Privacy policy

Who is responsible for your data

Nansec Software AB, organisation number 559602-3696, Blackevägen 56, 417 16 Göteborg, Sweden, is the controller for personal data described in this policy as controller data. You can reach us at support@dmarcvision.eu.

For DMARC, TLS-RPT, and forensic report data that customers send to the service, we act as a processor on behalf of the customer. That relationship is governed by the data processing agreement, which is Appendix 4 to the General Terms.

What we collect as controller

• Contact details you send us, such as name, work email address, company, and the content of your message.
• For user accounts and technical log data processed on behalf of a customer organisation, we process the data as a processor for the customer under Appendix 4.
• Billing and order data needed to invoice a subscription and meet bookkeeping obligations.
• Support correspondence and the records needed to answer and follow up on your request.
• Technical request data generated when you visit the website or the portal, such as IP address, user agent, requested URL, and timestamp, recorded by our content delivery network for security and operational purposes.
• When you use the free Email Security Check, we process the submitted message headers, connecting IP address, envelope sender, authentication results, and relevant sending-domain configuration. Email addresses are hashed or redacted and the message body is not retained.

Why we process it and on what legal basis

• To answer enquiries and provide requested information — our legitimate interest in communicating with people who contact us and handling their enquiries. Where the data subject intends to enter into a contract with us, the processing may also be necessary to take steps before entering into a contract.
• To administer, deliver, and support the Service to our business customers — our legitimate interest in fulfilling our commitments to the customer organisation and administering its users and contact persons.
• To keep the website and the Service secure and available, and to detect and prevent abuse — our legitimate interest in protecting our systems, users, and customers.
• To meet accounting, tax, and other legal requirements — legal obligation.
• To provide the public Email Security Check that the user requests and prevent abuse of the service — our legitimate interest in providing the requested function and protecting the service against abuse.

Report data processed for customers

DMARC aggregate (RUA) reports mainly contain sending IP addresses, authentication results, and volume counts. Forensic (RUF) reports can additionally contain message-level details and personal data such as envelope and header addresses.

Selected identifying values in the metadata extracted from RUF reports are pseudonymized with customer-specific keyed HMAC-SHA256 before they are stored for normal analysis. The original report may still contain the original personal data and is therefore stored separately with encryption and strict access controls for 14 days.

Cookies and similar technologies

This website does not use advertising cookies, tracking cookies, or third-party analytics, and it does not build visitor profiles. No cookie banner is shown because no consent-requiring storage is used.

The website stores two values in your browser's local storage so the site behaves the way you left it: your selected colour theme and your selected language. Both are stored only in your browser, are not sent to us, and can be removed by clearing site data.

Sharing and sub-processors

We do not sell personal data. We share data with service providers that help us run the website and the service, and those that process customer data are listed in Appendix 5 to the General Terms. Where a provider processes personal data on our behalf, a data processing agreement is in place.

We may disclose data where required by law or to establish, exercise, or defend legal claims.

Where data is processed

Website hosting and report processing run in AWS eu-north-1 (Stockholm, Sweden). The website and the portal are served through a global content delivery network, which means request metadata such as IP address, and in the portal users’ names and email addresses, may be handled at an edge location outside the EU for the purpose of delivering the page and protecting the service.

Where a transfer outside the EU/EEA takes place, we rely on an adequacy decision or the European Commission's standard contractual clauses together with additional safeguards.

How long we keep data

• Enquiries submitted through the contact form and related support correspondence: 12 months after the matter is closed, unless we need it for an ongoing customer relationship or legal claim.
• Billing records: seven years, as required by Swedish bookkeeping rules.
• Pseudonymized analytical report data processed for a customer: according to the retention period of the customer's plan, after which it is deleted.
• Original RUF reports: stored separately with encryption and strict access controls for 14 days after receipt, available to an authorized customer representative through support during that period, and then automatically deleted.
• Email Security Check raw messages: deleted immediately after parsing, with a one-day storage lifecycle as a deletion backstop. Extracted check reports: seven days.
• Delivery and security logs: 6 months.

Your rights

You have the right to request access to your personal data, and to request rectification, erasure, restriction, portability, or to object to processing based on legitimate interest. To exercise a right, contact support@dmarcvision.eu.

If you believe we handle your personal data incorrectly, you can lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or the supervisory authority in your country of residence.

Changes to this policy

We update this policy when the service or our processing changes. The date at the top of the page shows when it was last changed. Material changes affecting customers are communicated directly.