Privacy policy

Last updated 9 November 2026

This policy explains what personal information MonitorMyEmail collects, why, how long we keep it, who we share it with, and the rights you have.

Who we are

MonitorMyEmail is a trading name of Second Shadow Ltd, a company registered in England and Wales (company number 17466353), registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Second Shadow Ltd is the controller of the personal information described here ("we", "us"). For anything about your data, email support@monitormyemail.com.

What we collect, and why

Your account

Your email address and a securely hashed password (we never see your actual password).
When you signed up, confirmed your email and last signed in.

We use this to run your account, sign you in, and send account emails such as confirmations, password resets and the alerts you've set up.

Domains you monitor

The domain names you add, and the results of our checks on them: ownership verification, DMARC settings, and a daily health check (SPF, DKIM, DMARC, MTA-STS, blocklists, domain age).
A history of each domain's daily health score and which checks changed, so we can show trends and alert you when something gets worse.

DMARC reports

When you point your domain's DMARC reports at us, mailbox providers (such as Google and Microsoft) send us daily aggregate reports about mail sent using your domain. These contain the IP addresses of sending servers, message counts, the domains used, and SPF, DKIM and DMARC results. Aggregate reports do not contain message content, subject lines or recipient addresses. We keep each report, and the original file it arrived in, so we can show you your history.

Score My Email (email tests)

You can use our email test without an account. When you send a message to a test address, we receive and analyse it, and store:

the sender's address, the subject line and the message headers (which include the names and IP addresses of the servers it passed through);
the results of our analysis, including the authentication results and spam filter score.

We read the message body to analyse it (for example, counting links and images), but we don't keep the body. Anyone with the link to a test result can see it, so only send test messages you're happy for that to apply to. Test results are deleted after 90 days.

Support and contact

If you email us, we keep the conversation so we can help you and refer back to it.

Technical and security information

Our hosting providers keep standard server logs (such as IP addresses, browser type and the pages requested) so the service can run securely and problems can be investigated.

Analytics (only with your consent)

If you choose "Accept analytics", we use our own Second Shadow analytics to understand how the site is used. It records the pages you visit, how you arrived, page performance, clicks on links and, when you submit a form with no password field, the email address, name and phone number entered in it. Forms for signing in, signing up and resetting a password are excluded. See Cookies below.

Our legal basis

UK data protection law requires us to have a legal reason for each use of your information:

Contract: running your account, monitoring your domains, processing your reports, running email tests you request, and sending account emails and alerts.
Legitimate interests: keeping the service secure, preventing abuse, fixing problems, answering support requests, and improving the service. We only rely on this where it doesn't override your rights.
Consent: analytics cookies and the information they collect. You can withdraw consent at any time.
Legal obligation: keeping records the law requires, such as financial records if you pay us.

Who we share it with

We don't sell your information, and we don't use it for advertising. We use a small number of service providers who process data on our behalf, under contract, and only as needed to provide their service:

Supabase: database, file storage and account sign-in.
Render: website hosting.
Postmark: receiving DMARC reports and test emails, and sending account and alert emails.

To run health checks we look up public information about your domain and its sending servers: DNS records, domain registration data (RDAP), and public blocklists (such as Spamhaus, SpamCop and Barracuda). Those services see the domain names and server IP addresses we ask about.

We'll otherwise only share information if the law requires it, to protect our rights or users' safety, or as part of a sale or reorganisation of our business (in which case this policy would continue to apply).

International transfers

Some of our providers store or process data outside the UK, including in the European Union and the United States. Where that happens, we rely on the protections UK law provides, such as UK adequacy regulations (including the UK-US Data Bridge) or the International Data Transfer Agreement and Addendum to the EU Standard Contractual Clauses. You can ask us for more detail.

How long we keep it

Account, domains, DMARC reports and score history: while your account is open. Removing a domain deletes its reports, scores and alerts.
When you close your account: we delete your account and everything linked to it. Copies in our providers' backups are overwritten within their normal backup cycle (typically within 30 days).
Email tests: 90 days.
Support emails: up to 2 years after the conversation ends.
Financial records (if you pay us): 6 years, as UK law requires.

Cookies and analytics

We use a small number of cookies and similar browser storage:

Essential (always on): sign-in cookies that keep you logged in, and a cookie (mme_consent) that remembers your cookie choice for a year. The site can't work properly without these.
Analytics (only if you accept): Second Shadow analytics stores a random visitor ID in your browser's local storage (_ss_vid) and records the information described under "Analytics" above.

If you choose "Essential only", analytics isn't loaded at all. You can change your mind at any time using "Cookie settings" at the bottom of every page. We don't use advertising cookies.

Your rights

Under UK data protection law you have the right to:

ask for a copy of the personal information we hold about you;
ask us to correct information that's wrong or incomplete;
ask us to delete your information;
ask us to restrict how we use it, or object to our use of it based on legitimate interests;
ask for the information you gave us in a portable, machine-readable format;
withdraw your consent to analytics at any time (this doesn't affect anything before you withdrew it).

To use any of these rights, email support@monitormyemail.com. We'll reply within one month. There's normally no charge.

If you're unhappy with how we've handled your information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

Security

We protect your information with encryption in transit (HTTPS), hashed passwords, access controls that keep each customer's data separate, and by limiting who can access production systems. No system is perfectly secure, but if a breach affecting your information happens we'll tell you and the ICO where the law requires it.

Children

MonitorMyEmail is a service for businesses and isn't intended for children. We don't knowingly collect information from anyone under 16.

Changes to this policy

If we change this policy in a meaningful way, we'll update the date above and tell account holders by email before the change takes effect.