Privacy & Cookie Policy

Last Updated: October 2026

Privacy Policy

1. Information We Collect

We practice strict data minimisation. We collect only what is necessary to provide DMARC monitoring and enforcement.

1.1 Information You Provide

• Account Information: Email address (used for magic-link login).
• Billing Information: Payment details are handled entirely by our Merchant of Record. We do not store your credit card information.
• Domain Names: The domains you add to your account.

1.2 Information We Collect Automatically (Aggregate Reports)

• RUA Reports: We receive daily machine-generated XML aggregate reports from mailbox providers (e.g., Google, Microsoft, Yahoo). These contain IP addresses, sender domains, message counts, and authentication results.
• No Mailbox Access: We never access your mailboxes, passwords, or private messages. We do not process forensic (RUF) reports, which can contain message samples.

2. How We Use Your Information

We use your information to:

• Provide Services: Parse reports, display sending sources, and calculate readiness scores.
• Alerts: Notify you of new senders, failure spikes, or DNS changes.
• Hosted Enforcement: If enabled, we use your settings to publish and host your DMARC CNAME record.

3. Subprocessors & Data Sharing

We do not sell your personal data. We share data only with the following subprocessors necessary to run the service:

• Cloudflare: Hosting, DNS, Workers (parser), D1 (database), R2 (raw storage), and Email Routing.
• Polar: Merchant of Record for billing.
• Transactional Email Provider (e.g., Resend/Brevo): For sending you magic links and weekly digests.

4. Data Security & Isolation

We take data security seriously:

• Cross-Tenant Isolation: Every database table uses an org_id. All queries enforce this context to prevent data leaks between organizations.
• Access Controls: Strict team access. Support access is read-only, time-limited, and requires your consent.
• No Secrets in Logs: We do not log sensitive tokens or session data.

5. Your Rights (POPIA & GDPR)

Depending on your location (including South Africa's POPIA and the EU's GDPR), you have the right to:

• Access: Request a copy of your personal data.
• Correction: Update inaccurate information.
• Deletion: Request deletion of your data (subject to legal obligations).
• Portability: Export your audit log and policy history.

To exercise these rights, contact us at privacy@fromple.com.

6. Data Retention

• Raw Reports: Deleted after 30 days.
• Aggregated Data: Retained based on your plan (30 days for Free, 90 days for Starter, 12 months for Agency).
• Account Data: Retained until you delete your account. If you cancel, you have 30 days to export your data.

Cookie Policy

7. What Are Cookies?

Cookies are small text files stored on your device. Fromple uses very few cookies, focused strictly on keeping you logged in securely.

8. How We Use Cookies

• Strictly Necessary (Sessions): We use HttpOnly session cookies. Because we use magic-link authentication, these cookies remember that you successfully clicked your email link so you don't have to log in on every page load.
• Security: We use Cloudflare Turnstile to prevent bots from abusing the free checker. Turnstile may set a cookie to verify you are human.

We do not use marketing, advertising, or third-party tracking cookies.

9. How to Manage Cookies

You can block or delete cookies through your browser settings. However, blocking strictly necessary cookies will prevent you from logging into the Fromple dashboard.