Privacy policy

How Emailmetry handles information from its website, free tools and hosted SPF service.

Emailmetry is operated by Sahelay Pty Ltd (ACN 663 844 095, ABN 59 663 844 095) of 27/44 St Georges Terrace, Perth WA 6000. This policy covers the marketing website and, when you use it, the Emailmetry account and SPF flattening service. Personal information is information about an identified or reasonably identifiable person.

Version 2026-09-27 · Updated 27 September 2026

Our role

We decide how to use website, account, billing, security and support information to run our business, and act as its controller under European privacy law. For personal information a Business Customer puts into the hosted service for its own purposes, such as client contact details, domain assignments and support content, that customer is the controller and we act as its processor under our data processing addendum.

Why we use information

• Providing the service: sign-up, accounts, sign-in, domain management, service and renewal notices, and support. We rely on performing our contract with you or your organisation, or on our legitimate interest in serving the organisation you work for.
• Billing and records: orders, renewal choices, payment status, and tax and accounting records. We rely on performing the contract and on legal obligations.
• Security and misuse prevention: multi-factor sign-in, rate limits, audit records, spam checks on our forms and preventing repeat free trials. We rely on our legitimate interest in protecting users and the service, and on legal obligations where they apply.
• Answering enquiries: contact form messages and emails. We rely on our legitimate interest in responding, or on steps you ask for before entering a contract.
• Launch notifications: where you registered before launch, we rely on your consent, which you can withdraw at any time.

You may object to processing based on legitimate interests. Account and billing details are needed to provide the service; without them we cannot open an account or process an order. We do not use personal information for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Some routine account controls are automatic: repeated failed sign-in attempts lock an account for a short period, a card already used for a free trial cannot start another, a free trial ends after 14 days, after which domains beyond any annual licences are billed monthly, and domains cannot be added beyond paid cover. Stripe screens card payments for fraud automatically and may decline a payment it assesses as high risk.

Account and service information

You can sign up for an Emailmetry account yourself or be invited by your organisation, MSP or reseller. When you sign up, we collect your company name, your name and your work email address, and email you a single-use verification link that expires after 24 hours; we create the account only after you use it. We record the versions of our Terms of Service and privacy policy you accept and when you accepted them. When you are invited, we receive your name, work email address and role from the person who invites you. We keep your organisation and role, invitation and sign-in dates, multi-factor enrolment date, account status and audit records of significant account and domain actions. Support is provided by email to support@emailmetry.com, and those messages are kept in our support inbox and support ticketing system.

To provide SPF flattening, we process the domains, current public SPF records, selected sending providers, proposed and published policies, validation results and change history associated with your account. Domain names and published DNS records are public; account associations, support conversations and access logs are not necessarily public. We do not need your DNS provider password or API key and do not relay or read your email messages.

Sign-in uses your email address, a password and a required authenticator app code. Supabase, our identity provider, holds your email address, password hash and authenticator factors. It receives your IP address with sign-in, invitation, password reset and authenticator requests, and uses it to limit repeated attempts and in its security logs. We keep IP addresses only as keyed one-way digests that expire, for rate limiting. Our application logs exclude IP addresses and email addresses; database logs of slow queries may occasionally include an email address. Only authorised staff who need it for support or security can access your account, and staff actions are recorded in our audit logs.

The portal sets three cookies: a sign-in session cookie that expires after 12 hours, a short-lived cookie that links the steps of a sign-in, invitation or password reset, and, only if you choose an appearance setting, a cookie that remembers it for one year. The portal has no analytics, advertising or tracking scripts. We use safeguards including multi-factor sign-in, access controls and encryption, but no system is risk-free.

Billing information

If you buy a licence, we keep order, renewal, consent, subscription and payment status records, including the Terms version you accepted, to manage cover, collect fees, handle disputes and meet accounting obligations. Card purchases use Stripe’s hosted checkout. When you start a free trial, you add a card through that checkout, and the trial begins once the card is saved. Where Stripe’s Link service acts as merchant of record, it collects your payment and billing details, calculates and collects tax, and issues receipts and tax invoices under its own privacy terms. We receive payment identifiers and status, not your card number or security code. To identify repeat free trials, we keep a one-way digest of the card fingerprint Stripe provides, with our billing records. If we agree to invoice your organisation, we keep the invoice email address it gives us.

Launch notifications

Before Emailmetry launched, people could register for a launch notification. SMTP2GO delivered those requests to our sales inbox. We keep each address until we send the launch notification, then delete it unless you become a customer or ask us to keep in touch. To remove your request sooner, email support@emailmetry.com.

Contacting us

The contact form collects your name, email address, question type, message and any plan details you include. We use this information to answer your question.

SMTP2GO sends the message to support@emailmetry.com, or to sales@emailmetry.com for reseller enquiries. SMTP2GO and our email provider process the message for delivery. We keep delivered messages in our inbox to handle the conversation.

Form entries stay in the current page if sending fails. They are not saved in cookies or local storage. Your browser may offer its own autofill. Email links open your email application; you choose whether to send the message.

Using the DNS checkers and email service discovery

When you submit an SPF, DMARC or DKIM check, scan for email services, check a list of domains, or inspect lookup counts in the SPF planning tools, your browser sends the relevant public DNS names to Google Public DNS. The email DNS change checker sends the requested name to both Google Public DNS and Cloudflare’s public DNS service. These can include SPF references, parent DMARC names and the DKIM selector you supply. Each DNS provider receives your IP address as part of those requests. The tools read public records; they do not change your DNS.

