We use only essential cookies required for the Service to function (authentication session, active organisation). Cloudflare Turnstile may set a short-lived cookie during login and sign-up to verify you are a real user. We do not use tracking cookies, analytics cookies, or advertising cookies.

9. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), encrypted storage, access controls, audit logging, and regular security reviews.

10. International Transfers

Your core monitoring and account data is stored and processed in the EU. The following sub-processors may process data in the United States or other jurisdictions: Stripe (payments), Cloudflare (edge network, globally distributed with EU default routing), Anthropic (optional AI features), OpenAI (optional AI features) and Google (optional AI features). Where data is transferred outside of the UK and EU, we rely on appropriate safeguards including Standard Contractual Clauses, UK International Data Transfer Agreements and the EU-US Data Privacy Framework. Enterprise customers with strict EU data residency requirements can request UK hosted environments and EU AI routing as part of a custom plan.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.