Privacy Policy

1. Introduction

1.1. Overview

This Privacy Policy describes how Demi Solutions OÜ ("we", "us", or the "Company"), located at Sepapaja tn 6, 15551 Tallinn, Harju maakond, Estonia, collects, uses and discloses information about you when you use DemiSignal at demisignal.com and the services, features and content we offer (the "Services"). Demi Solutions OÜ is the data controller for the personal data described here.

1.2. Information Sources

We receive information about you: (i) when you register for an account; (ii) when you use the Services; and (iii) automatically from your device and browser as you interact with the Services.

1.3. Consent and Legal Bases

We process personal data only where we have a legal basis to do so (see Section 9.4). Where the law requires prior opt-in for affiliate-referral cookies — for example in the EU/EEA — we ask for your consent through a cookie banner before setting them, and you may withdraw it at any time (see Sections 4 and 10). Where prior opt-in is not required — for example in the United States — we set that first-party functional cookie on a disclosed basis, without a banner. Product analytics and error monitoring rely on our legitimate interest and run without a banner, as described in Section 3.9; you can object as described there.

1.4. International Processing and Transfers

We are based in Estonia (EU). Your information may be processed by us or by our service providers in countries outside the European Economic Area. Where that happens, we rely on an adequacy decision or on EU Standard Contractual Clauses to safeguard the transfer. See Section 5.5 for the categories of service providers involved.

2. Scope of This Privacy Policy

This Privacy Policy covers our treatment of information gathered when you use or access the Services. It does not apply to third-party websites or services we do not own or control, including any sites you reach through the Services. We encourage you to review the privacy policies of those third parties.

3. Information We Collect and How We Use It

3.1. Account Information

When you create an account we collect personal information such as your name and email address. If you register or sign in using a third-party login — Google or Microsoft — we receive your name and email address from that provider, according to your settings with them, so we can create and secure your account. We use your contact information to operate your account and to send you service-related messages. You can manage marketing messages from your account settings.

Children: Our Services are not directed to children. Under Estonian law the digital age of consent is 13; we do not knowingly collect personal data from children under that age, and we will delete such data if we learn we have collected it.

3.2. Domain Scans

A core feature of DemiSignal is scanning the email-authentication setup of domains you submit. When you run a scan we collect and store the domain name you submit and the public DNS records we retrieve for it — including your SPF, DKIM, DMARC and MX records. Scans run before 26 September 2026 also hold the domain-blacklist status we checked at the time. For each record we store the raw value returned by DNS, our parsed interpretation of it, and any configuration issues we detect, together with an overall health score, an issue count, and the time each scan started and completed. When you are signed in, this information is associated with your account, workspace and the domain (project) it belongs to. The DNS records we collect are published by you (or your DNS provider) in the public Domain Name System; we retrieve them the same way any receiving mail server would.

3.3. Monitoring and Alerts

If you enable monitoring for a domain, we store your monitoring configuration — such as how often we re-scan the domain, whether alerts are enabled, and any additional recipient email addresses you choose to notify — and we re-run scans automatically on that schedule. When a scan detects a new or critical issue, a drop in your health score, or a failed scan, we generate an alert record (its type, a summary message, and related context) and may email it to the address associated with your account or workspace and to any additional recipients you have configured for that domain.

3.4. Free Domain Checker

The free checker uses the domain you enter and its public DNS records to check email authentication. We keep scans for 180 days. Anyone with a shareable report link can view that scan without an account or another email submission.

When you select “Email me this report” and accept the Terms and Privacy Policy, we open the full report in your browser and send one requested transactional email with a link to that saved scan. We keep your email, checked domain, report details, campaign information and referring website when available, and whether you stopped follow-up emails. Before we accept the request, Cloudflare Turnstile checks that it comes from a person; Cloudflare receives your IP address and browser signals for that check. Submitting an email does not create an account or prove ownership of the domain. Postmark processes the recipient address and report email to deliver this requested service. The private link expires after at most 7 days, or earlier if the report or receipt expires or is deleted. Anyone you forward the link to can view the snapshot until it expires or is revoked. Public share links remain public. Opening a public share link never starts follow-up emails.

The checker form also tells you that we send a few short follow-up emails on fixing the domain you checked. They start only when you open the report link we email you: the report page records that it was viewed in a browser (the time, your browser type and a keyed fingerprint of its user-agent string), and automated link checkers do not count. Nothing is sent if you never open it. Once it is opened, we pass your email address, the checked domain, its main finding and how you found the checker to our own email scheduling system, which sends a few emails over about two weeks through Postmark. Before each email we check the domain's public DNS records again, so the email reflects what is published now and is skipped when it has nothing useful to say. Every email has an unsubscribe link, and unsubscribing there also stops them here; you can also stop them from your report page or by contacting support@demisignal.com. These emails stop if you create a DemiSignal account. Requests made while the checker offered a separate optional box keep the choice made then: an unticked box never receives these emails. Permission given under an earlier version of this notice keeps the scope you accepted at the time and is never widened: earlier permission for DemiSignal monitoring and product updates remains limited to that purpose, and permission given while the notice also named DemiEmail guides and offers covers only what that notice said.

