Data we collect
We process the following categories of information:
- Account and workspace information. The name, email address, and password you provide when you create a workspace or are invited to one, plus the workspace name and your role within it.
- Monitored domain names. The domain names you add to a workspace so SenderProbe can run DNS, authentication, blacklist, and SMTP checks against them.
- Diagnostic results. The DNS records, email authentication findings (SPF, DKIM, DMARC), blacklist status, SMTP transcripts, certificate details, and deliverability scores that our checks produce for those domains.
- Inbound test messages. The content and headers of email messages sent to the sandbox mailboxes and test addresses SenderProbe provides, so we can analyse how receiving filters treat them.
- Usage and telemetry. Aggregate, pseudonymous information about how the Service is used — which checks run, how long they take, and errors encountered — used to keep the Service reliable.
- Cookies and local storage. A session token and your theme preference are stored in your browser. We do not use advertising or cross-site tracking cookies.
How we use it
We use the information above to:
- provide, operate, and improve the diagnostic checks and reports that make up the Service;
- authenticate you and keep your workspace and its data separate from other workspaces;
- send you alerts, reports, and account notifications you have asked for;
- detect, prevent, and respond to abuse, fraud, and security issues;
- comply with our legal and regulatory obligations.
Legal basis
For users in the European Economic Area, the United Kingdom, and Switzerland, we rely on the following bases under the GDPR: performance of the contract you form when you create a workspace (to run the checks you asked for); our legitimate interests in operating and securing the Service (for telemetry and abuse prevention); your consent (for optional communications); and compliance with legal obligations.
Sharing and subprocessors
We do not sell your personal information. We share it only as needed to run the Service, with:
- DNS resolvers and blacklist-zone operators, which are queried as part of the domain checks you request, and which may log the queries they receive.
- Cloud hosting providers that store workspace data and run the Service, under agreements that limit their use of the data to providing the service to us.
- Authorities or others where required by law, or to protect the rights, property, or safety of SenderProbe, our users, or others.
A current list of subprocessors is available on request.
Data retention
We keep your workspace data for as long as your workspace is active. When a workspace is deleted, we remove the associated domains, diagnostic results, inbound test messages, and reports within a short, defined window. Diagnostic logs and telemetry are retained in aggregate, pseudonymous form for longer so we can investigate incidents and improve the Service.
Security measures
Access tokens are kept in memory only; long-lived refresh tokens are stored in an HttpOnly cookie. Passwords are hashed with a modern, salted key-derivation function. We require strong passwords, offer two-factor authentication, and encrypt data in transit. No method of transmission or storage is completely secure, but we work to protect your information using measures appropriate to its sensitivity.
Your rights
Depending on where you live, you may have the right to access, correct, or delete the personal information we hold about you; to restrict or object to its processing; to receive a copy of it in a portable format; and to withdraw any consent you have given. To exercise any of these rights, contact us. We will respond within the time required by applicable law.
International transfers
Your information may be processed in countries other than your own, including by the cloud providers and DNS resolvers mentioned above. Where those transfers are subject to specific legal protection requirements, we put appropriate safeguards — such as standard contractual clauses — in place.
Children
The Service is not directed at children, and we do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, contact us and we will delete it.
Changes to this policy
We may update this Privacy Policy as the Service evolves. When we do, we will revise the “Last updated” date above and, for material changes, give you notice through the Service. Continued use after a change takes effect means you accept the updated policy.
Contact
Questions about this policy or your personal information? Send us a message and we will get back to you.