Privacy Policy

1. Overview

DeliverSight is a trading name. The data controller for the personal data described in this policy is Aethon Systems OÜ, a private limited company registered in Estonia under registry code 17345654, at Sepapaja 6, 15551 Tallinn, Estonia. You can reach us at [email protected].

Where we determine the purposes and means of processing your personal data, we act as the data controller; where we process the content you submit for testing on your behalf, we act as a processor under your instructions.

Because we are established in Estonia, an EU member state, the GDPR applies to us directly and we do not need to appoint a representative in the Union. We have not appointed a data protection officer: we are not a public authority, and we do not carry out large-scale systematic monitoring or large-scale processing of special-category data, which are the circumstances that would require one.

2. Information we collect

Account data (such as name, email address, and workspace/team details); billing data, which is processed by our payment processor (we receive limited billing metadata such as country, tax ID status, and invoice records, but do not store full card numbers); the content of emails you submit for testing and the resulting analysis; DMARC aggregate reports you route to us; and technical metadata needed to produce reports and operate the Service (DNS records, SPF/DKIM/DMARC authentication results, sending IP addresses, and usage/diagnostic logs).

Emails you submit for testing may contain personal data of your own recipients or senders; you are responsible for having a lawful basis to submit that content to us for processing.

If you write to us through the contact form, we store your name, email address, and message so we can reply and keep a record of the exchange. We also record the IP address and browser user agent of the submission for a short period, solely to detect abuse of the form.

3. How we use information

We use information to provide deliverability testing, monitoring, DMARC aggregation, and reporting; to operate, secure, and improve the Service; to process payments and prevent fraud and abuse; to enforce rate and plan limits; and to communicate with you about your account, security, and service updates.

Where GDPR or similar laws apply, our legal bases include performance of our contract with you, our legitimate interests in operating and securing the Service, compliance with legal obligations, and your consent where required.

4. Cookies and analytics

Some cookies are strictly necessary and are set whether or not you agree to anything else: they keep you signed in, protect forms against abuse, and remember display preferences such as light or dark mode. Without them the Service cannot work, so they are not covered by the choice below.

For analytics we use Google Analytics 4 to understand which pages are useful — how many people read a guide, which pages lead to a signup, where visitors arrive from. It is loaded ONLY if you accept: until then no Google script is downloaded, no analytics cookie is set, and no request is made. Declining loads nothing at all and changes nothing about how the Service works for you. You can change your mind at any time on this page, and withdrawing removes the cookies already stored.

Where analytics is enabled, Google acts as our processor and receives the page you viewed, approximate location derived from your IP address, and general device and browser information; this involves a transfer of data to Google in the United States. We send a redacted page address: report share links, password-reset links, invitation links and email addresses appear in our URLs, and these are stripped before anything is sent, so Google records that a report was viewed but not which one. We do not enable advertising personalisation or cross-site advertising signals, and we do not use this data for advertising.

If we ever change who processes this data, we ask again rather than carrying your answer over to a different recipient.

Our lawful basis for analytics is your consent, and only your consent. Nothing is loaded and no request is made until you accept, declining is a real outcome rather than a preference we record and ignore, and you can withdraw at any time from the cookie preferences link in the footer — which also expires the cookies Google has set. Because this rests on consent, we do not claim legitimate interests for it as a fallback.

Google is listed on our service-provider and subprocessor page, and the applicable transfer safeguard is described there.

5. Service providers, subprocessors and disclosures

We do not sell your personal data, and we do not share it for advertising. We use a small number of third parties to run the Service, each only for the purpose listed:

Stripe — payments, subscriptions, invoices and tax calculation. Stripe receives your billing name and email, country, VAT ID where you supply one, and the payment details you enter directly into Stripe's own hosted fields. We never receive or store full card numbers.

Google — website analytics, and only after you accept analytics cookies. Nothing is loaded or sent before that. See the cookies section above for exactly what is transmitted.

Cloudflare — sits in front of the website and the API as a CDN and protects them from attack and abuse. It processes the IP address and request metadata of everyone who visits, and, because it proxies the API, it also passes through the content of report and API responses in transit. Inbound test email does not go through it: mail reaches our gateway directly. This is infrastructure rather than something you can opt out of while still reaching the site, and it is relied on for security and availability rather than consent. Cloudflare's own visitor analytics is switched off, so no measurement script is injected into pages from that direction — the consent gate described above is the only thing that ever loads analytics here.

Our typefaces are not on this list, deliberately: they are served from our own servers rather than a font CDN, so loading a page does not disclose your IP address to a font provider.

Hetzner Online GmbH — hosting. Every server the Service runs on is rented from Hetzner Online GmbH and located in Finland. That is where your data physically sits, including the messages you submit for testing.

