Privacy Policy
Effective September 29, 2026 · Last updated October 1, 2026
dmarcful.com ("dmarcful", "we", "us") is operated by XT4 Enterprises LLC, a Wyoming company. This policy explains what personal data we collect when you use dmarcful's free tools and its paid DMARC Reports service, why we collect it, who we share it with, and how long we keep it.
1. Summary
- The free tools work without an account. We don't store your lookups on our servers.
- For the paid service we store your account details, your domains and the DMARC reports that mailbox providers send to your dmarcful address.
- Card payments are handled by Stripe. We never see or store your card number.
- We don't sell personal data, and we don't use advertising or analytics cookies.
- Report data is deleted 90 days after your subscription ends.
2. What we collect and why
Free tools (no account)
- What you look up (domain names, IP addresses, pasted email headers) is processed to produce the result you asked for and is not stored on our servers. Your recent lookups are saved only in your own browser's local storage, which you can clear at any time.
- Your IP address is held briefly in memory to apply rate limits that prevent abuse. It is not written to a database.
- Email deliverability test: when you send an email to a test address, we analyze its headers (for example the sender address, subject line, sending server, and SPF, DKIM and DMARC results). We never store the message body. The analysis is kept for 24 hours so you can view it, then deleted.
Accounts (paid service)
- Sign-in details: your email address and sign-in credentials are handled by our authentication provider, Clerk. We store your Clerk user ID and email address to run your account.
- Your domains and the unique report address we assign to your account.
- Optional SendGrid API key: if you connect one, it is stored encrypted (AES-256-GCM) and used only to read your sending IPs and authenticated domains.
Billing
- Payments are processed by Stripe. Your card details go directly to Stripe; we never receive or store your card number.
- We store the Stripe customer and subscription identifiers, your plan, and your subscription status and dates.
- Free-trial eligibility: to allow one free trial per customer, we store Stripe's card fingerprint, an identifier that tells whether the same card was used before but cannot be turned back into a card number. We keep it even after an account is deleted, for 3 years from the start of the trial, solely to prevent repeated free trials.
DMARC report data
When you publish your dmarcful address in your domain's DMARC record, mailbox providers (such as Google, Microsoft and Yahoo) send us daily aggregate reports about email sent using your domain. These reports contain the IP addresses of sending servers, message counts, domains used in the email, and authentication results. They generally do not identify individual people, but sending IP addresses may in some cases relate to an individual. We store the reports to provide your dashboard, and we look up public reverse-DNS names for sending IP addresses to identify email services.
3. Legal bases (EEA and UK visitors)
- Contract: to provide the service you signed up for, including billing.
- Legitimate interests: to secure the service, prevent abuse (rate limits, one free trial per card) and improve the tools.
- Legal obligation: to keep billing records as required by tax law.
4. Who we share data with
We share personal data only with service providers that help us run dmarcful, under contracts that limit their use of it:
| Provider | Purpose |
|---|---|
| Clerk | Account sign-up and sign-in |
| Stripe | Payments, subscriptions, invoices |
| Twilio SendGrid | Receiving DMARC reports, deliverability-test emails and messages to our contact address |
| Railway | Application hosting and database (United States) |
| Cloudflare | DNS for dmarcful.com |
Our tools send DNS queries about the domains and IP addresses you check to public DNS resolvers (Cloudflare and Google), and blocklist checks send IP addresses to blocklist operators (such as Spamhaus). These queries contain the name or address being checked, not your identity. On the What is my IP page, your browser contacts ipify (ipify.org), a free public service, directly to find your IPv6 (or IPv4) address; that request comes from your browser, so ipify sees your IP address. We don't store your IP address from that page.
We may disclose data if required by law or to protect our rights, and to a successor if dmarcful is sold or merged. We do not sell or rent personal data.
5. How long we keep data
| Data | Kept for |
|---|---|
| Deliverability test results | 24 hours |
| Report-processing activity log | 90 days |
| DMARC report data | While your subscription is active, then 90 days after it ends, after which it is deleted automatically |
| Account record (email, domains, report address) | Until you delete your account |
| Card fingerprint for trial eligibility | 3 years from the start of the trial, including after account deletion |
| Billing records held by Stripe | As required by tax and accounting law |
When you delete your account, we delete your account record and all associated report data. You can delete your account from the account menu after signing in, or by contacting us.
6. Cookies and local storage
We use only what the service needs to work: Clerk's session cookies keep you signed in, and your browser's local storage remembers your recent lookups and selected plan. We do not use analytics, advertising or tracking cookies.
7. Security
All traffic uses HTTPS. Stored API keys are encrypted, webhooks are verified with shared secrets or signatures, and access to production systems is restricted. No method of transmission or storage is completely secure, but we work to protect your data and will notify you of a breach as required by law.
8. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. California residents have the right to know what we collect and to request deletion; we do not sell or share personal information for cross-context behavioral advertising. To exercise a right, email inquiry@dmarcful.com. We respond within the time the law requires. You may also complain to your local data-protection authority.
9. International transfers
dmarcful is hosted in the United States. If you use it from elsewhere, your data is transferred to and processed in the United States, using safeguards such as the Standard Contractual Clauses where required.
10. Children
dmarcful is a business service and is not directed to children under 16. We do not knowingly collect their data.
11. Changes
We will post changes on this page and update the date above. For material changes we will notify account holders by email before they take effect.
12. Contact
XT4 Enterprises LLC
Wyoming, USA
inquiry@dmarcful.com