Privacy Policy

Last updated September 2026. TransactionX.

Draft — have a lawyer review before launch.

What we collect

Account Your email address, organization name, and a password hash. Billing details are held by Stripe, not by us.
Public DNS records SPF, DKIM, DMARC, MX and related records for the domains you monitor. All of it is already world-readable.
DMARC aggregate reports Sent to us by receiving mail servers because your DNS record asks them to. These contain sending IP addresses, message counts, and whether authentication passed.

What DMARC reports do not contain

This is worth stating plainly: aggregate reports carry routing metadata only. No message content, no subject lines, no recipient addresses, no attachments. We never see the contents of your email, and this service is not capable of doing so.

How we use it

To provide the service: detecting misconfiguration, identifying who sends mail as your domains, alerting you, and producing your reports. We do not sell data, and we do not use your data to train models.

Aggregate learning

We maintain a catalogue of email sending services — their IP ranges, DNS signatures and identifying characteristics — which improves as we see more traffic. This catalogue describes services, never customers, and contains nothing that identifies you or your domains.

Who else touches it

StripePayment processing and billing records.
PostmarkDelivery of alerts and reports to you.
Our hosting providerServers and storage.

No one else. We do not share your data with advertisers or data brokers.

Retention

Report data is kept while your account is active and for ninety days after it closes, so that a returning customer has no gap in their history. Raw report messages are archived for ninety days to allow reprocessing. You can request deletion at any time.

Your rights

You may request a copy of your data, ask us to correct it, or ask us to delete it. Write to christopher@transactionx.com and we will respond within thirty days.

Security

Data is encrypted in transit. Backups are encrypted at rest. Report data for a domain is served only to the account that has demonstrated control of that domain's DNS; there is no administrative override of that rule.

Contact

christopher@transactionx.com