Everything else is software we run ourselves on that hosting rather than a third-party product: the database, the object storage holding submitted messages, the mail gateway that receives your test emails, error tracking, and the sign-in system. None of those is a separate company with a copy of your data — they are our own services on our own servers in Finland.

On international transfers: the primary storage systems holding submitted messages, DMARC data and monitoring data are in Finland, an EU member state, operated by an EU company. Inbound test email is delivered directly to that Finnish mail infrastructure and does not pass through Cloudflare.

When reports or API responses are delivered to you, Cloudflare may process that content transiently through its global network, including outside the EEA, under the safeguards below. So the stored copy stays in the EEA; the delivery path does not always.

Each provider that may process data outside the EEA relies on a different combination:

Stripe — the European Commission's Standard Contractual Clauses, together with certification under the EU–U.S. Data Privacy Framework, and a UK addendum for UK transfers.

Google — the Standard Contractual Clauses set out in its data processing terms. Google documents any additional certification it relies on separately, and analytics only runs at all if you have accepted it.

Cloudflare — the Standard Contractual Clauses with supplementary measures, together with certification under the EU–U.S. Data Privacy Framework; its terms state that the clauses continue to apply if that certification lapses.

We may also disclose information where required by law, or where necessary to protect our rights, our users, or the public. If we are ever compelled to hand over data, we will tell you unless we are legally prohibited from doing so.

The full list, with the exact legal entity, processing location, data categories and transfer safeguard for each, is on the subprocessors page — along with our commitment to give 30 days’ notice before that list changes.

Subprocessors, in full →Data Processing Agreement →

6. Data retention

We delete on a schedule rather than on request only, and a background sweep enforces it whether or not anyone asks.

A test you run without an account is short-lived: the address you are given stops accepting mail after a few hours, and the report and the stored message are purged about a week later. There is no way to extend this, and no way for us to recover it afterwards.

Tests run inside an account are kept for 30 days on the Free plan, 90 days on Starter, and a year on Pro, Business and Custom.

DMARC report data and domain-monitoring history are not part of the Free plan, so nothing of either is collected or stored for a free account. Where they are included, they are kept for 90 days on Starter and a year on the plans above it.

Every one of these windows is published on the pricing page alongside the other plan limits, because it is a plan limit rather than something buried here — and it is enforced by the same configuration that page reads, so the two cannot drift apart.

Both kinds of workspace can be deleted from the dashboard. A team is deleted by its owner from the team settings; your own account, and the personal workspace created with it, are closed together from account settings. Neither needs to go through us.

Deletion takes effect immediately: the workspace disappears from your account list, scheduled monitoring stops, sessions end, and nothing further is collected for it.

Erasure follows on a schedule. For 14 days the account stays recoverable — sign in again with the same password and everything comes back — and after that it and its data are permanently deleted, along with the stored messages in object storage. We keep only the billing and tax records the law requires us to hold.

If you would rather not wait out the recovery window, or you cannot reach the dashboard, ask us and we will carry out the erasure directly.

Stored message bodies are additionally subject to an outer expiry in object storage that no plan can exceed, so the content of a test does not persist indefinitely even without a request.

Messages sent through the contact form are deleted once the enquiry is no longer needed as a record. The IP address and user agent attached to a submission are removed sooner than the message itself, because they serve only to detect abuse of the form.

Billing and tax records are kept for as long as tax and accounting law requires, which is longer than the windows above and is not something we can shorten on request. Deleted data may persist briefly in routine backups before being overwritten.

7. Your rights

Depending on your location, you may have rights to access, correct, export, delete, or restrict processing of your personal data, to object to certain processing, and to withdraw consent. To exercise these rights, contact [email protected]; we will respond as required by applicable law. If you are in the EEA or UK you also have the right to lodge a complaint with a data protection authority — either your local one, or our lead authority, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

In practice: email [email protected] and say what you want. We aim to reply within a few days and will complete the request within one month, which is the GDPR deadline; if it is genuinely complex we may extend that and will tell you why before the month is up. There is no charge for a reasonable request.

If the request comes from the email address on the account, that is normally enough for us to act on it. If it does not, we will ask you to verify that address instead — we would rather ask an awkward question than hand an account's data to whoever happened to know the address.

Where we have a genuine doubt about who is asking, we may request the limited extra information needed to resolve it. We will not ask for identity documents unless it is necessary and proportionate to the request, which for an account secured by an email address it very rarely is.

Some of this you can do without asking us: account and domain data is visible and editable in the dashboard, your test history can be exported to CSV, and your account can be closed from account settings as described above. Individual test reports cannot be deleted on demand — they age out on the retention window for your plan, or go with the account.

If you are in California, you have comparable rights to know, delete, and correct, and to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information in that sense, so there is nothing to opt out of; the rights above are exercised the same way.

8. Contact

Questions about this policy, or to exercise your rights, contact [email protected]. We will update this policy from time to time and will indicate the effective date; material changes will be communicated as required by law.