What we collect, and when the tag loads.

18 October 2026

Sender Identity at senderidentity.com is operated by Finmail Limited. This policy covers the free static audit and a paid hosted DMARC subscription. The terms of use cover the service itself.

Contact

Registered office of Finmail Limited
Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road
Central
Hong Kong

Account and billing questions: support@senderidentity.com

Privacy questions and requests: privacy@finmail.com

EU representative

Euverify Ltd
Unit 3D, North Point House
North Point Business Park
New Mallow Road, Cork, T23 AT2P
Ireland
Email: gdpr@euverify.com

UK representative

Euverify Ltd
3rd Floor, 86-90 Paul Street
London, EC2A 4NE
United Kingdom
Email: gdpr@euverify.com

Please mention Finmail Limited when contacting our representative. You may also contact us directly at privacy@finmail.com.

What we collect

The domain or address you submit for an audit, any DKIM selectors or a signature header you add, and an optional report mailbox used only to draft a new DMARC record. The last audit stays in this browser. We do not store the free audit result on the server.
Your account email. We use it for login links and change notices. A login link works for 15 minutes and only once. The access code for that tab lasts 12 hours. We store a hash of the token, not a password.
Subscription status, plan, and expiry. Card numbers are entered and stored on Stripe, not on this site. Opening the payment page, or returning from it, does not start the subscription.
For a paid domain: the report mailbox, the hosted DMARC record, and a sender list taken from aggregate reports. The list can include a source IP, the header-from domain, message counts, and alignment failures. We discard the raw aggregate XML after that list is saved.
A BIMI SVG you submit. We keep the hosted logo.
An optional https webhook the account owner adds for notices. A notice does not include the raw aggregate XML.

Advertising and measurement

When a Google Tag Manager container is configured, the page can load Google’s tag for Google Analytics and for Google Ads. The tag stays off until you accept. Reject leaves it off. You can change that choice later with Cookie choices. Accepting can send events from that visit, including an audit you already ran.

The tag can set cookies and send Google your IP address, browser, and pages viewed. After you accept, it can also send:

A finished audit: the domain, grade, and score. The same domain is counted once in that tab. The report mailbox is not included.
A new account. That does not include your email or access code. Login, sign-out, and a notice-address change are not sent.
The start of checkout: the plan, the yearly amount in US dollars, and the currency.
A paid year: the same plan and amount, plus a transaction id made from the plan and the paid-until time. It does not include your card or your email. Returning from the payment page does not count as a paid year by itself.

Google may use this data under its own terms. We do not sell personal information.

Pages also load type from Google Fonts. That request includes your IP address and happens whether or not you accept the tag.

Who else receives data

Stripe processes the subscription, stores the card for the yearly renewal, and tells us the payment result. We do not receive the full card number.
The mail server that sends login links and change notices receives the account email and the text of that message.
Google receives the font request, and, after you accept, the analytics and ads data described above.
When hosted DNS publishing is on, Cloudflare receives the DMARC TXT and the authorization TXT for a domain you asked us to host.
A webhook you set receives the change notice you asked us to send.

How long we keep it

We keep the account, the sender list, and the hosted record while the account exists. Removing a domain deletes its mailbox, sender list, and hosted TXT. You delete your own CNAME. A login link expires after 15 minutes. The access code in that tab expires after 12 hours. The consent choice stays in this browser until you change it or clear site data. Aggregate XML is discarded after the sender list is saved.

This browser

The consent choice is stored in this browser under sender-identity-consent, as granted or denied. The last audit stays in this browser and is not stored on the server. The access code, the checkout note, and the list of domains already counted for a measurement event stay in that tab.

Your rights

If the GDPR or UK GDPR applies, you can ask to access, correct, delete, or restrict your personal data, and you can object or ask for a copy you can take with you. Write to privacy@finmail.com or to the EU or UK representative above. You can also complain to the Irish Data Protection Commission or the UK Information Commissioner’s Office.

We use the account, the subscription, the report mailbox, and notices to provide the service you asked for. We use a free audit to answer the lookup you submitted, and we do not keep that result on the server. Analytics and Google Ads run only if you accept.