DomainSentinel — Privacy Policy
Version: 1.2 Effective date: 2026-04-26 Last updated: 2026-11-15
1. Who we are
Steelcap Labs (ABN 69 540 550 460) operates the DomainSentinel service at domainsentinel.app and related subdomains.
In this Privacy Policy, "we", "us", "our", and "DomainSentinel" refer to Steelcap Labs. "You" and "your" refer to you, the user.
Our privacy contact is:
- Email:
[email protected] - Postal address: PO Box 2110, Burleigh BC QLD 4220, Australia
2. Scope
This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you:
- Visit our website at
domainsentinel.app. - Create and use an Account.
- Use the DomainSentinel scanning service on any plan.
- Communicate with us.
It does not cover third-party websites, services, or applications linked from our Service. Those are governed by their own privacy policies.
3. What information we collect
3.1 Information you provide
- Account data: name, email address, password (hashed), and any profile information you choose to add.
- Billing data: where you pay for a Subscription, billing name, billing country, and partial payment card details (last 4 digits, expiry, card brand). Full card numbers are handled directly by Stripe and are never stored on our servers.
- Support and communication data: messages you send to our support channels, including attachments.
3.2 Information we collect automatically
- Usage data: pages you visit, features you use, timestamps, and actions you take within the Service.
- Device and log data: IP address, browser type, operating system, referrer URL, and similar technical identifiers.
- Cookies and similar technologies: see our Cookie Notice at
domainsentinel.app/cookiesfor detail.
3.3 Scan data
When you submit a domain for scanning, we retrieve and process:
- Public DNS records (A, AAAA, MX, TXT, SPF, DKIM, DMARC, CNAME, and related).
- DMARC aggregate reports (if configured).
- Email authentication configuration and related metadata.
- If you connect Google Postmaster Tools, your Google account email address, a refresh token for that connection (stored encrypted), and daily Gmail statistics for the domains you have verified there: spam rate, delivery error rates, and SPF, DKIM, DMARC and encryption rates.
- If you connect Instantly or Smartlead, the API key you give us (stored encrypted), your Instantly account email address, and daily statistics for the campaigns you link to a domain: emails sent, replies, bounces and account errors. We also keep the type and time of each sending event with the provider's ID for it, but not the message or the recipient's email address.
- If you connect Slack, the webhook address you give us (stored encrypted). We send to it alerts and a weekly summary for your monitored domains: domain names, scores, open incidents, their severity, when an issue was first seen, and a link to your dashboard.
Scan data is generally not personal data, but email addresses appearing in rua / ruf DMARC fields or other DNS records may be considered personal data under some laws. We treat such data with the same protections as account data.
3.4 Sensitive information
We do not knowingly collect sensitive information (as defined in the Australian Privacy Act 1988 (Cth)) such as health data, racial or ethnic origin, or political opinions. Do not submit such information to the Service.
3.5 Children
The Service is intended for users 18 years or older. We do not knowingly collect information from children under 18. If we learn we have collected such information, we will delete it promptly.
3.6 Product telemetry
Product telemetry. To understand how DomainSentinel performs, we record events such as a scan completing, a score changing, or an incident opening.
These records are pseudonymised, not anonymised. Account and domain identifiers are replaced with a keyed hash at the moment the event is recorded, and the original identifiers are never stored in them. Because we hold the key, these records can be linked back to an account, so they are treated as personal data.
Before hashing, a domain is reduced to its registrable name — mail.example.com and example.com are recorded as the same domain. Scans run without an account are recorded with no account identifier at all.
We keep these records for 24 months, then delete them.
We also compute daily summaries from them. Nothing from these summaries is published or shared today.
3.7 Google user data
If you connect Google Postmaster Tools, we ask Google for two read permissions: the list of domains you have verified in Postmaster Tools (postmaster.domain) and the daily Gmail statistics for those domains (postmaster.traffic.readonly). We also receive the email address of the Google account you connect. If you sign in with Google, we receive your Google account identifier, name, profile picture and email address, and use them to create your Account and sign you in.
- How we access it: only after you choose to connect and approve the request on Google's own consent screen.
- How we use it: to show you how mail from your own domains is doing and to measure how DomainSentinel performs. For you, that means the Gmail statistics on your dashboard, the Reputation score we work out from them, alerts when they change, and answers from MARC when you ask it about your domains. When a Reputation score changes, the product telemetry in section 3.6 records the new score, its state and the connection status against a keyed hash of your Account and domain, and we compute daily summaries from those records. We do not use Google user data for any other purpose.
