Privacy

Draft for owner and legal review. Not in effect.

SpamCatcher.dad is offered to customers in the United States. [Business name, address and governing law to be added.]

What we keep

• Account: username, password hash, email address and plan. Kept until you or we delete the account.
• Aliases (private pilot, not offered to new accounts): alias addresses, your verified destinations, observed senders, mail received through your aliases and the notices we send you. Alias addresses are never reissued to anyone else, so a record of each address stays.
• DMARC: domains you add and the aggregate reports mail providers send about them (sending IPs, counts and authentication results; no message content).
• Support requests: your email address, subject, messages and our replies. Requests sent while signed in are deleted with your account; requests sent by email or while signed out: [Planned: deleted 365 days after the request is closed. Not yet switched on; until then they are kept]. A request is closed when we have finished with it; replying to our email about it reopens it and restarts that period, and writing to us any other way opens a new request.
• [When paid plans launch] Billing: handled by Stripe; we keep your Stripe customer and subscription references, not card numbers.

How long we keep it

• Held or quarantined alias mail: content erased after [Planned: 30 days. Not yet switched on; until then it is kept until you or we delete it.].
• Mail forwarded to your inbox: content erased [Planned: 24 hours. Not yet switched on; until then it is kept until you or we delete it.] after our mail server accepts it for delivery. Mail still waiting to be delivered, or whose delivery failed or is unclear, is kept so it can be retried, within the other periods here. Our mail server keeps its own queue copy until your provider accepts or bounces it (up to 5 days).
• Account emails we send you (confirmations, password resets, alerts, trial notices, support replies): [Period to be set. Not yet switched on; until then our copies are kept until the account is deleted, and copies of replies to requests without an account are kept]. A record of the address, type and time is kept [period to be set; until then until the account is deleted, and records of emails not tied to an account are kept]. An email whose sending is still pending or unclear keeps its content and record until its outcome is settled. Support replies also stay in the support request itself (see above).
• Message details (subject, sender, scan, review and delivery history) and observed-sender history: deleted after [Planned: 90 days. Not yet switched on; until then they are kept until you or we delete them.]. Senders you marked or labelled are settings and stay until you change them.
• Original DMARC report emails: erased after [Planned: 30 days. Not yet switched on; until then they are kept until you or we delete them.]. A report still waiting to be processed is kept until it is processed; a report we could not read is kept until the dashboard history period ends, so it can be retried.
• DMARC dashboard history: deleted after [Planned: 400 days. Not yet switched on; until then it is kept until you remove the domain or we delete it.].
• Mail that is still being scanned or delivered is never deleted by these periods; it is handled first.
• Free trials that end without a plan: the account's DMARC domains and reports are deleted no sooner than 60 days after the trial ends and at least 7 days after a warning email to your confirmed address. The account itself stays.

When you delete your account it is locked right away: no sign-in, no mail in or out. After 30 days its data is erased from our live systems; until then you can ask us to restore it. Removing a domain deletes its dashboard data and its original report emails right away. Copies in backups are removed [within the backup retention period, to be set by the owner before launch]. Your own inbox and mail providers are outside our control.

What we don't do

We do not sell your data, show ads, or use your mail or reports to train AI models. The free domain checker keeps no record of what you check beyond short-lived caching.

Who processes it

Our own server (sc01) stores the data. Stripe processes payments. Outgoing notifications and support replies are sent through our mail relay, and email to our support address reaches us through our own mail server.

Your choices

You can change your email, remove domains, unsubscribe from DMARC alert and weekly summary emails, and ask us to delete your account.

Contact

Privacy questions and requests: support@spamcatcher.dad. We answer within two business days. [Legal and privacy contact and any required state notices to be added.]