Privacy Policy

Information Collection and Use

Account Information: When you create an account, we collect certain personal information, including your name, email address, and any other information you choose to provide.

Log Data: We may also collect information that your browser sends whenever you visit Seatbelt Security. This log data may include information such as your IP address, browser type and version, the pages you visit, the time spent on those pages, and other statistics.

Cookies: We use cookies to personalize your experience, analyze usage patterns, and improve the overall functionality of Seatbelt Security. You can control the use of cookies at the individual browser level, and you can change or withdraw your analytics-cookie consent at any time using the “Cookie settings” control shown on the site.

DMARC Report Data: When you enable DMARC monitoring for a domain you control, mailbox providers send us aggregate DMARC reports about email claiming to come from your domain. To show you who is sending on your behalf, we process and store data contained in these reports, including the IP addresses of sending mail servers (which may belong to third parties) and the “header-from” domains observed. This information relates to email senders rather than to you, and we use it solely to provide your domain's authentication dashboards and reports.

Product Usage Data: While you use the app, we record which pages and setup steps you use (tied to your account) so we can tell where customers get stuck and improve the product. This is separate from the Rybbit website analytics described below, and is not shared with any third party.

Information Sharing and Disclosure

We will not sell, trade, or otherwise transfer your personal information to third parties without your consent, other than the service providers listed below, each of which processes data only to perform its stated function for us.

Service Providers / Subprocessors

To operate Seatbelt Security we rely on a small number of trusted third-party providers that process data on our behalf. We only share the information needed for each provider to perform its service, and each is bound by its own data-protection terms.

• Hetzner Online (Germany): Cloud server hosting and infrastructure where our application and database run.
• Google Cloud DNS: Hosting of DNS records used to set up and delegate your email authentication (SPF, DKIM, DMARC).
• Google Firebase Authentication: Handles sign-in when you use a social login (e.g. Google) instead of a password.
• Google Gemini: Categorizes the sending servers named in your incoming DMARC reports (their IP addresses, hostnames, and reporting organization) so we can tell you whether a sender is a known service.
• Microsoft Graph API: Reads DMARC aggregate reports from the mailbox we operate for that purpose, and powers the optional Microsoft 365 connection you can use during setup.
• Your DNS provider: If you connect a DNS provider (e.g. Cloudflare, GoDaddy, Google Cloud DNS) during setup, we send it the DNS record changes needed to protect your domain, using the access you grant.
• Resend, or SMTP (including Microsoft 365): Delivery of transactional emails such as account verification, alerts, and reports — sent via Resend, or via SMTP (which may be routed through Microsoft 365 or another mail server), depending on how we've configured email delivery at the time.
• Rybbit Analytics: Self-hosted website analytics that records individual visit events (not just aggregate totals) to help us understand how the site is used. You can opt out at any time using the “Cookie settings” control.

Data Security

We implement a variety of security measures to ensure the safety of your personal information when you enter, submit, or access your personal information. However, please note that no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

Data Retention

We retain your account information and the data associated with your domains for as long as your account is active and you need the service. You can delete a domain at any time, which permanently removes that domain's associated data from our systems, including its scan results and stored DMARC report data. When you close your account, we delete the personal information associated with it. One exception: the internal DNS labels we generate to route your domain's protection keep the domain name attached even after deletion, so that label can never be reused for a different account.

We keep DMARC report records, report intake details, and held reports for up to 400 days from receipt. Some held reports are removed sooner. We also remove sender IP classifications when no kept report uses them. After 400 days, we remove processed report emails we can identify from our Microsoft 365 mailbox when mailbox permissions allow it. If permanent deletion is unavailable, they move to Deleted Items and Microsoft 365 purges them under the mailbox policy.

We may retain limited information for longer where required to comply with legal obligations, resolve disputes, or enforce our agreements. Rybbit analytics records individual visit events (see Subprocessors above), not just aggregate totals, and you can opt out of analytics cookies at any time.

Your Choices

You have the right to access, update, correct, or delete your personal information. You can download a copy of your data and delete your account yourself at any time from Settings, or contact us using the contact information provided below.

Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Any changes will be effective immediately upon posting on this page. We encourage you to review this Privacy Policy periodically to stay informed about our information practices.

Contact Us

If you have any questions or concerns about this Privacy Policy, or want to access, export, or delete your data, please contact us at support@seatbeltsecurity.com, (831) 277-3525, or visit our contact page.