Privacy Policy
Last updated 8 July 2026
This policy explains what data SPFWise collects and how we use it. In short: scanning a domain is anonymous, accounts store only what is needed to run your monitoring, passwords are stored only as a secure hash, and your data is kept on EU infrastructure.
Who we are
SPFWise operates the website at spfwise.com and the email-authentication tools and monitoring on it. We host the service on infrastructure in the European Union. For any privacy question, contact us at contact@spfwise.com.
What a scan collects
When you scan a domain, we read its public DNS records (SPF, DKIM, DMARC, MX, DNSSEC, BIMI, MTA-STS, TLS-RPT and public blocklist status) live from the internet, exactly as a mail server would. A scan needs no account and no personal data, and we do not store the result of an anonymous scan.
Accounts and passwords
Continuous monitoring, reports and alerts require an account. You can sign in with Google, or create an account with an email address and password. If you use a password, we store it only as a salted one-way hash (bcrypt). We never store or can see your plain-text password. We also store your email address, an optional display name, and the domains and data tied to your account. You must confirm your email address before your account is active.
Domain monitoring and DMARC reports
When you monitor a domain, mailbox providers send DMARC aggregate reports about mail that uses your domain. These reports include the IP addresses of sending servers, which can be personal data. We receive, parse and store these reports so we can show you who sends as your domain and whether it passes authentication. This data, and the reports you upload, are stored on our EU infrastructure.
Emails we send
We send transactional emails to the address on your account: email confirmation, and the security and deliverability alerts you enable. They are sent from no-reply@spfwise.com through our EU email provider. We do not send marketing email without your consent, and every account email relates to a service you asked for.
Cookies
We use strictly necessary cookies: a session cookie to keep you signed in, and a CSRF token cookie to protect form submissions. The public tools work without any account cookie. Our site analytics is privacy-friendly and cookieless. For advertising measurement we use Google Ads, which sets cookies only after you accept them. They are off by default under Google Consent Mode: nothing is stored until you accept on the cookie banner, and you can change or withdraw your choice anytime from Cookie settings in the footer. If you reject, no advertising cookies are stored.
Payments and infrastructure
We rely on a small set of providers to run SPFWise: OVHcloud for hosting and email (in the EU), Stripe for payments if you buy a paid plan, and Google only if you choose to sign in with Google. When you pay, Stripe processes your payment details; we never store your card number. We do not sell your data or share it for advertising.
How we use data
We use your data only to provide the service: to run scans, monitor your domains, ingest and display DMARC reports, send the alerts and confirmations you request, secure your account, handle billing, and reply to your messages.
Data retention
DMARC report data is retained according to your plan and then purged automatically. Account data is kept while your account is open. When you delete your account, we delete your personal data and the domains, reports and alerts tied to it, except where we must keep limited records to meet legal or accounting obligations.
Browser extension
The SPFWise browser extension sends only the domain name being scanned to our API, and only when you start a scan by clicking the extension or submitting a domain. It does not read page content, does not track your browsing, and contains no analytics. Scan results, your recent-scan list and your theme and language preferences are stored locally in your browser and you can clear them from the extension at any time.
Your rights
If you are in the EU or UK, you have the right to access, correct, delete, and export your personal data, and to object to or restrict its processing. You can delete your account at any time. To exercise any of these, email contact@spfwise.com and we will respond within the time the law requires.
Changes
We will post any changes to this policy on this page and update the date above.