Privacypolicy.

What we collect

Account data you give us: your email address, name if you provide one, and time zone. Monitoring data we generate on your behalf: the domains you add, DNS records we resolve for them, blacklist query results, DMARC aggregate reports sent to your reporting address, and inbox placement results from our seed network.

We do not read your mail. Mailbox connections, where you grant them, are used to send and retrieve seed test messages only.

Your data never trains AI models

This is worth stating plainly because it is not the industry norm. Vitals reads your account context to answer your questions about your own domains. That context is not retained for training, not shared with model providers for training, and not pooled with other customers’ data.

Credentials

Mailbox credentials and OAuth tokens are stored encrypted in a secrets vault, never in plain database columns, and are used only to perform the checks you asked for. You can revoke any connection at any time, which deletes the stored secret.

How long we keep it

Monitoring history is retained while your account is open, because trends are the product. Raw DMARC XML is pruned on a rolling schedule. When you delete your account, everything cascades — including vault secrets and stored report files.

Your rights

You can export your data or delete your account from your settings, without contacting us. Deletion is real deletion, not deactivation.

Cookies

We use what is necessary to keep you signed in, plus privacy-respecting product analytics to understand which parts of the product work. You are asked before any non-essential cookie is set.

Contact

Questions about any of this: hello@mailvitals.com.