Privacy
mail.maib.io is operated by mAIb Tech LLC, a Delaware limited liability company, which is the controller of the personal data described here. Its registered address is 8 The Green, STE R, Dover, DE 19901, USA (the address of its registered agent). Write to support@maib.io about anything on this page. This page describes what the service actually does with data, in the order that matters.
Message headers are never uploaded
The header analyser runs entirely in your browser. The text you paste is parsed by JavaScript on your own device; it is not sent to this server, is not logged, and is not stored. Closing the tab disposes of it.
If you choose to attach the findings to a repair calculation, only derived, non-identifying values are sent: the SPF, DKIM and DMARC verdicts, the signing domain and selector, the visible From domain, alignment booleans and the receiving system's name. Email addresses are reduced to their domain before anything leaves the browser, the Message-ID token is discarded, and the message body is discarded before parsing begins.
Domain scans
When you scan a domain we store the normalised domain, the scan result, the rules that fired, the DNS evidence, the engine and ruleset versions, and the time. If you type an email address, only its domain is kept. This is what makes a result reproducible and what makes before-and-after comparison possible. Scans query public DNS resolvers run by Cloudflare, Google and Quad9, which see the domain being looked up.
We also store a salted hash of your IP address, used only for rate limiting. The address itself is not stored, and the hash cannot be reversed to recover it without the secret salt.
Scan results are private by default. A scan is only reachable by its own unguessable URL, results pages carry
noindex, and a shareable link exists only if you explicitly create one.
Payments
Payments are processed by Stripe. Card details are entered on Stripe's own checkout page and never reach this service. We store the Stripe session and customer identifiers, the amount, the currency, the status, and the email address Stripe collects, so that your purchase can be linked to your repair pack, so refunds work, and so the messages described under "Email" can be sent to it.
Payment records, including that email address, are kept for as long as the law requires accounting records to be kept, and are not removed when an account is deleted. Stripe's handling of your payment data is governed by Stripe's own privacy policy.
Accounts
Accounts are optional and exist only to give you a way back to purchases and to a Guard dashboard. We store your email address and a scrypt hash of your password, and a record of sign-in attempts against that address so that guessing can be limited. We never store the password itself. When you register, a single-use link to confirm the address is created; we record whether it was used. Confirming an address does not link any purchase to the account. You can delete your account at any time from the account page; deletion removes your sessions, sign-in attempt records and unused confirmation links, scrubs the email address and the password hash from the account, and cannot be undone. Payment records are kept, as above.
This service sends a small number of messages, each about something you did: the link to a Repair Pack you bought, a Guard welcome and Guard change summaries (at most one a day per domain, and you can turn them off), the links to your purchases when you ask for them on the "Lost your link?" page, and an account confirmation link. There is no newsletter and no marketing email.
Each message is written to our database before it is sent. We keep the address, the kind of message, the subject, and when it was sent or why it could not be. The message text, which contains your access links, is deleted 30 days after the message was sent or given up on. Email addresses are masked in server logs.
Messages are delivered by Resend, which receives the address and the message in order to deliver it.
Who processes data for us
- Stripe (payments): everything entered on the checkout page, under Stripe's own privacy policy.
- Resend (email delivery): the recipient address and the message.
Scans also query public DNS resolvers, as described under "Domain scans"; they see the domain, not you.
Analytics
First-party only. No Google Analytics, no third-party scripts, no advertising pixels, no cross-site
tracking. A random session identifier is held in your browser's sessionStorage so that a visit can
be counted as one funnel rather than several; it is not a cookie, it is discarded when the tab closes, and it is
not linked to anything identifying.
Event payloads are restricted by an allow-list to counts and short labels. Domains, email addresses, DNS record contents and header text are never placed in an analytics event.
Logs
Server logs record the request method, the path without its query string, the status, the duration and a random request id. Query strings are excluded because a scanned domain appears in one, and the private part of a repair pack, result, share, Guard or confirmation link in the path is masked. Log output passes through a redaction step that removes anything resembling an API key and masks email addresses.
Cookies
Four cookies are strictly necessary for something you asked for: a repair pack access cookie after a purchase, a Guard proof-of-purchase cookie after subscribing, a session cookie if you sign in, and a cookie that remembers your answer to the question below.
One is optional: an attribution cookie that records which campaign link brought you here (UTM parameters or an ad click identifier), kept for 30 days so a purchase can be credited to it. It is set only if you accept when asked, and you are only asked when you arrive on a campaign link. Rejecting changes nothing else about the site. No other advertising or analytics cookie is set.
Why we use it (lawful basis)
- Scans, rate limiting, security logs and first-party analytics: our legitimate interest in providing the scanner you asked for, keeping it available, and understanding how it is used in aggregate.
- Purchases and accounts, and the emails about them: performing the contract you entered into when you bought or registered.
- Payment records after the fact: our legal obligation to keep accounting records.
- Campaign attribution: your consent.
Retention
Repair packs remain accessible for 30 days from purchase. Scans are retained so that historical comparison works. Monitoring history is retained for the life of the subscription. Account data is kept until you delete the account. Email message text is deleted 30 days after sending; the delivery record stays. To have data about a domain you control removed, write to support@maib.io.
Your rights
You can ask for a copy of the personal data held about you, and ask for it to be corrected, deleted or restricted, or object to how it is used, by writing to support@maib.io. If you are unhappy with the answer, you have the right to complain to the Information Commissioner's Office (ico.org.uk).
What we never do
We do not sell data. We do not share it with advertisers. We do not collect your DMARC aggregate reports —
those go to whatever address you put in your own rua tag, and this service is not it.
Questions about this page: support@maib.io.