Privacy Policy

Mail Monitor (“we”, “us”) operates the email security monitoring service at mailmonitorhq.com. This policy explains what data the service collects, why we collect it, and who we share it with. Questions go to hello@mailmonitorhq.com.

• Account data. Your email address and name, provided when you sign in with Google or a magic link. We never receive or store your Google password.
• Domain data. The domain names you add or check, and the public DNS records we read for them (SPF, DKIM, DMARC, MX, MTA-STS), plus the scores and history we derive from those records.
• DMARC reports. Aggregate and forensic reports that receiving mail providers send to the reporting address you configure. These contain sending IP addresses, authentication results, and message metadata.
• Emails you forward to us. If you forward a message to your Mail Monitor inbound address for analysis, we store its headers and body for as long as the related threat record exists.
• Usage data. Page views, product events, IP address, browser and device type — used to understand how the product is used and to keep it available.
• Billing data. Subscription status and a customer identifier from our payment provider. Card numbers never reach our servers.

We use your data to run the service you asked for: check domains, detect changes, parse DMARC reports, send alerts and digests, provide support, bill Pro subscriptions, and keep the platform secure and reliable. We do not sell your data, and we do not use it to train third-party AI models.

We process account, domain, and report data to perform our contract with you; usage and security data on the basis of our legitimate interest in operating and improving a secure service; and marketing email only with your consent, which you can withdraw at any time.

We share data only with the processors needed to run the service, each bound to use it solely on our instructions:

• Google — sign-in via OAuth, if you choose it.
• Resend — sending transactional email and receiving inbound mail and reports.
• Polar — payment processing and subscription management (merchant of record).
• Analytics and error-monitoring providers — aggregate product usage and telemetry.
• Our hosting and database provider — storing and serving the application.

We also disclose data where required by law, or to protect the rights and safety of our users and the service.

Account, domain, and monitoring data live for as long as your account exists. When you delete a domain, its records and history are deleted with it. When you delete your account, we remove your personal data within 30 days, except where we must keep records for legal or accounting reasons. Aggregate, non-identifying statistics may be kept indefinitely.

You can access, correct, export, or delete your data, object to or restrict certain processing, and withdraw consent for marketing email. Write to hello@mailmonitorhq.com and we will respond within 30 days. If you are in the EEA or UK, you also have the right to complain to your local data protection authority.

We use cookies that are strictly necessary to keep you signed in, plus privacy-focused analytics to count page views and product events. We do not run advertising cookies or cross-site tracking.

Traffic is encrypted in transit with TLS, sessions are stored server-side, and sensitive integration credentials (such as notification channel configuration) are encrypted at rest. No service can promise perfect security, but we treat access to your domain data as the sensitive information it is.

Mail Monitor is a business tool and is not directed at children under 16. We do not knowingly collect their data.

If we change this policy in a way that materially affects you, we will update the date above and notify you by email or in the app before the change takes effect.