- How we store it: the refresh token is stored encrypted. Your Google account email address and the statistics are stored in our database with the rest of your Account. We keep the statistics until you disconnect the connection or delete your Account. When you disconnect, we delete the token and the statistics that came from that connection and ask Google to revoke our access; if that request fails, you can remove DomainSentinel at
myaccount.google.com/permissions. If another Google account connected to your Account still supplies the same domain, we keep that domain's statistics until that connection is also disconnected or you delete your Account. The record of the connection and its activity log, including the Google account email address, stay in your Account until you delete your Account. - Who we share it with: we do not sell Google user data and do not use it for advertising. It is handled by the subprocessors in section 5.1 that host and run the Service, and by Anthropic for MARC as set out below. We do not transfer it to anyone else unless the law requires it or you ask us to.
- MARC: when you ask MARC a question, we send Anthropic the data needed to answer it. For a domain with Postmaster Tools connected, that can include its Reputation score and connection status, which come from your Google data. It is only your own data, and it is used only to answer your question.
- AI training: we do not use Google user data to train AI or machine learning models.
- People: nobody at DomainSentinel looks at your Google user data unless you ask us to for support, we need to for security or to investigate abuse, or the law requires it.
- Revoking access: you can disconnect in DomainSentinel at any time, and remove DomainSentinel at
myaccount.google.com/permissions.
DomainSentinel's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Why we collect and use your information
We collect and use personal information for the following purposes:
| Purpose | Legal basis (GDPR/UK GDPR) |
|---|---|
| Providing, operating, and maintaining the Service | Contract performance (Art. 6(1)(b)) |
| Authenticating your Account | Contract performance (Art. 6(1)(b)) |
| Processing payments and managing Subscriptions | Contract performance (Art. 6(1)(b)) |
| Sending service-related emails (onboarding, security alerts, billing) | Contract performance (Art. 6(1)(b)) |
| Responding to support requests | Contract performance + legitimate interests (Art. 6(1)(f)) |
| Improving the Service using aggregated, de-identified data | Legitimate interests (Art. 6(1)(f)) |
| Preventing fraud, abuse, and unauthorised access | Legitimate interests (Art. 6(1)(f)) + legal obligation (Art. 6(1)(c)) |
| Marketing emails (newsletter, product updates) | Consent (Art. 6(1)(a)) — opt-out available at any time |
| Complying with legal obligations (tax, regulatory) | Legal obligation (Art. 6(1)(c)) |
For Australian users, our handling is governed by the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth).
5. Who we share your information with
We share personal information only where necessary and with appropriate contractual safeguards.
5.1 Subprocessors
We use the following third parties to provide the Service. Each has contractual obligations to protect your information in line with applicable law.
| Subprocessor | Purpose | Region | Safeguards |
|---|---|---|---|
| Render | Hosts the DomainSentinel web app, API, background workers and cache | Germany (Frankfurt) | Provider's standard data processing terms |
| Supabase | Database hosting (Postgres) | Germany (Frankfurt) | GDPR SCCs |
| Resend | Sends all DomainSentinel email | Japan (Tokyo) for sending; the company is in the United States | GDPR SCCs |
| Sentry | Error monitoring. We configure it to leave out personal data | Germany (Frankfurt) | GDPR SCCs |
| Stripe, Inc. | Payment processing for paid plans | United States, global | PCI-DSS Level 1, GDPR Standard Contractual Clauses (SCCs) |
| Abusix | Blocklist lookup. It receives the domain name being checked | Not confirmed | Provider's standard terms |
| ip-api.com | Looks up the location and network owner of sending IP addresses found in DMARC reports. It receives those IP addresses | Not confirmed | Provider's standard terms |
| Anthropic | Powers the MARC assistant. It receives your question and the scan data needed to answer it | United States | Provider's standard data processing terms |
Services you connect. These are not our subprocessors. You hold your own account with each of them, and you choose to connect it. Each handles your data under its own terms and privacy policy, not under our instructions. If you connect one, we send it only what the connection needs, and it sends us back data about your own account.
