Legal
Privacy Policy
In short: we store your account details, the domains you monitor, and their check results. Free checks are stored too — anonymously, at a random URL, for 90 days. We read public DNS — never your emails' content.
1. Data controller
The data controller is Kadiaak OÜ, Sepapaja tn 6, 15551 Tallinn, Harju Maakond, Estonia (reg. no. 16357744, VAT EE102437021), operating the Inboxight service.
2. What we collect
For account holders, we process:
- Account data — email address, name, hashed password, plan and billing status (payments are processed by our payment provider; we never store card numbers).
- Monitoring data — the domains you add, their public DNS records, blacklist status and check history.
- Alert channels — the email addresses, Slack webhooks or endpoint URLs you configure to receive alerts.
- Technical logs — IP address, browser and usage events, kept for security and debugging.
3. The free checker
A free check is stored so that its report has a link you can come back to and forward. We keep the domain you entered, what the public DNS said about it, and the resulting report — under a random identifier, with no account and no identity attached to it.
- The link is the key — a report lives at an unguessable URL, is not listed anywhere, and is excluded from search engines. Anyone you send the link to can read it.
- Public data only — every record in a report is public DNS. Nothing in it is private to you, and none of it is your email.
- 90 days — free reports are deleted automatically after 90 days.
- Rate limiting — we count checks per IP address to prevent abuse.
If you want a report removed before then, send us the link — see Contact.
4. DMARC report data
If you route your DMARC aggregate reports (rua) to Inboxight, we receive the XML reports that receivers send about your domain. These contain sending IPs, volumes and authentication results — never the content of any email. We parse and store them to build your report dashboards for the retention period of your plan.
5. Retention
Check history and DMARC data are kept for the retention window of your plan (7 to 365 days). Free-tool reports are kept for 90 days, then deleted. Account data is kept while your account is active and deleted within 30 days of account closure, except where law requires longer retention (e.g. invoices).
6. Subprocessors
We use a small number of subprocessors to host and deliver the service (cloud infrastructure, email delivery, payments). They act on our behalf under data processing agreements; the current list is available on request.
7. Your rights
Under the GDPR you can access, rectify, export or delete your personal data, object to or restrict processing, and lodge a complaint with a supervisory authority — in Estonia, the Andmekaitse Inspektsioon. Most of this is self-service from your account settings; for the rest, contact us.
8. Contact
Privacy questions and requests: through the contact options on this website, or by post to Kadiaak OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia.