Legal
Privacy Policy
This policy explains which personal data DMARC AI processes when you use dmarc.ai, our free tools and our service, why we do that, how long we keep it and which rights you have. Last updated: 4 November 2026.
1. Who we are
The controller for the processing described here is Kevlarr, trading as DMARC AI.
- Address: Appelvink 1, 3435 RX Nieuwegein, the Netherlands
- Phone: +31 30 200 6416
- Email: [email protected]
- Data protection officer: Levente Bokor, [email protected]
This policy covers the website dmarc.ai, the free tools on it, our forms and newsletter, and your account with us. When we process DMARC report data on behalf of a customer or MSP partner, that customer decides why the data is processed and we act as its processor under our agreement with that customer (see section 3).
2. What we process, why, and for how long
We only process the data we need for each purpose below. The legal bases come from Article 6(1) of the General Data Protection Regulation (GDPR): (a) consent, (b) performance of a contract or steps at your request before entering into one, (c) a legal obligation, and (f) our legitimate interests.
| Purpose | Personal data | Legal basis | Retention |
|---|---|---|---|
| Answering your contact form message, email or call | Name, email address, subject, message, phone number if you give it | Legitimate interest in answering questions (f); steps before a contract (b) when you ask about our service | Up to 2 years after our last contact |
| Creating your account and trial, delivering the service, support and invoicing | Name, organisation, email address, phone number, address, the domains you add, account activity | Contract (b); invoicing records: legal obligation (c) | For the duration of the contract and up to 2 years after it ends; invoicing records 7 years (Dutch tax law) |
| Running a spoof test you request: we send an imitation email to show whether your domain can be spoofed | Email address, domain, test result | Your request (b) | 6 months |
| Free tools (DMARC, SPF, DKIM, BIMI, MTA-STS, DNS and record generator): improving the tools and identifying organisations whose domains could benefit from our service | The domain you check and the result of the check, a salted hash of your IP address (never the IP address itself), a shortened browser identifier, the referring page, time and number of checks. Content pasted into the email header analyzer is not stored. | Legitimate interest (f) in improving our tools and in business-to-business marketing. You can object at any time (section 7). | 730 days after the last check |
| Newsletter and product updates | Name, email address, what you open and click | Consent (a); for existing customers about similar services: legitimate interest (f) | Until you unsubscribe; every message has an unsubscribe link |
| Website statistics with Google Analytics | Pseudonymous identifier, pages visited, device and browser type, approximate location (country/region) | Consent (a), given in the cookie banner | Cookies up to 2 years; analytics data at most 14 months |
| Security and spam protection of the website and forms | IP address, browser information, request data | Legitimate interest (f) in a secure website | Only as long as needed to detect and investigate abuse |
We do not use your data for advertising networks, we do not build profiles across other websites and we never sell personal data.
3. DMARC monitoring data in our service
Our service receives DMARC aggregate reports for the domains our customers monitor. These reports describe mail servers and authentication results (sending IP addresses, domains, message counts, SPF, DKIM and DMARC outcomes). They rarely identify individuals, but some reports, such as DMARC failure reports, can contain email addresses or message details.
- For this report data the customer (or the MSP partner that manages the domain) is the controller and DMARC AI is the processor. We process it only to deliver the service and under the terms of our agreement with that customer.
- We use statistics derived from monitoring data to improve our analysis and AI models. Only data that contains no personal data is used for this; DMARC failure reports are never used. We may keep using such non-personal statistics after a customer ends the service.
- Questions about monitoring data: [email protected].
4. Who receives your data
We share personal data only when that is needed for the purposes above or when the law requires it. The parties below process data on our behalf (processors) under a data processing agreement:
- Hosting and backup providers that run and back up this website and our platform
- Cloudflare: content delivery, security and the Turnstile spam check on our forms
- Google: Google Analytics (only with your consent), reCAPTCHA spam protection, and Google Fonts
- Our email delivery provider, for messages sent from the website
We may also share data with authorities when we are legally obliged to, and with our professional advisers under a duty of confidentiality.
5. Transfers outside the European Economic Area
Some of these providers (Google and Cloudflare) can process data in the United States. We only allow this when the transfer is protected by the EU-US Data Privacy Framework or by the European Commission's Standard Contractual Clauses with additional safeguards where needed. You can ask us for a copy of the relevant safeguards at [email protected].
6. Cookies
Necessary cookies keep the site working and secure; we do not ask permission for those. Analytics cookies are only placed after you click Accept analytics in the cookie banner. You can change your choice at any time:
| Cookie | Set by | Purpose | Duration | Type |
|---|---|---|---|---|
| dmarcai_consent | dmarc.ai | Remembers your cookie choice | 12 months | Necessary |
| wp-wpml_current_language | dmarc.ai | Remembers the language version you use | 1 day | Necessary |
| PHPSESSID | dmarc.ai | Keeps a form or tool session together | Session | Necessary |
| __cf_bm, cf_clearance | Cloudflare | Distinguishes people from malicious bots | 30 minutes to 1 year | Necessary |
| _GRECAPTCHA | Google reCAPTCHA | Protects forms against spam and abuse | Up to 6 months | Necessary |
| _ga, _ga_WD5R4RLLN9 | Google Analytics | Distinguishes visitors for website statistics | 2 years | Analytics (only with consent) |
You can also delete or block cookies in your browser settings. Blocking necessary cookies can stop forms and tools from working.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have incorrect data corrected and incomplete data completed;
- have your data erased, unless we must keep it by law;
- restrict our processing while a question or objection is being handled;
- object to processing based on our legitimate interests, and object at any time, without giving a reason, to direct marketing;
- receive data you gave us in a structured, machine-readable format, or have it sent to another organisation (data portability);
- withdraw your consent at any time, without affecting processing that took place before you withdrew it.
Send your request to [email protected]. We answer within one month; for complex or numerous requests we may extend this by up to two further months, and we will tell you why. To protect your data we may ask you to confirm your identity. We only ask for a copy of an identity document when that is strictly necessary; in that case please mask your photo, the machine-readable zone, the document number and your citizen service number (BSN).
If you are not satisfied with how we handle your data, please contact us first. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in the EU country where you live or work.
8. Children, automated decisions, security and changes
Children. Our website and service are meant for businesses and are not aimed at people under 16. If you believe we have collected personal data from a child under 16 without parental consent, contact [email protected] and we will delete it.
Automated decisions. We do not take decisions based solely on automated processing, including profiling, that have legal or similarly significant effects for you.
Security. We take appropriate technical and organisational measures against misuse, loss, unauthorised access, unwanted disclosure and unauthorised modification, such as encrypted connections (HTTPS), access controls and regular backups. If you think your data is not properly secured or see signs of misuse, contact [email protected].
Changes. We update this policy when our processing changes. The date at the top shows the latest version. For significant changes that affect you as a customer, we will inform you by email.