Skip to content
correct.email
correct.email

Terms of service

The Polish version is binding.

1. General

  1. These terms set out the types and scope of the services provided electronically on correct.email at https://correct.email (the “Service”), the conditions for providing them, how agreements are concluded and terminated, and how complaints are handled. They are the terms required by Article 8 of the Polish Act of 18 July 2002 on providing services by electronic means.
  2. The services are provided by Michał Masłowski, trading as MICHAŁ MASŁOWSKI EXMOOR SOFTWARE, entered in CEIDG (the Polish register of businesses), ul. Sosnowa 3, 72-123 Rurzyca, Poland, NIP 8561889653, REGON 380880587 (the “Provider”). Contact: office@exmoor.pl.
  3. office@exmoor.pl is also the single point of contact for users and for the authorities of the Member States, the European Commission and the European Board for Digital Services under Articles 11 and 12 of Regulation (EU) 2022/2065 (Digital Services Act). It can be contacted in Polish and English.
  4. These terms are available free of charge at https://correct.email/terms in a form that can be downloaded, saved and printed.

2. Definitions

  1. User — a person using the Service.
  2. Account — a User’s account in the Service, linked to an email address.
  3. Consumer — a User who is a consumer within the meaning of Article 22¹ of the Polish Civil Code.
  4. Sole trader with consumer rights — a natural person concluding an agreement directly related to their business, where the agreement shows that it is not of a professional nature for them (Article 38a of the Polish Consumer Rights Act of 30 May 2014).
  5. Domain — an internet domain name added by a User for monitoring.
  6. DMARC report — a DMARC aggregate report uploaded by a User for analysis or storage.
  7. API key — a confidential string that allows using the Service’s application programming interface (API) on behalf of an Account.

3. Services

  1. The Provider offers the following services free of charge (the “Services”):
    1. diagnostic tools available without an Account: checks of SPF, DKIM, DMARC, BIMI, MX, MTA-STS and TLS-RPT records, reverse DNS and IP blocklists, an SMTP (STARTTLS) connection test, a comparison of DNS answers, an email header analyzer, an email address syntax check and a one-off analysis of a DMARC report — the result is shown to the User and not stored;
    2. the API — access to the tools in point 1 through a programming interface: without an Account with lower limits, or with an API key;
    3. the Account, which includes: monitoring of Domains once control of the Domain is confirmed, a history of results and changes, email notifications about changes, an optional weekly summary, storage and analysis of DMARC reports, and API keys with usage statistics;
    4. guides and other information.
  2. The limits of the free plan (number of Domains and API keys, daily API checks, number and retention period of stored DMARC reports, monitoring frequency) are shown on the sign-in page and in the Account. Technical limits such as requests per minute and upload sizes are described in the API documentation.
  3. The Services are free of charge. The Provider will not charge any fee without the User’s separate, express agreement to new terms.
  4. Tool results are technical information based on public DNS data and server responses at the time of the check. They do not guarantee email delivery and are not legal advice or a security audit.
  5. The Service does not send email messages as part of its tests and does not check whether mailboxes exist.

4. Technical requirements and risks

  1. Using the Service requires a device with internet access and an up-to-date browser with JavaScript enabled. The Account also requires cookies and access to the mailbox used to sign in; the API requires an HTTP client supporting TLS 1.2 or later.
  2. Using services provided electronically involves common risks such as malware, phishing and stolen credentials. The Provider never asks for a password: signing in works only through a one-time link sent by email. Users should protect access to their mailbox and API keys, never put API keys in web page code, and revoke or rotate any API key that may have been exposed.

5. Concluding and ending the agreement

  1. The agreement to use a tool without an Account is concluded when the User starts using it and ends when they stop.
  2. The agreement to maintain an Account is concluded for an indefinite period when the User first signs in with the link sent to the given email address, after accepting these terms on the sign-in form.
  3. Accounts may be opened by adults and by persons acting on behalf of businesses or other organizations they are authorized to represent. One email address corresponds to one Account.
  4. The User may terminate the Account agreement at any time, without giving a reason and at no cost, by deleting the Account on the Account page or by writing to office@exmoor.pl. Deleting the Account takes effect immediately and cannot be undone.
  5. A Consumer or sole trader with consumer rights may withdraw from the Account agreement within 14 days of concluding it without giving a reason, by writing to office@exmoor.pl or deleting the Account. Withdrawal costs nothing.
  6. The Provider may terminate the Account agreement by sending a statement with reasons to the Account’s email address:
    1. with 30 days’ notice, for an important reason, in particular if the Service is discontinued or a change in the law prevents providing the Services;
    2. without notice, if the User materially breaches section 6 and does not stop after a warning sent to the Account’s email address, or where a warning would be pointless given the nature of the breach (for example an attack on the Service).