Requests exclude browser credentials and the referring page. Results and working lists stay in the current tab and are not saved by the tools to cookies or local storage. Copying or exporting a result saves it only where you choose. A link can prefill a domain, selector or SPF record in the page URL; these values can appear in browser history and hosting request logs. A DNS lookup starts only when you choose a lookup action.

See Google Public DNS privacy information and Cloudflare public DNS privacy information.

Using the DNS propagation checker

When you choose Check DNS worldwide, your browser sends the queried public name and record type to Globalping. Globalping receives your IP address and shares the queried name with its distributed probes and their DNS resolvers. Globalping measurements and results are public and can be retrieved using their measurement ID. Do not enter private or confidential names. See Globalping / jsDelivr privacy information.

The checker requests 12, 24 or 48 probe lookups per run. Globalping applies request allowances to your connection. Expected record values stay in your browser and are not included in API requests. Requests omit browser credentials and the referring page. The checker does not save results in cookies or local storage; Globalping processes and retains measurement data separately. Cancelling stops this page from waiting for results, but does not cancel measurements already started at Globalping.

Building records and reading DMARC reports

Record drafting and DMARC report parsing run in your browser. Report files and pasted XML are not sent to Emailmetry or a DNS provider, and are not saved in cookies or local storage. The SPF planning tools query public DNS only when you request a DNS lookup or lookup-count check. The DMARC record generator does not query DNS. Use the clear control to remove report data from the page; exports save only where you choose.

Analysing email headers

The email header analyser processes pasted text entirely in your browser tab. It does not send the headers to Emailmetry, Google Public DNS or another service, and does not save them to cookies or local storage. The clear button removes the pasted text and results from the page. Copying results puts them on your clipboard only when you select that action.

If you follow a “Check this key” link, only the extracted signing domain and DKIM selector are placed in the checker page URL. They may appear in browser history and hosting request logs. The rest of the headers remain in the analyser tab.

Spam prevention

The contact form uses Cloudflare Turnstile. Cloudflare receives connection and browser information to check for automated submissions. Our server sends the verification token and your connection IP address to Cloudflare before accepting a message. See Cloudflare’s privacy policy.

The contact service temporarily holds IP addresses in memory to limit repeated submissions. It also keeps a hash of each submission and its delivery result for 15 minutes to help prevent duplicate messages.

Hosting, cookies and analytics

Vercel hosts this website and may process your IP address and request details to serve it. Email providers process connection and delivery information when you contact us.

Fonts and application scripts are served from this website. The contact page also loads Cloudflare’s Turnstile script and widget. No advertising pixels or analytics scripts are installed, and this website does not set cookies. It is not served through Cloudflare’s proxy, so Turnstile does not set Cloudflare’s clearance cookie here.

Who receives information

We share information only as needed with the providers below, our professional advisers and the organisation that administers your account. We may also disclose information when required by law or to protect users and the service.

• Amazon Web Services: application hosting, database, backups and hosted SPF records, in the United States (Oregon).
• Supabase: sign-in and multi-factor authentication, in the United States.
• SMTP2GO: delivery of service email, from its Australian region, and of website form messages.
• Stripe and Link: hosted checkout, payment processing and, where Link is merchant of record, tax, receipts and tax invoices, in the United States and other countries where they operate.
• Vercel: hosting of this website, in the United States and on its global edge network.
• Cloudflare: Turnstile spam checks on our forms, in the United States and on its global network.
• Google Public DNS, Cloudflare DNS and Globalping: lookups your browser sends from our free tools, as described above, on their global networks.
• Microsoft 365: our support and sales inboxes, in Australia.
• HaloPSA: our support ticketing system, which receives messages sent to our support inbox, in Australia.

We are based in Australia, and some providers process information in the United States or other countries where they operate. Where EU, EEA or UK law restricts a transfer, we rely on the standard contractual clauses, with the UK addendum where applicable, in our providers’ data protection terms, or on an adequacy decision or certification that covers the provider. Contact us for a copy of the relevant safeguards. We do not sell personal information.

Retention and your choices

We keep personal information while it is needed for the purposes above and to meet legal requirements:

• Account, domain, audit and billing records are kept while your organisation uses Emailmetry and afterwards for as long as needed for tax, accounting, audit and dispute purposes, which for financial records is generally at least five years. They are not deleted automatically when a licence ends, renewal is cancelled or a domain is removed. Ask us if you want them deleted.
• Application and database logs are kept for 30 days and database backups for 7 days. Supabase keeps sign-in and security logs, which include IP addresses, for a limited period.
• Rate-limiting records and sign-in steps expire automatically after a short period.
• Enquiries and support tickets are kept while needed to handle the conversation and any follow-up.

We handle access, correction and deletion requests manually, aim to respond within one month, and will explain the outcome, including any information we must keep. Deleted information may remain in backups until they expire.

You can ask for access to, correction of or deletion of personal information, or raise a privacy complaint, by emailing support@emailmetry.com. We may need to verify your identity and may be unable to delete records that we must keep. We will investigate complaints and respond with the outcome. If you remain dissatisfied, you may contact the Office of the Australian Information Commissioner where its jurisdiction applies. If you are in the EU, EEA or UK, you may also complain to your local data protection supervisory authority, such as the UK Information Commissioner’s Office. Depending on where you live, you may also have rights to object to or restrict processing, request data portability, or withdraw consent. We will assess requests under applicable law.

Updates and contact

We update this policy when our practices change and post the revised date here. If a change materially affects how we handle account information, we will notify account holders where required. For privacy questions or requests, email support@emailmetry.com or write to Sahelay Pty Ltd, 27/44 St Georges Terrace, Perth WA 6000. We have no establishment in the EU or UK. People in those regions can contact us directly at the same addresses, and we handle their requests under the rights described above.