Who we are
Leadify SecureMark ("SecureMark", "we", "us") is a DMARC monitoring service run by Leadify (Pty) Ltd, a South African company with registration number 2016/455880/07. We are the responsible party for the personal information described here, as defined in the Protection of Personal Information Act, 2013 (POPIA).
You can reach our Information Officer, and anyone else at Leadify about privacy, at support@leadify.biz.
What we collect
Your account
Your email address, the names of the organizations you belong to, your role in each and when you last signed in. Your password is held by our sign-in provider, Auth0; we never see or store it.
Your team, and the people you ask us to email
The email addresses of people you invite, whether they accepted, and a record of changes to your organization's members and their roles. We also keep the addresses an owner or admin adds to receive your organization's monthly report, and the address of anyone you ask us to email your DNS record to, with the message you add.
Your domains
The domains you add, and the DNS records we look up to check your DMARC, SPF, DKIM, MTA-STS, TLS reporting and BIMI setup.
DMARC aggregate reports
When your DMARC record lists our reporting address, email providers such as Google and Microsoft send us daily reports about mail that used your domain. These list the IP addresses of the servers that sent it, how many messages each sent, the domains it used and whether it passed SPF, DKIM and DMARC. They don't contain the content of messages or the addresses of the people they were sent to. For each sending server we also look up its reverse DNS name, country and network operator.
DMARC failure reports
Some providers send a failure report when a message using your domain fails DMARC. These can include the message's headers, such as sender and recipient addresses and subject lines, and sometimes parts of its content. We don't ask for them, and we don't process them or show them in SecureMark. The DMARC record we used to recommend listed our address for them, so domains set up earlier may still send them until that address is removed; your domain's settings page shows the updated record.
Your plan
Your organization's plan and its history. If you move to a paid plan, we keep its invoices, and card payments will be processed by PayFast, so we never receive your card details.
Technical information
Our servers log errors and warnings so we can keep the service running. These logs can include IP addresses and the pages requested.
How we use it
- To run SecureMark: collect and analyze your reports and show you who sends email as your domains.
- To send you the email you've asked for, such as digests, alerts and monthly reports, and the email the service needs, such as sign-up confirmations and invitations. You can turn digests, alerts and monthly reports off from the "Your emails" page, and every one of them has a link to unsubscribe.
- To keep the service secure, fix problems and answer your support requests.
We don't sell your information, and we don't use it for advertising.
Who we share it with
We use these service providers, who process information for us:
- Auth0, for sign-in.
- Postmark, to deliver the email we send.
- Xero, for invoicing and accounting.
- PayFast, to process card payments, if you move to a paid plan.
- The hosting provider that runs our servers and database.
Our pages also load fonts and styles from Google Fonts, jsDelivr and cdnjs (Cloudflare). Your browser contacts them directly, which gives them your IP address and browser details.
Some of these providers process information outside South Africa, under their own data protection terms.
We also share your email address with people when you ask us to: with the owners and admins of another organization if you ask to join it, with whoever you ask us to email your DNS record to, and with the members of organizations you belong to. We'll disclose information when the law requires it.
How long we keep it
- Account and team information: while your account is open. When an owner deletes an organization, its domains, report data, team and settings are deleted straight away; emails we've already sent are kept. To have your own account deleted, email support@leadify.biz.
- DMARC report data, and the report files it came from: 400 days (about 13 months) from the start of the period each report covers, then we delete it. If your plan shows more history than that, we keep it for as long as your plan shows.
- Server logs in our database: 90 days.
- Invoices and other billing records: as long as South African tax law requires.
How we protect it
Everything you send to SecureMark and everything we show you travels over encrypted connections. Only members of your organization can see its domains and reports, and someone removed from an organization loses access within a minute. Links in our emails, such as confirmation and unsubscribe links, use random tokens rather than anything that could be guessed. Only staff who need it to run the service can reach our servers and database.
Cookies
We only use cookies the service needs to work:
- A sign-in cookie that keeps you signed in, and cookies Auth0 sets on login.leadify.biz while you sign in.
- A session cookie that remembers the address we sent your confirmation email to while you sign up.
- A cookie that remembers a domain you checked with our free domain check, for 30 days, so it's ready to add once you've signed up.
- A security cookie that protects forms against cross-site request forgery.
We don't use analytics or advertising cookies.
Your rights
You can ask us what personal information we hold about you, and ask us to correct or delete it. You can also object to how we use it. Email support@leadify.biz and we'll respond within 30 days.
If you're not happy with how we've handled your information, you can complain to the Information Regulator (South Africa) at inforegulator.org.za.
Changes to this policy
When we change this policy we'll update the date at the top. If a change affects how we use your information, we'll email the owners of each organization before it takes effect.
Contact
For anything else about this policy, email support@leadify.biz. See also our terms of service.