6. Rules of use

  1. Users must use the Service in accordance with the law, these terms and good practice. Providing unlawful content is prohibited.
  2. Users may monitor only Domains they manage or are authorized to monitor; this is confirmed by the TXT record shown in the Account. Only DMARC reports about Domains confirmed in the Account may be stored.
  3. In particular, it is prohibited to:
    1. circumvent limits, including by opening several Accounts or changing IP addresses;
    2. run automated, large-scale checks of domains or IP addresses that do not belong to the User or their clients, or use the Service to prepare attacks or send unsolicited email;
    3. disrupt the Service, test its security without the Provider’s consent or try to access other Users’ data — please report vulnerabilities to office@exmoor.pl;
    4. share API keys with third parties, put them in web page code, or resell API access without the Provider’s consent.
  4. Automatic limits on the number of requests and on data size protect the Service and are not an assessment of the User’s content.

7. User content and reporting illegal content

  1. Stored DMARC reports and monitoring data are available only to the User. The Provider stores them as part of the Services (hosting) and does not look at their content unless this is needed to fix a fault, the User asks for it, or a notice or the law requires it.
  2. Stored DMARC reports are deleted automatically after the retention period shown in the Account (currently 90 days). The User may delete them earlier.
  3. Anyone may report content they consider illegal to office@exmoor.pl. A notice should include an explanation of why the content is illegal, its exact location (for example a URL or an identifier), the name and email address of the person reporting it (not required for offences referred to in Articles 3 to 7 of Directive 2011/93/EU) and a statement that the notice is made in good faith. The Provider confirms receipt and, without undue delay, informs about its decision and the possibilities for redress.
  4. If the Provider removes content, restricts access to it, or suspends or deletes an Account, it gives the User a statement of reasons with the basis for the decision and the possibilities for redress. An appeal can be sent to office@exmoor.pl within 6 months of receiving the statement and is decided within 14 days. Regardless of any appeal, the User may take the matter to court. These decisions are made by a person; the Provider does not use automated content moderation.

8. Availability and liability

  1. The Provider makes every effort to keep the Service running correctly but does not guarantee uninterrupted availability. Interruptions may result from maintenance, failures or the actions of third parties such as DNS or blocklist operators.
  2. The Provider may change the Service’s features, including adding and withdrawing tools. It gives at least 14 days’ notice before withdrawing an Account feature the User uses, unless security or the law requires otherwise.
  3. Towards Users who are neither Consumers nor sole traders with consumer rights, the Provider is liable for damage related to the free Services only if caused intentionally or by gross negligence; this liability does not cover lost profits.
  4. Towards Consumers and sole traders with consumer rights, the Provider is liable under the general rules. These terms do not exclude or limit rights they have under mandatory law.

9. Complaints

  1. Complaints about the Services can be sent to office@exmoor.pl or by post to the Provider’s address.
  2. A complaint should include contact details, the Account’s email address (if relevant), a description of the problem and when it occurred, and how the User would like it resolved. If information needed to handle it is missing, the Provider will ask for it.
  3. The Provider handles a complaint within 14 days of receiving it and replies to the email address it came from or to another address given.
  4. Consumers may use out-of-court complaint and redress procedures, for example the help of a municipal or district consumer ombudsman or a provincial Trade Inspection office in Poland. Information is available on the website of the Polish Office of Competition and Consumer Protection (uokik.gov.pl).

10. Personal data

  1. The Provider is the controller of Users’ personal data, including the Account’s email address. The purposes, legal bases and retention periods of processing and Users’ rights are described in the privacy policy: https://correct.email/privacy.
  2. For personal data in DMARC reports and monitoring data stored by the User, the Provider acts as a processor for the controller of that data — the User or the organization on whose behalf the User maintains the Account — under Annex 1.

11. Changes to these terms

  1. The Provider may change these terms for important reasons: changes in the law, changes in the scope, manner or conditions of the Services (including plan limits), security reasons, or to clarify provisions.
  2. The Provider informs Users who have an Account by email and in the Account at least 14 days before a change takes effect. During that time the User may terminate the agreement by deleting the Account. Changes required by law or only beneficial to Users may take effect earlier.
  3. Versions of these terms are identified by the date they take effect. After a change, the Service asks Users to read and accept the new version when signing in or in the Account. Previous versions are available on request.

12. Final provisions

  1. Agreements concluded under these terms are governed by Polish law. This choice of law does not deprive a Consumer of the protection of the mandatory provisions of the country where they habitually reside.
  2. Disputes with Users who are neither Consumers nor sole traders with consumer rights are settled by the court competent for the Provider’s registered address. Disputes with Consumers are settled by the courts competent under the general rules.
  3. These terms are drawn up in Polish and English. In case of discrepancies the Polish version prevails, unless mandatory law provides otherwise.
  4. These terms apply from 27 October 2026.