| Service | What it does for you | Data we exchange | Region |
|---|---|---|---|
| Google (Gmail Postmaster Tools) | Reputation data for your sending domains | Your connected Google account email; per-domain reputation statistics | United States |
| Cloudflare | Reads your DNS zone so we can scan it | DNS zone data | United States, global |
| Instantly | Sending statistics from your Instantly account | Your API key (stored encrypted); campaign and account statistics | United States |
| Smartlead | Sending statistics from your Smartlead account | Your API key (stored encrypted); campaign and account statistics | United States |
| Slack | Receives alerts at a webhook you provide | The alert text we send to your webhook | United States |
A current and authoritative list of subprocessors is maintained at domainsentinel.app/subprocessors. We will give at least 14 days' notice before adding or replacing a subprocessor.
5.2 Legal disclosures
We may disclose personal information where required by law, regulation, court order, or to:
- Respond to a lawful request from government or law enforcement.
- Enforce our Terms of Service or protect our legal rights.
- Protect the safety or property of any person.
5.3 Business transfers
If Steelcap Labs is sold, merged, or acquires another business, personal information may be transferred to the successor entity. You will be notified in advance where required by law and given an opportunity to exercise your rights before the transfer.
5.4 With your consent
We will share personal information for any other purpose only with your explicit consent.
5.5 No sale of personal data
We do not sell personal data to third parties, and have not done so in the preceding 12 months. For California residents, see Section 9 below.
6. International data transfers
DomainSentinel is run from Australia, but none of our infrastructure is in Australia. Your data is stored and processed in:
- Germany: our hosting (Render), our database (Supabase) and our error monitoring (Sentry).
- Japan: the servers that send our email (Resend).
- United States: payments (Stripe), our MARC assistant (Anthropic) and the services you choose to connect (Google, Cloudflare, Instantly, Smartlead and Slack). Several of our providers are United States companies, so their staff there may be able to access data we hold with them.
Our blocklist provider (Abusix) and IP-lookup provider (ip-api.com) receive only a domain name or an IP address from a DMARC report. We have not confirmed where they are located.
- For transfers from the European Economic Area or United Kingdom to countries without an adequacy decision (such as the United States), we rely on Standard Contractual Clauses (SCCs) and, where applicable, UK International Data Transfer Agreements, supplementary measures, and transfer risk assessments.
- For Australian users, we comply with Australian Privacy Principle 8 (cross-border disclosure) and take reasonable steps to ensure overseas recipients handle information consistently with the APPs.
You may request a copy of our SCCs by emailing [email protected].
7. How long we keep your information
We keep personal information only for as long as necessary to provide the Service and comply with our legal obligations.
| Category | Retention |
|---|---|
| Active Account data | Until you delete your Account (see 7.1) |
| Scan data and reports | Until you delete your Account (see 7.1) |
| Billing and invoicing records | At least 5 years — Australian tax law requires us to keep them |
| Support correspondence | 2 years from the date of the last interaction |
| Log and security data | 12 months, unless needed longer for fraud or abuse investigation |
| Marketing opt-in records | Until you withdraw consent, plus 2 years to evidence the consent |
7.1 Deleting your Account
When you delete your Account, we delete your data straight away. There is no 30-day wait and no reactivation. Deletion can't be undone.
We delete straight away:
- Your Account and sign-in details.
- Your domains, with their scan history, findings and alerts.
- Your DMARC reports and statistics.
- The details we store for any account you connected (for example Cloudflare, Google, Instantly or Smartlead).
Deleting your Account does not withdraw the permission you gave at Google or Cloudflare. To do that, remove DomainSentinel in that provider's own settings.
We keep:
- Billing records, if you ever paid, for at least 5 years. Australian tax law requires it.
- Your email address on a do-not-email list, if you ever unsubscribed from our emails. This is so we don't email you again.
- Usage events, with the link to your Account removed. Some are kept for up to 24 months.
- Records of free scans run before you signed up (the domain, IP address and browser), and any email address you gave us before you signed up, with the link to your Account removed.
- Copies in our database provider's backups. These expire after 7 days.
If you find anything else of yours after you delete your Account, email [email protected] and we will remove it.
7.2 Getting a copy of your data
There is no export window after deletion, because deletion is immediate. If you want a copy, ask for it first. Email [email protected] (see section 8.5) and we will send your scan data and account records in a machine-readable format (CSV or JSON) within 30 days. Do not delete your Account until you have received it. Once your Account is deleted, we can't recover anything.
