Privacy Policy

1. Who We Are

ShieldMarc Ltd ("we", "us", or "our") is a company registered in England and Wales under company number 17352242, operating shieldmarc.com, and is the data controller for the personal data this policy describes; where we process personal data for a business customer, we are its processor under our Data Processing Agreement. Our registered office is 66 Paul Street, London, EC2A 4NA, United Kingdom.

For data protection enquiries, contact us at open a privacy ticket or email privacy@shieldmarc.com.

2. What Data We Collect

We collect the following categories of personal data:

• Account information: email address and hashed password when you create an account.
• Organisation data: organisation name, domain names you add for monitoring, and team member email addresses you invite.
• DMARC report data: aggregate DMARC reports (RUA) and forensic reports (RUF) sent to your ShieldMarc reporting address. Aggregate reports contain sender IP addresses, domain names, and authentication results. Forensic reports may additionally contain sender and recipient email addresses and message headers, and some receivers attach the whole failing message. We keep each report email as it arrived.
• Monitoring data: SSL certificate details (issuer, expiry, SANs), DNS record snapshots, SPF/DKIM verification results, and uptime check results for domains you register with the Service.
• Payment information: billing details are collected and processed by Stripe. We store only your Stripe customer ID and subscription ID - never your card number.
• Audit logs: records of significant account actions (logins, configuration changes, member invites) including timestamps and IP addresses, for security and accountability purposes.
• Free tool lookups: when you run one of the public tools at shieldmarc.com/tools, we record the domain or hostname you submitted, your IP address, your browser user agent, which tool you used and the result category (for example, whether a DMARC record was found). No account is needed to use these tools and we do not link these records to an account. We use them to rate-limit abuse, investigate failures and decide which tools to keep. The tools that run entirely in your browser - the SPF, DMARC, DKIM and CAA record generators, the email header analyser and the DMARC report viewer - never send what you paste or generate to our servers.
• Usage analytics: page views and a small set of interactions on our public pages (which tool was submitted and, for the tools that run on our servers, the domain you submitted; clicks on sign-up and pricing links; and that a sign-up finished and whether by email or Microsoft), together with the referring URL, an approximate viewport size and a random session identifier stored in your browser's local storage. These events are first-party, carry no cookie and no IP address, and are not shared with anyone.

3. How We Use Your Data

We use your personal data to:

• Provide, maintain and improve the Service.
• Process payments and manage subscriptions.
• Send transactional emails (account confirmation, password resets, billing receipts).
• Send alert and notification emails (SSL expiry warnings, DNS changes, uptime incidents, DMARC policy issues).
• Monitor domain security on your behalf (SSL, DNS, DMARC, uptime).
• Respond to support requests.
• Comply with legal obligations.

4. Legal Basis for Processing

Under the UK GDPR, we process your data on the following lawful bases:

• Contract: processing necessary to perform our contract with you (providing the Service).
• Legitimate interest: improving the Service, preventing fraud, and ensuring security.
• Legal obligation: complying with applicable laws and regulations.

5. Data Sharing

Where we process personal data on behalf of a business customer, our Data Processing Agreement applies and forms part of our Terms of Service.

We share personal data only with the following sub-processors:

• Our hosting provider (Germany, EU: hosting and offsite backups): the application servers, our self-hosted PostgreSQL database and authentication store (holding the primary application database, account records, organisation data and authentication tokens), the monitoring pipelines, search / analytics data stores and Redis-backed queues that power the Service run on dedicated servers in Germany. Encrypted offsite backups of the application database, Elasticsearch indices and configuration are stored with the same provider within the European Union, encrypted with keys held by ShieldMarc; the provider has no access to their plaintext contents. The provider's name is given to any customer or data subject on request; datacentre region and instance details are given to procurement teams under NDA on request.
• Stripe (US, payments): processes payment data under their own privacy policy. PCI-DSS Level 1 certified.
• Microsoft (EU, email): processes recipient email addresses and message content to deliver transactional and alert emails on our behalf via Microsoft Graph API, and hosts the mailbox that receives the DMARC reports sent to us.
• Cloudflare (global, edge network): routes all public traffic to the Service, providing DDoS mitigation, web application firewall, bot scoring, the authenticated edge tunnel to our origin, and Turnstile CAPTCHA during login and sign-up. Cloudflare R2 object storage keeps a copy of each DMARC report email we receive and the report files it carries. Cloudflare also operates the AI Gateway that passes requests to OpenAI and Google when you invoke AI-assisted features that use them. Requests to Anthropic go to Anthropic directly.
• Anthropic (US, optional AI features): runs Ask AI (the AI chat on the Email page) and Scan for threats (the AI review of one of your domains). The relevant domain context is sent to it, and for a scan so are the results of the checks it runs, to write the answer. Anthropic does not train on API inputs or outputs and retains data only for short-term abuse monitoring.
• OpenAI (US, optional AI features): when you invoke the Explain with AI feature on certain tools, or the onboarding wizard's AI analysis, the relevant record is routed to OpenAI via the Cloudflare AI Gateway. OpenAI does not train on API data by default and retains data only for short-term abuse monitoring.
• Google (US, optional AI features and website analytics): when you invoke the Explain with AI feature on the DMARC checker, the record is routed to Google's Gemini API via the Cloudflare AI Gateway. Google does not use paid API prompts or responses to train its models. If you choose “Accept analytics” in the cookie banner, Google Analytics also receives pseudonymous usage data from our public website (pages visited, approximate location at city level, device and browser type); it is switched off in the dashboard.

