Privacy notice

Last updated: 8 November 2026

Who we are

Spoofmark is a trading name of Averlane Systems Ltd, registered in England and Wales, company number 17556191, registered office 128 City Road, London, EC1V 2NX. In this notice "we" and "us" mean that company. We are the controller of the personal data described here, except where this notice says we act for a customer.

For anything about your data, email hello@spoofmark.com or write to us at the registered office. We are registered with the Information Commissioner's Office, registration number ZC291593.

What this notice covers

How we handle personal data when we check a company's email domain and write to it, when you ask us for a free check, when you write to us, when you become a customer, and when you visit spoofmark.com.

What we collect, and where it comes from

From the Companies House register: a company's name, number, registered office and type of business. This is information about companies rather than people.
From search engine results: the address of the company's website.
From the company's own website: one general contact address it publishes, such as info@ or enquiries@, and nothing else from its pages. We do not keep named staff addresses: a company that publishes only named addresses is recorded as having no general address, and we do not contact it. Our contact check page, spoofmark.com/contact-check, explains the visit.
From public DNS: the domain's email records. These describe mail servers, not people.
From you, if you ask for a free check: the email address and the domain you give us.
From you, if you write to us: your name, your email address and what you write.
From you and from Paddle, if you become a customer: your name, your work email address, the domains on your plan and the details of your order. We never see your card details.
From email providers, for customers' domains: DMARC reports listing the servers that sent email using the domain, with counts and results. These are mostly about organisations' servers, but an IP address can sometimes relate to a person.
When you visit spoofmark.com: our hosting provider keeps standard server logs, such as IP address and browser type, to keep the site secure.

Why we use it, and on what basis

To tell a company what we found about its email domain and offer our service. Basis: legitimate interests. A short, factual note about a gap in a company's own domain, sent once to the general address it publishes, with an immediate way to opt out, is something a business can reasonably expect. We have weighed this against the interests of the people involved and recorded the assessment, and you can ask us for a copy.
To send a free check you asked for. Basis: taking steps at your request before a contract.
To answer your messages. Basis: legitimate interests.
To provide the service, including reports and alerts. Basis: our contract with the customer. Where DMARC reports about a customer's domain contain personal data, we process it on the customer's behalf, as their processor, under our terms.
To keep accounting and tax records. Basis: legal obligation.
To keep the website secure. Basis: legitimate interests.
To keep a list of the addresses and domains we must not write to, because they asked us to stop or our messages bounced, so that we never contact them again. Basis: legitimate interests.

Who we share it with

Service providers who run our email, our website and our DNS, who provide search results, and who provide the software we use to sort and answer messages. They act only on our instructions.
Paddle (Paddle.com Market Limited), our reseller and Merchant of Record, which handles orders, payments, VAT and refunds as a controller in its own right. Its privacy notice is at paddle.com/legal/privacy.
Professional advisers, such as accountants and lawyers, where we need their help.
Authorities, where the law requires it.

We do not sell personal data, and we do not share it for anyone else's marketing. You can ask us for a list of our current service providers.

International transfers

Some of our service providers process data outside the UK, including in the United States. Where they do, the transfer relies on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, for providers certified under it) or on the ICO's International Data Transfer Agreement or its Addendum to the EU standard contractual clauses.

How long we keep it

Companies we have written to that did not become customers: deleted 12 months after our last contact.
Our do-not-contact list: kept permanently, holding only the address or domain, the date and the reason it was added, such as "asked us to stop" or "message bounced", so that we never write again.
Messages you send us: kept while we deal with them, and deleted no later than 12 months after our last contact, unless you become a customer.
Free check requests: deleted 12 months after the check.
Customer records: kept while the plan runs, and accounting records for six years after it ends.
DMARC report data: kept while the plan runs, and deleted within 90 days after it ends.
Server logs: kept by our hosting provider for a short period, for security.

Your rights

You have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict how we use it, to object to our using it, and, where we rely on a contract or your consent, to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time. You can object to direct marketing at any time and we will stop: reply "unsubscribe" to any email from us. We reply to requests within one month.

If you are unhappy with how we handle your data, please tell us. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Automated processing

We use software to check DNS records and to sort the messages we receive. We do not make decisions about people based solely on automated processing that have legal or similarly significant effects on them.

Security

Access to personal data is limited to the accounts that run the service, which use two-step sign-in, and data travels over encrypted connections.

Cookies

spoofmark.com does not use advertising, analytics or tracking cookies. Our hosting provider may set a cookie that protects the site from abuse, and Paddle's checkout sets the cookies it needs to take payment.

Changes

If what we do with personal data changes, we will update this notice and the date at the top.