We keep these details for 180 days from submission, or delete them earlier on request. To access or delete your data, or stop follow-up emails, contact support@demisignal.com using the rights process in Section 9.2. We may ask you to confirm that the email address belongs to you before sharing or deleting personal information. Account and billing records have their own retention policies.

3.5. Product Analytics

We record checker stages under a random journey identifier, without email addresses, domain names or private link tokens in those events. Known internal and test traffic is classified separately; anonymous traffic remains unknown. Private emailed-report links load analytics only after link validation. Private report addresses are redacted from analytics events, including remembered entry URLs. Known internal and test report traffic is excluded, and existing analytics opt-outs still apply.

We send selected product milestones to PostHog under a pseudonymous identifier derived from your account, such as completing registration, adding your first project and completing your first domain check. Those milestone events do not include your submitted domain names, DNS records, scan findings, report content, name or email address. PostHog also records the pages you visit in DemiSignal, including their addresses, and the text of buttons and links you click. It does not record what you type into forms. Section 3.9 describes the shared analytics, the pseudonymous account identifier and how to object.

3.8. First-Party Usage Analytics

To understand how the Services are used and to improve them, we record page views on our own servers. For each page view we may store the page URL and path, the referring page, any campaign (UTM) parameters in the URL, a coarse device type (desktop, mobile or tablet) inferred from your browser, your IP address, your browser user-agent, the time of the view, and — if you are signed in — your account identifier. We do not sell this data or share it with advertising networks. Legal basis: our legitimate interest in measuring and improving the Services (Section 9.4).

3.9. Product Analytics and Error Monitoring

Where this product uses PostHog, it runs automatically on our pages and in the app. PostHog stores a random identifier in a first-party cookie and local storage so it can recognise your browser on later visits. It records the pages you view, clicks and other interactions with page elements, the referring page, campaign (UTM) parameters, browser and device information, and an approximate location derived from your IP address. Requests are routed through our own domain. Session recording is off.

When you are signed in, we link this activity to your account using a pseudonymous identifier derived from your account; we also send your current plan and sign-up date. We do not send your name or email address to PostHog. We also report business milestones from our own records, such as registration, setup steps and payments (amount and currency, including tax), under the same pseudonymous identifier. Billing records remain our authoritative financial record.

We use Sentry to monitor errors. When something fails, Sentry receives technical details about the error, the page or request involved, your browser and your IP address, and, if you are signed in, your account identifier and email address so we can investigate problems you report. Session replay is disabled.

Legal basis: our legitimate interest in understanding how the Services are used, improving them and keeping them working (Section 9.4). You can object at any time by contacting support@demisignal.com. You can also block or delete cookies and site data in your browser, or use a tracker blocker; the Services keep working. We continue to honor analytics refusals recorded by earlier versions of our website.

3.10. Affiliate / Referral Tracking

We operate an affiliate (referral) program. When you arrive through an affiliate link — a URL containing a ?ref= parameter (and optionally ?subid=) — we record a referral visit and set a single first-party cookie (app_visitor) holding a randomly-generated, per-browser identifier. For each visit we store on our servers: the affiliate referral code and sub-identifier; that visitor identifier; your IP address; the full URL you landed on; the referring website, if any; and the date and time. The referral code itself is not stored in a cookie — only the visitor identifier is. Where prior cookie consent is required (see Section 10), we record nothing until you accept.

Referral visits start out tied only to that per-browser identifier, not to your name. If you later create an account after arriving through an affiliate link, we link those earlier visits — including the IP addresses and URLs captured at the time — to your account so we can attribute the referral and calculate affiliate commissions. Because of this linkage we treat referral-visit data as personal data. We reconstruct the referring affiliate on our own servers from the most recent affiliate visit tied to your app_visitor identifier (a "last-touch" model); the referral source is not stored in the cookie. The app_visitor cookie lasts 60 days — that is the window during which a later sign-up can be matched to an earlier affiliate visit — while the underlying visit records are retained for the longer period described in Section 9.3 for commission calculation and auditing. Legal basis: our legitimate interest in operating and auditing the affiliate program; where prior cookie consent is required (see Section 10), we also rely on your consent for the app_visitor cookie (see above).