We also send the IP addresses of servers that send email as our customers' domains to AbuseIPDB (US), an independent IP reputation service, to check their reputation. Only when a user chooses to report an address does AbuseIPDB publish a report, under our name, naming that IP address and the domain it sent email as.

Support tickets (subject, body and any attachments) are stored in a helpdesk we host ourselves on the same servers, so no helpdesk company receives them. Tickets you email to us arrive through our Microsoft 365 mailbox, and our replies are sent through Microsoft.

AI-assisted features are always triggered explicitly by a user action. No personal or monitoring data is sent to any LLM provider unless you invoke one of these features. EU-only AI routing is available on request on an enterprise plan; see our Trust page for details.

We do not sell your personal data. We do not share data with advertisers or data brokers.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your individual account, your personal data and organisation membership are removed immediately. If an organisation's subscription is cancelled, it moves to the free Starter plan and its data is kept. If an organisation is deleted, its data is retained for a 30-day grace period to allow export and recovery, then permanently deleted. DMARC report data is retained for 365 days, then automatically purged, and so are threat scans (Scan for threats); Ask AI conversations are kept for 24 hours. Enterprise customers may negotiate extended retention as part of a custom plan. Audit logs are retained for 12 months. Residual data in backups is overwritten within the normal backup rotation cycle (up to 30 days). Free tool lookup logs are retained for 90 days, usage analytics events for 400 days, and internal API request logs for 14 days. LLM provider logs held by Anthropic, OpenAI and Google for abuse monitoring are governed by those providers' own retention policies (typically 30 days) and are not accessible to us.

7. Your Rights

Under the UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict processing of your data.
• Port your data to another service. Open a privacy ticket to request a machine-readable export of your data.
• Object to processing based on legitimate interest.

To exercise any of these rights, contact us at open a privacy ticket. We will respond within 30 days.

8. Cookies

We use essential cookies required for the Service to function (authentication session, active organisation). Cloudflare Turnstile may set a short-lived cookie during login and sign-up to verify you are a real user. These are always on.

With your consent, we also use Google Analytics to understand how visitors use the public website (pages visited, approximate location at city level, device and browser type). Analytics cookies are set only if you choose “Accept analytics” in the cookie banner; if you choose “Essential only”, no analytics cookies are set. We do not track authenticated application pages, beyond recording that a sign-up finished, and we do not use advertising cookies. To change a previous choice, clear this site’s cookies and site data in your browser and the banner will be shown again on your next visit.

9. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), encrypted offsite backups, access controls, audit logging, and regular security reviews.

10. International Transfers

Your core monitoring and account data is stored and processed in the EU. The following sub-processors may process data in the United States or other jurisdictions: Stripe (payments), Cloudflare (edge network, globally distributed with EU default routing), Anthropic (optional AI features), OpenAI (optional AI features) and Google (optional AI features and, where you have consented, Google Analytics). AbuseIPDB (IP reputation), an independent controller, receives sending-server IP addresses in the United States. Where data is transferred to our sub-processors outside of the UK and EU, we rely on appropriate safeguards including Standard Contractual Clauses, UK International Data Transfer Agreements and the EU-US Data Privacy Framework. Core data is hosted in Germany by default. Enterprise customers who need UK data residency can request a dedicated UK-hosted environment, and EU-only AI routing, as part of a custom plan.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.