Legal — Privacy Policy
What we collect, why, and what we will never do with it.
Two lists, eleven sections and a retention table. Nothing here is written to be skipped — the parts that are still in audit say so.
Last updated October 5, 2026GDPR · CCPA
Who we are
DDMARC is a product of PlatOps Security, LLC, a Delaware limited liability company with its office at 18310 Montgomery Village Ave, Ste 300-1202, Gaithersburg, MD 20879, United States. PlatOps Security, LLC is the controller of the personal data described in this policy, except where we act as a processor for a customer under the data processing agreement. Our infrastructure runs to SOC 2 Type II and ISO 27001 — DDMARC's own audit is in progress.
01 — What we collect
What we collect
Two lists: what you hand us, and what arrives on its own.
Information you provide
Account informationName, email address and company name
Payment informationBilling address and payment details, processed by Stripe
Domain informationDomain names you register for monitoring
CommunicationsMessages when contacting support or providing feedback
Identity-provider sign-inIf you sign in with Google or a Microsoft work or school account, they send us your name, email address and profile picture. We do not receive your password.
Newsletter subscriptionEmail address, plus the time, IP address, page and consent wording when you subscribed and when you confirmed, kept as evidence of consent. You are subscribed only after you click the link in the confirmation email
Information collected automatically
DMARC reportsAggregate and forensic reports from email providers
Usage dataFeatures used, time spent, and interaction patterns
Device informationBrowser type, OS, IP address, and device identifiers
CookiesEssential cookies, a referral cookie when you open a friend’s invite link, and with your consent analytics and partner-referral cookies — the cookie policy lists each one by name
Partner referral codeIf you arrive through a partner’s ?ref= link and allow cookies, the partner’s code is kept in the ddmarc_ref cookie for 30 days. If you sign up, the code is saved with your account and subscription record so the partner can be paid commission on your payments. The code identifies the partner, not you.
Friend referralIf you open a friend’s invite link (app.ddmarc.com/register?friend=), app.ddmarc.com keeps your friend’s code in the same ddmarc_ref cookie for 30 days, so the referral is recorded when you sign up. If you sign up, we record which account referred yours, the dates, and the credit each of you receives. Your friend sees only the date you joined, the status of their credit and its amount — never your name, email address or organization.
Server logsIP address, user agent, URL and timestamp, kept 90 days
Error reportsSentry records browser errors — page URL, browser details and what led to the error — to keep the site working
02 — How we use it
How we use it
Nine purposes, and nothing beyond them.
- Provide email authentication monitoring services
- Process and analyze DMARC reports
- Send alerts, notifications and updates
- Process payments and prevent fraud
- Respond to enquiries and support requests
- Analyze usage to improve our platform
- Send marketing email and the newsletter, and follow up on a lead you asked us to capture
- Credit and pay the partner who referred you, if you arrived through a partner link
- Apply Refer a friend credit to you and to the friend who referred you, if you opened a friend’s invite link
Where the GDPR or UK GDPR applies, this is the legal basis for each purpose. Where we act for a customer as processor — the DMARC reports and forensic samples in your account — the customer decides the basis, not us.
Account, billing, team invitationsPerformance of a contract
DMARC, SPF, DKIM, MTA-STS, BIMI monitoringYour basis as processor — usually your legitimate interest in securing your email
Alerts, digests, login codes, service noticesPerformance of a contract
Support, sales and security enquiriesLegitimate interest in responding to you; steps before a contract
Emailed domain reportContract-like performance of what you asked for
Newsletter and other marketing emailConsent, which you can withdraw at any time
Free toolsLegitimate interest in providing a public service
Site security, error monitoring, server logsLegitimate interest in security and reliability
Analytics and session replayConsent
Partner referralConsent for the cookie; after you sign up, legitimate interest in paying the partner who referred you
Refer a friendPerformance of a contract — the offer you took up by opening your friend’s link, and the program terms with the friend who referred you
04 — Analytics and third-party services
Analytics and third-party services
We use Google Analytics 4 and Microsoft Clarity session replay to understand how visitors interact with our website. Neither tag loads until you allow analytics in the cookie banner, and turning it off stops both. Google’s privacy policy and Microsoft’s own privacy statement cover what they do with it. GA4 does not store IP addresses.
You can opt out using:
- The “Cookie Preferences” button in our footer, which stops collection immediately
- The Google Analytics opt-out browser add-on
Do Not Track and Global Privacy Control
This site does not respond to browser “Do Not Track” or Global Privacy Control signals today. Use the Cookie Preferences link in the footer instead — it takes effect immediately.
This is the current, dated subprocessor list. It is the same list, with regions, that appears on the security page and in the data processing agreement. PlatOps Security, LLC is not on it — it is the entity operating DDMARC, not a subprocessor of it.
Amazon Web ServicesHosting, storage, database and the CDN that serves this site — US and EU regions. Backups and support access are described in the data processing agreement
Amazon SESEmail delivery for alerts, digests and the newsletter
StripePayment processing. Card numbers never reach our systems
GoogleGoogle Analytics 4 (consent-gated) and Google Public DNS as a fallback resolver for the DMARC lookup and DKIM checker, which query DNS from your browser
MicrosoftClarity session replay (consent-gated)
SentryError and performance monitoring
CloudflareTurnstile bot challenge on our forms, and the DNS-over-HTTPS resolver for the DMARC lookup and DKIM checker
Google WorkspaceThe mailbox that receives contact, security-packet and support submissions
05 — Data sharing and disclosure
Data sharing and disclosure
The short version
We do not sell your personal information. There is no exception to that sentence and no definition of “sell” doing quiet work in it.
We may share data in four circumstances:
Service providersThird parties that help operate our platform — hosting, payments, analytics
Legal requirementsWhen required by law, court order, or government request
Business transfersIn connection with a merger, acquisition, or sale of assets
With your consentWhen you explicitly authorize us to share information
06 — Data security
Data security
EncryptionAES-256 at rest, TLS 1.3 in transit
Access controlRole-based permissions, no shared logins
Penetration testingContinuous automated scanning, periodic third-party penetration testing; the most recent summary is available under NDA
MonitoringContinuous infrastructure monitoring with a documented incident response plan
SOC 2 Type IIPlatOps Security infrastructure certified; DDMARC’s own audit in progress
ISO 27001PlatOps Security infrastructure certified; DDMARC’s own audit in progress
For the record
DDMARC does not hold its own SOC 2 Type II or ISO 27001 certification yet. The certified controls belong to the infrastructure we run on. If your review needs the product’s own certificate, record that as a gap — we would rather you logged it than discovered it.
07 — How long we keep it
How long we keep it
Account and team dataLife of the account, then 30 days for export, deleted from the live service within a further 30 days; encrypted backup copies age out within 12 months
DMARC aggregate reports30 days to 1 year, depending on plan
Forensic samples (RUF)90 days on every plan, then deleted from the live service; backup copies age out within 12 months
Activity (audit) logViewable for 90 days on every plan and exportable as CSV from Protect; older entries are retained until a one-year deletion schedule is in place
Billing records7 years, for legal compliance
Server logs90 days
Newsletter subscriptionUnconfirmed signups are deleted after 7 days. Confirmed: address and consent evidence kept while you are subscribed; after you unsubscribe, the address and the time you unsubscribed are kept so we do not email you again
Web analytics (GA4)14 months, only with your consent
Session replay (Microsoft Clarity)Set by Microsoft's retention defaults, only with your consent
Partner referral (ddmarc_ref)30 days in your browser, only with your consent; if you sign up, kept with your account while it exists and in commission and billing records for 7 years
Friend referral (ddmarc_ref and the referral record)30 days in your browser; if you sign up, the record of who referred you is kept with your account while it exists, and the credits in billing records for 7 years
Error monitoring (Sentry)Kept for a limited window to diagnose and fix issues, then deleted
08 — Your rights
Your rights
We give the rights below to everyone who asks, wherever local law grants them, not only where a law happens to name a region:
AccessRequest a copy of your personal data
RectificationCorrect inaccurate or incomplete data
ErasureRequest deletion of your personal data
PortabilityReceive data in a machine-readable format
RestrictionLimit how we process your data
ObjectObject to certain processing activities
To exercise these rights, email hello@ddmarc.com. If we cannot confirm the request came from you, we will ask for enough information to check, and no more. We respond within 30 days.
If you disagree with our answer
Reply and say you want it reviewed. A different person reviews it and tells you how to take it further, including how to complain to the data-protection authority where you live or work.
If your personal data reaches us inside a customer’s DMARC reports or forensic samples, that customer is the controller and we act on their instructions. Send your request to them; if you send it to us, we will pass it on and help them answer within the statutory time.
09 — International transfers
International transfers
Your data may be transferred to and processed in countries outside your own. We ensure adequate protection through:
- Standard Contractual Clauses for transfers of EU data
- Data Processing Agreements with every subprocessor
- Data residency options — US or EU, chosen when the tenant is created; Tokyo, HIPAA-eligible (US) and AWS GovCloud (US) on request with an Enterprise agreement
What residency covers, and what it does not
Choosing a region keeps report data, forensic samples and the audit log in that region. Account and billing data, support access, and the subprocessors listed in section 04 are not region-bound — several operate from the United States regardless of which region you choose.
10 — Children, automated decisions and identity providers
Children, automated decisions and identity providers
ChildrenDDMARC is a business service. You must be at least 18 to open an account, and we do not knowingly collect personal data from anyone under 18. If you think we have, email hello@ddmarc.com and we will delete it.
Automated decisionsWe do not make decisions about you by automated means that have legal or similarly significant effects. Alerts, scores and grades are about domains and mail flows, not about people.
Signing in with Google or Microsoft (work or school)If you choose that option, Google or Microsoft sends us your name, email address and profile picture. We do not receive your password and do not post to or read from your account.
11 — Contact and changes
Contact and changes
Privacy enquirieshello@ddmarc.com
Changes to this policy: we may update it periodically. We will notify you of material changes by email or through the platform, and continued use after a change constitutes acceptance.