Privacy policy

The controller of personal data is Michał Masłowski, trading as MICHAŁ MASŁOWSKI EXMOOR SOFTWARE, entered in CEIDG (the Polish register of businesses), ul. Sosnowa 3, 72-123 Rurzyca, Poland, NIP 8561889653, REGON 380880587. For anything about personal data, write to office@exmoor.pl.

This policy explains what data we process when you use correct.email with and without an account, why, on what legal basis and for how long.

When you run a check, the domain, selector or IP address you enter is sent to our server, which makes DNS queries. We do not store the names and addresses you check or write them to logs. DNS answers are kept in server memory for a few minutes at most (blocklist results for up to 15 minutes) to limit the number of queries.

DNS queries go to public DNS servers (Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9)) and to the DNS servers of the checked domain; the DNS propagation checker also asks OpenDNS (Cisco, 208.67.222.222), AdGuard DNS (94.140.14.140). Their operators receive the query — the checked name or IP address — and may process it, including outside the European Economic Area, under their own privacy policies.

A blocklist check sends the checked IP address, in a DNS query, to the operators of the lists named on the tool page. The SMTP test connects to the checked domain’s mail servers and ends the connection before any message is sent.

The header analyzer and the address syntax checker run in your browser — the text you paste is not sent to us. The optional check whether a domain receives email sends only the domain.

A DMARC report uploaded for analysis is processed in server memory only for the duration of the analysis; it is not stored or logged. We look up the IP addresses in the report in DNS (PTR records) to show server names.

Legal basis: your data needed to run a check is processed under Article 6(1)(b) GDPR (providing the service you ask for). Data about other people that may appear in the names and addresses you check or in an uploaded DMARC report (for example mail server IP addresses or email addresses) is processed under Article 6(1)(f) GDPR — our and our users’ legitimate interest in diagnosing email configuration — and only for the duration of the check.

To protect the service from abuse, the server keeps request counters per IP address in memory for a few minutes. Technical logs contain a shortened IP address (without the last part), the type of request, the response code and the time — no checked domains, email addresses or keys. Logs are written on the server to files with a limited total size (up to 50 MB for each part of the service) and are overwritten automatically, oldest entries first, so how long they are kept depends on traffic. We do not copy them off the server and they are not included in backups.

Legal basis: Article 6(1)(f) GDPR (our legitimate interest in keeping the service secure and available).

To sign in you give an email address, to which we send a one-time link; using it for the first time creates the account. We store the email address, the language of emails, when the account was created and last used, the version and date of the terms you accepted and your weekly summary setting. Giving an address is voluntary, but an account cannot be created without one — the tools work without an account.

We use the address only to send sign-in links, the alerts and summaries you turn on, replies to your messages and notices of changes to the terms. We do not send newsletters or advertising.

Sign-in links expire after 15 minutes and sessions after 30 days. Sessions and API keys are stored only as cryptographic hashes.

Legal basis: Article 6(1)(b) GDPR (the account agreement) and, for the record of accepting the terms, also Article 6(1)(f) GDPR (demonstrating that the agreement was concluded). Account data is kept until the account is deleted.

For each monitored domain we store its name, the verification code, alert settings and DKIM selectors, and the results of the last 30 checks: status, finding codes and the published DNS records (such as SPF, DMARC and MX) so that changes can be shown. To avoid sending the same alert repeatedly, we keep a hash of each alert sent for 30 days.

Stored DMARC reports (server IP addresses, host and domain names, message counts and authentication results) are kept for the period shown in your account — currently 90 days — or until you delete them. For personal data in reports and monitoring data we act as a processor for its controller — the account holder or the organization on whose behalf they maintain the account — under the data processing agreement (Annex 1 to the terms). Under the terms, the account holder ensures that they may entrust this data to us.

For API keys we store the name, a hash of the key and when it was created and last used, and after a rotation a hash of the previous key until its grace period ends. Daily API check counts, in total and per key and type of check, are kept for 40 days.

You can delete your account at any time on the account page. Deletion immediately removes the account, domains, reports and keys; database backups are deleted as they rotate, within 30 days at the latest. Before deleting the account you can ask for a copy of this data in JSON format at office@exmoor.pl — we send it within 14 days.

We save your colour theme and the language of code samples in the API documentation in browser storage (localStorage) and, if we use an analytics tool that requires consent, your decision about it. This is needed for features you use, is not sent to us and does not require consent.

The account uses two strictly necessary cookies: __Host-ce_session (your session, up to 30 days) and __Host-ce_login (links a sign-in link to the browser that asked for it, 15 minutes). A domain added with the “Monitor” button next to a check result is kept in the current tab’s storage (sessionStorage) until it is added.

We do not use third-party analytics.

Your browser measures how fast a page loads and responds (Core Web Vitals) and sends our server only the name of the measurement, its value and rating, and the type of page (for example “guide”) — no page address, cookies or identifiers. Clicks on links to Exmoor Software are reported the same way, with only the link’s position on the page. We keep the results as aggregate counters that we do not link to any person or device; the request itself appears in the technical logs described above.

If you write to us, we process your email address and message to reply and deal with your request (Article 6(1)(f) GDPR) — for as long as that takes and, for complaints and claims, until the limitation period ends.

Data is processed on our behalf, under a data processing agreement, by OVH Sp. z o.o., Wrocław, Poland (KRS 0000220286), part of the OVHcloud group: the service and its database run on its server in a data centre in the European Union, and its mail server sends our emails (sign-in links, alerts and summaries). Under that agreement, OVHcloud group companies in the United Kingdom and Canada may process data remotely where this is needed to provide the services (for example maintenance and security). The European Commission has found that the United Kingdom and Canada ensure an adequate level of data protection (Article 45 GDPR) — for Canada, with respect to organizations engaged in commercial activities, such as the OVHcloud company. Otherwise we do not transfer account data outside the European Economic Area.

Operators of DNS servers and blocklists receive the content of queries as described above. We may also disclose data to public authorities where the law requires it.

You have the right to access your data, have it corrected or deleted, restrict its processing and receive it in a portable format, and to object to processing based on our legitimate interest. Where we rely on consent (for example for statistics), you can withdraw it at any time without affecting earlier processing.

To exercise your rights, write to office@exmoor.pl — we reply within one month. If you have no account, we usually hold no data that identifies you.

If you have an account, you can see your data on the account page and change or delete it there yourself.

We make no decisions based solely on automated processing that have legal effects on you, and we do not profile users. Automatic request limits protect the service and are not such decisions.

You can also lodge a complaint with a data protection authority — in Poland the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).