Annex 1. Data processing agreement

  1. This agreement (the “DPA”) binds the Provider as the processor (the “Processor”) and the User, or the organization on whose behalf the User maintains the Account (section 5(3)), as the controller of the data stored in the Account (the “Controller”), to the extent that this data is personal data. It is the agreement referred to in Article 28(3) of Regulation (EU) 2016/679 (GDPR) and is concluded together with the Account agreement. The User declares that they are authorized to conclude it on the Controller’s behalf. If the Controller itself processes this data on behalf of another party (for example an agency monitoring a client’s domain), this DPA is a sub-processing agreement, the Controller ensures that the other party has authorized it, and the provisions on the Controller apply accordingly.
  2. Subject matter and purpose: the Processor processes the data only to provide the Services — to store, analyze and present stored DMARC reports and Domain monitoring results.
  3. Nature of the processing: storage, analysis, display in the Account and deletion. Analysis includes DNS lookups of host names for IP addresses in reports, sent to these DNS servers: Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9).
  4. Types of data: IP addresses of mail servers, host and domain names, organization names and email addresses given in reports (for example the report sender’s contact address) and email addresses published in the Domain’s DNS records (for example report recipients). Categories of data subjects: the persons this data relates to, for example operators of mail servers and employees or contractors of the Controller or its business partners.
  5. Duration: for as long as the data is kept in the Account — DMARC reports until their retention period ends or they are deleted, monitoring results for the last 30 checks of each Domain — and no longer than until the Account is deleted.
  6. The Processor:
    1. processes the data only on documented instructions from the Controller, including with regard to transfers to a third country. These terms and the Controller’s actions in the Account are the instructions. If Union or Polish law requires the Processor to process the data, it informs the Controller before processing unless that law prohibits it;
    2. ensures that persons authorized to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality;
    3. takes the measures required by Article 32 GDPR, in particular: encrypted connections (TLS), access to data only after signing in and only to the Account’s own data, sessions and API keys stored only as cryptographic hashes, restricted administrative access to the server, logs without report contents or checked domains, and regular backups;
    4. may engage another processor (sub-processor) under the Controller’s general authorization, which the Controller gives by concluding this DPA. The sub-processor is OVH Sp. z o.o., Wrocław, Poland (KRS 0000220286), part of the OVHcloud group — a server in a data centre in the European Union and email — under its data processing agreement. The Processor informs the Controller by email at least 14 days before adding or replacing a sub-processor. Within that period the Controller may object by writing to office@exmoor.pl. The Processor considers the objection before making the change and informs the Controller of its decision; if it does not accommodate the objection, the Controller may, before the change and at no cost, terminate the Account agreement and request the return of the data. The Processor imposes the same data protection obligations on the sub-processor and remains liable to the Controller for their performance;
    5. taking into account the nature of the processing, assists the Controller in responding to requests from data subjects and in meeting the obligations in Articles 32 to 36 GDPR;
    6. notifies the Controller of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, with the information required by Article 33(3) GDPR that it has;
    7. when the Services end, at the Controller’s choice, deletes the data or returns it to the Controller and then deletes it, unless Union or Polish law requires it to be kept. Deleting a report, Domain or the Account is the Controller’s instruction to delete the data and takes effect immediately. The Controller may request the return of the data by writing to office@exmoor.pl before deleting the Account or, if the Provider terminates the agreement, before the notice period ends or, for termination without notice, within 14 days of receiving the statement; until then the Processor keeps the data for that purpose only. The Processor returns the data within 14 days of the request, in JSON format. Backups are deleted as they rotate, within 30 days at the latest. The Controller also keeps the original DMARC report files it uploaded;
    8. makes available to the Controller the information needed to demonstrate compliance with Article 28 GDPR and allows for audits, including inspections, by the Controller or an auditor it mandates. Audits must be announced at least 14 days in advance, take place on working days, no more than once a year (unless there has been a data breach), and must not compromise the confidentiality of other Users’ data. For the sub-processor, the Processor passes on the information, certificates and reports that the sub-processor makes available to its customers;
    9. immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law.
  7. The Processor does not transfer the data to third countries, except for the DNS lookups described in paragraph 3, which reach the operators of the DNS servers named there under their privacy policies, and remote access by companies of the sub-processor’s group from countries the European Commission has found to ensure adequate protection (the United Kingdom, and Canada for organizations engaged in commercial activities), under the sub-processor’s data processing agreement.
  8. The parties’ liability for breaches of data protection law is governed by Article 82 GDPR. Matters not covered here are governed by these terms and the GDPR.