8. Your rights
Depending on your location, you have the following rights. We respond to verified requests within 30 days.
8.1 All users
- Access: request a copy of the personal information we hold about you.
- Correction: ask us to correct inaccurate or incomplete information.
- Deletion: ask us to delete your information (subject to legal retention obligations).
- Complaint: lodge a complaint with us at
[email protected].
8.2 EU / UK users (GDPR / UK GDPR)
In addition to the rights above, you have the right to:
- Portability: receive your data in a machine-readable format and transmit it to another controller.
- Object to processing based on legitimate interests.
- Restrict processing in certain circumstances.
- Withdraw consent at any time (without affecting the lawfulness of prior processing).
- Not be subject to automated decision-making producing legal or similarly significant effects.
- Lodge a complaint with your supervisory authority (e.g., Irish Data Protection Commission, UK Information Commissioner's Office, CNIL in France).
8.3 Australian users
You have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you believe we have breached the Australian Privacy Principles.
8.4 California users (CCPA / CPRA)
See Section 9 for additional rights available to California residents.
8.5 How to exercise your rights
Email [email protected] with your request. We may need to verify your identity before processing the request. Rights requests are free, except for manifestly unfounded or excessive requests, for which we may charge a reasonable fee or refuse to act.
9. California Consumer Privacy Act (CCPA / CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act.
- Right to know what categories and specific pieces of personal information we have collected about you.
- Right to delete your personal information, subject to exceptions.
- Right to correct inaccurate personal information.
- Right to opt out of the "sale" or "sharing" of your personal information — we do not sell or share personal information as those terms are defined under the CCPA, so there is nothing to opt out of.
- Right to limit use of sensitive personal information — we do not use sensitive personal information for inferring characteristics.
- Right to non-discrimination for exercising your CCPA rights.
To exercise these rights, email [email protected]. You may designate an authorised agent to submit requests on your behalf; we will require proof of authorisation.
10. Security
We take reasonable technical and organisational measures to protect personal information, including:
- Encryption in transit (TLS 1.2+).
- Encryption at rest for databases containing personal data.
- Role-based access controls.
- Regular backups with tested restoration procedures.
- Security monitoring, logging, and incident response procedures.
- Principle of least privilege for infrastructure access.
No system is perfectly secure. If you believe your Account has been compromised, contact [email protected] immediately.
11. Data breach notification
In the event of a data breach affecting your personal information:
- We will notify affected users within 72 hours of becoming aware of the breach where the breach is likely to result in a risk to your rights or freedoms.
- Notification will include the nature of the breach, categories of data affected, likely consequences, and steps being taken.
- We will notify relevant supervisory authorities (OAIC for Australia, EU/UK authorities where applicable) in accordance with law.
Our 72-hour commitment exceeds the Australian Notifiable Data Breaches scheme's "as soon as practicable" standard and matches the GDPR requirement.
12. Direct marketing
We may send you service-related emails (billing, security, account notifications) that are not subject to opt-out because they are essential to the Service.
Marketing emails (product newsletters, feature announcements, educational content) are sent only with your consent at signup or a later opt-in. You can unsubscribe at any time using the link in every marketing email or by emailing [email protected].
We comply with the Spam Act 2003 (Cth), GDPR marketing consent requirements, CAN-SPAM, and CASL as applicable.
13. Cookies and tracking
For details on cookies and similar technologies, see our Cookie Notice at domainsentinel.app/cookies.
We do not use third-party advertising cookies or cross-site tracking.
14. Links to third-party sites
The Service may contain links to third-party sites or services. We are not responsible for their privacy practices. Review their policies before providing personal information to them.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. For material changes, we will notify you by email and/or prominent notice in the Service at least 30 days before the change takes effect.
The "Effective date" and "Last updated" fields at the top of this policy will reflect the latest version.
16. Contact us
For privacy questions, requests, or complaints:
- Email:
[email protected] - Postal address: PO Box 2110, Burleigh BC QLD 4220, Australia
- Business: Steelcap Labs (ABN 69 540 550 460)
Regulatory contacts:
- Australia: Office of the Australian Information Commissioner —
oaic.gov.au - United Kingdom: Information Commissioner's Office —
ico.org.uk - European Union: Your local data protection authority (list at
edpb.europa.eu)
Steelcap Labs — Privacy Policy v1.2 — 2026-04-26