Privacy Policy

This policy explains what personal data PostVee handles, why, and your rights. PostVee is operated by Ctrl Networks, the data controller for the account and website data described below. For the domain data you load into a workspace, you are usually the controller and we are your processor — see the Data Processing Addendum.

1. What we collect

Account and contact details

When you request access or use a workspace: your name, work email, organisation, an optional message, and the roles of colleagues you invite. When you enquire, we keep the request and the IP address it came from, to prevent abuse.

The domains you add

The domain names you enter, and everything we read from their public DNS: SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, DNSSEC and BIMI records, name servers and blocklist status. DNS data is public by nature.

DMARC aggregate report data

This is the sensitive part. When you route a domain's DMARC reports to PostVee, we receive and store aggregate reports from receiving mail providers. These contain third-party sending IP addresses, the volume of mail seen from each, and authentication results and metadata for mail that claimed to be from your domain. They can reveal which services send on your behalf and where mail is being spoofed. We process this only to show you who is sending as your domains; it is stored per workspace and never pooled with, or disclosed to, other customers.

Email-test messages

When you send a message to a domain's private test address, we store and parse that message — headers, body, links and authentication results — so we can grade it. Do not send test messages containing personal data you do not need us to see.

Technical and usage data

Standard server logs (IP, timestamp, request) for security and reliability. The public domain-checker keeps no record of who ran a check; results are cached briefly by domain only.

2. Lawful basis

• Contract — to provide the workspace you have asked for.
• Legitimate interests — to run, secure and improve the service, respond to enquiries, and prevent abuse, balanced against your rights.
• Legal obligation — to keep records we are required to keep (for example, for tax).

Where we act as your processor for report and test data, your own lawful basis as controller applies; we act on your instructions.

3. How long we keep it

Account data is kept for as long as your workspace is active and for a reasonable period afterwards. DMARC report data and test messages are retained while they are useful for the trend and change analysis the service provides, and are deleted when you delete the domain or close the workspace, subject to short backup-rotation windows. Access-request records are kept only as long as needed to deal with the enquiry.

4. Sub-processors

We use a small number of service providers who process data on our behalf. Today these are:

• 20i — UK hosting for the application and its database (our VPS host).
• Stripe — card-payment processing, once card billing is enabled. Until then, billing is by invoice and no card data reaches Stripe.

We do not sell your data and do not share it with advertisers. We will update this list before adding any new sub-processor.

5. Where your data lives

The application and its data are hosted in the United Kingdom. DMARC aggregate reports are sent to us by receiving providers around the world, but are stored on our UK infrastructure.

6. Your rights

Under UK GDPR you may ask us to give you access to your personal data, correct it, delete it, restrict or object to its processing, or provide it in a portable form. To exercise a right, contact us below. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), though we would like the chance to put things right first.

7. Contact

Privacy questions or requests: phowden@ctrl-networks.com.