Privacy policy

Last updated: 28 June 2026

1. Who we are

DMARCER is operated by iVibe Media Limited ("DMARCER", "we", "us", "our"), a company registered in England & Wales (company number 17212558), registered office 2 Frederick Street, Kings Cross, London, United Kingdom, WC1X 0ND. We are registered with the UK Information Commissioner's Office (ICO) under reference ZC161456.

For privacy questions or to exercise your rights, contact privacy@dmarcer.net.

2. Controller and processor roles

For your own account, billing and marketing data, we act as a data controller. When we process data within our platform on behalf of a business or MSP customer (for example DMARC report data relating to their domains), we generally act as a data processor, and that customer is the controller. Where we act as a processor, our processing is governed by our Data Processing Agreement, and the relevant customer's own privacy notice also applies.

3. The data we collect

Account & identity data, name, work email, company/organisation, role, and (for MSP partners) the tenants you manage.

Billing data, your plan, billing contact and country. Card payments are processed by our payment provider (Stripe); we do not store full card numbers.

Domain & DNS data, the domains you add and their publicly published DNS records (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DNSSEC). This is public information.

DMARC and TLS report data: aggregate (RUA) reports summarise authentication results by sending source, and MTA-STS / TLS-RPT reports concern policy and transport security; these do not contain message content or personal data. Where you enable it, forensic/failure (RUF) reports may occasionally contain limited personal data, such as message headers, sender/recipient addresses or subject lines, which may relate to individuals in any jurisdiction. We minimise and restrict access to forensic data.

Free-tool data, when you use the public domain check we record the domain checked and, if you provide it, your email address (to send you the result and relevant follow-ups). When you contact us we collect the details you submit.

Usage & technical data, log data, IP address, browser/device information, and cookies (see section 7).

4. How and why we use data (lawful bases)

• To provide the service, scanning, scoring, monitoring, reporting and remediation (performance of a contract).
• To operate, secure and improve the platform, prevent abuse, and produce aggregated, non-identifying benchmark statistics (legitimate interests).
• To take payment and manage your account (contract / legal obligation).
• To respond to enquiries and provide support (legitimate interests / contract).
• To send service and, where permitted, marketing communications (legitimate interests or consent, you can opt out at any time).
• To meet legal and regulatory obligations (legal obligation).

5. Our benchmark

We maintain a benchmark of email-security posture across tens of millions of domains. It is built from public DNS data only and reported in aggregate (for example, average scores by industry or country). It does not identify individuals.

6. AI-assisted features

When you request it, we use third-party AI / large language model (LLM) providers (currently Anthropic and OpenAI) to analyse a forensic (RUF) report and generate an explanation. Forensic reports can contain personal data, such as message headers, sender/recipient addresses and subject lines, which is sent to the AI provider only for that user-requested analysis. We contract with providers on terms that prohibit using your data to train their models, and we do not send personal data to AI providers for any other purpose. We also use AI on anonymised, aggregated data for analytics, which contains no personal data. Our public AI-assistant (MCP) connector exposes public data only.

7. Cookies

We use cookies needed to run the site and keep it secure, for example a session cookie, an anti-forgery token, an audience-preference cookie on our support site, and a bot-protection check (Cloudflare Turnstile). To understand how visitors use our public website and support site so we can improve them, we also use Microsoft Clarity, a product-analytics and session-replay service that sets first-party cookies and records anonymised interaction data such as clicks, scrolls, mouse movement and page navigation. Clarity masks text you type and sensitive fields by default, and we do not use it for advertising or to build marketing profiles. It loads only after you accept analytics cookies in our cookie banner — if you decline, Clarity is not loaded and no analytics cookies are set. Microsoft processes this data as our processor; see Microsoft's privacy statement for details. We do not use third-party advertising cookies.

8. Where your data is stored (data residency)

DMARCER runs on cloud infrastructure from Microsoft Azure and on dedicated servers we lease from iomart, across multiple regions (currently the United Kingdom, Netherlands, United States, Canada, South Africa, Singapore, Australia and Chile). All data is encrypted at rest across every server and provider, with the encryption keys held by us. iomart supplies the leased hardware and data centre only — they have physical access to the hardware but no logins to our systems and no access to your data, which they hold only in encrypted form. Where you select a region for a domain, that domain's reporting data, including DMARC aggregate (RUA), forensic (RUF) and MTA-STS data, is processed and stored in that region, and the resulting analytical databases are kept in that region and are not copied or transferred to another region.

Our management systems, which hold account and login details, tenant information and billing data, are hosted in the United Kingdom and the EU. When you view your data in the management application, the management system retrieves it from the relevant regional database on request to present it to you; at that point the data is accessed through, and displayed via, our UK/EU management layer.

9. Sharing and sub-processors

We do not sell personal data. The limited third parties that may process personal data are: Microsoft (cloud server hosting via Microsoft Azure; our business email hosting via Microsoft 365; and website analytics and session replay via Microsoft Clarity, see section 7); Stripe (card payments, as an independent payment processor, we do not store full card details); Xero (invoicing and accounting); Cloudflare (bot-protection on certain forms, processing your IP address); and Anthropic and OpenAI, used only to analyse a forensic (RUF) report when you request it (see section 6). Our leased-hardware provider iomart supplies the data centre and physical servers only, with no access to your (encrypted) data, and so acts as a hosting provider rather than a processor (see section 8). We also use AI on anonymised data for analytics. We may also disclose personal data where required by law.

10. International transfers

Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement, or EU Standard Contractual Clauses.

11. Retention

We keep personal data only as long as needed for the purposes above, for the life of your account, and then for any period required to meet legal, accounting or dispute-resolution obligations. DMARC report data is retained according to your plan and configuration; forensic (RUF) data is retained for a shorter period by default. Aggregated, non-identifying data may be kept indefinitely.

12. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, regional isolation, multi-factor authentication for staff, and least-privilege access to sensitive data such as forensic reports. No system is perfectly secure, but we work to protect your data and to detect and respond to incidents.

13. Your rights

Subject to UK GDPR, you have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent. To exercise these rights contact privacy@dmarcer.net. If we process your data on behalf of a business/MSP customer, please direct your request to that customer and we will assist them. You also have the right to complain to the ICO (ico.org.uk).

14. Children

DMARCER is a business service and is not intended for, or directed to, children. We do not knowingly collect data from children.

15. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the "last updated" date; material changes will be notified to customers where appropriate.

16. Contact

iVibe Media Limited (trading as DMARCER), 2 Frederick Street, Kings Cross, London, United Kingdom, WC1X 0ND. Email: privacy@dmarcer.net or hello@dmarcer.net.