4. Cookies

Cookies are small pieces of text stored by your browser. We keep our cookie use minimal:

Cookie	Purpose	Essential?	Lifetime
Session cookie	Keeps you signed in and protects against request forgery.	Yes (always set)	7 days
app_visitor	Per-browser identifier that links your affiliate referral visits and, if you register, ties them to your account for referral attribution. Set only when you arrive via an affiliate (?ref=) link.	Functional	60 days
ph_<project>_posthog	PostHog analytics: random browser identifier, and your pseudonymous account identifier once you sign in (Section 3.9). Also kept in local storage.	Analytics	1 year
ds_analytics_enabled_v2, ds_analytics_consent_v1 (legacy)	Set only by earlier versions of our website; read to keep honoring an analytics refusal made there.	Preference	Up to their original expiry
app_cookie_consent	Remembers your cookie choice. Only used where we show a consent banner (see Section 10).	Functional	1 year

We do not use advertising cookies. Strictly-necessary cookies are always set. The app_visitor cookie is a first-party functional cookie; where the law requires prior consent (Section 10) it is set only after you accept. You can disable or selectively block cookies in your browser settings, and clear this site's stored data. Blocking essential cookies may prevent sign-in or other core features; blocking analytics cookies does not.

5. Information Sharing

5.1. What Is Not Public

Your account, the data you create in the Services, and your usage and referral information are private to your account by default and are not published or made publicly browsable by us.

5.2. IP Addresses

We store IP addresses (for example on referral visits and request logs) for security, fraud prevention and affiliate attribution. We retain them in raw form on our own servers; we do not currently hash them and we do not share raw IP addresses with third parties for their own purposes.

5.3. Service Providers

We share information with service providers who perform tasks on our behalf and under our instructions, only as needed to provide the Services. They may not use it for any other purpose.

5.4. Business Transfers

If we are involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction; the recipient will remain bound by this Privacy Policy or provide equivalent protection.

5.5. Categories of Service Providers (Sub-Processors)

We use service providers in categories including: cloud hosting and infrastructure; authentication (Google, Microsoft); transactional email delivery; backup storage; and payment processing. We can provide the current list of named sub-processors on request.

5.6. Legal and Protection

We may access, preserve and disclose information where we reasonably believe it is necessary to comply with law or legal process, to enforce our terms, to detect or prevent fraud or security issues, or to protect the rights, property or safety of the Company, our users and the public.

5.7. With Your Consent

We share information as you direct, such as when you choose to share content through a third-party service.

6. Information Protection

Your account is protected by a password; keep it confidential. We use industry-standard security measures to protect personal data, but no method of transmission or storage is completely secure. If we become aware of a breach affecting your personal data, we will notify you as required by applicable law.

7. Your Choices

You can use parts of the Services without an account, which limits the information collected about you. If you have an account, you can access and update your information from your account settings, and you can delete your account at any time. When you delete your account we anonymize the email address on your account, disconnect any linked sign-in providers, and erase the referral-visit data (IP addresses and URLs) linked to you. We may retain limited records where we have a legal obligation or a legitimate need to do so (for example, commission and billing records), as described in Section 9.3.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes to how we collect or use personal data, we will notify you by posting a notice in the Services or by email, and we will indicate when the changes take effect.

9. Your Rights and Data Retention

9.1. Your Rights

Depending on your location, you have rights over your personal data, which may include:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your personal data
• Restriction — request that we limit how we process your data
• Portability — receive your data in a machine-readable format
• Objection — object to certain processing
• Withdraw consent — withdraw consent at any time, without affecting prior processing

9.2. Exercising Your Rights and Complaints

To exercise any of these rights, contact us at support@demisignal.com. We will respond within 30 days. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or with your local EU supervisory authority.

9.3. Data Retention

We keep personal data only as long as necessary for the purposes described here:

• Account data — while your account is active; your sign-in email is anonymized on deletion
• Affiliate referral-visit logs (IP, URL, referrer, visitor id) — up to 13 months from the visit, then deleted
• Affiliate referral and commission records — for the life of the referral relationship plus the period required for commission and financial-record obligations
• First-party usage analytics — retained for a limited period and then deleted or aggregated
• PostHog analytics and Sentry error reports — for the retention period configured with each provider, and deleted earlier on request
• Marketing communications — until you unsubscribe

9.4. Legal Basis for Processing (GDPR)

• Contract — processing necessary to provide the Services to you
• Consent — where you have given specific consent, such as for non-essential cookies
• Legitimate interests — for security, fraud prevention, affiliate attribution and product improvement, balanced against your rights
• Legal obligation — where the law requires it

10. Cookie Consent

Strictly-necessary cookies are always active. Where the law requires prior opt-in for non-essential cookies (for example, in the EU/EEA), we show a cookie banner and set the affiliate app_visitor cookie — and record the referral visit in Section 3.10 — only after you choose "Accept all"; if you choose "Essential only" or ignore the banner, neither is set. Where prior opt-in is not required (for example, in the United States), the app_visitor cookie is a first-party functional cookie set with the disclosure in this policy. In all cases you can delete the cookie through your browser at any time.

PostHog analytics is separate from affiliate tracking and the cookie banner, and runs as described in Section 3.9.

11. Questions or Concerns

If you have any questions or concerns about privacy, contact us at support@demisignal.com.

Company Details: Demi Solutions OÜ Sepapaja tn 6 15551 Tallinn Harju maakond Estonia