Privacy & cookies

Service operator: NetGains Technologies Pvt Ltd. This notice describes the data handled by this application. Assessment policy and retention updated 27 October 2026. Read the public assessment terms for scope and acceptable use.

Business account information

Email registration stores your email address and a salted password hash; we never store your readable password or ask for your mailbox password. Verification and password reset emails are sent through the operator’s mail service using expiring, one-use links. Optional Google Workspace or Microsoft Entra sign-in supplies your provider identity, name and email. Registration also collects your company name, designation and phone number.

Websites and reports

We store the websites you submit, scan settings, timestamps, results and generated report files to provide your private report history. Reports may contain publicly rendered HTML, element selectors and URLs. Submit only websites you own or are authorised to assess, and avoid URLs containing confidential information.

When Website Health & Security checks are enabled, we also store DNS, HTTPS/TLS, certificate and registry observations. The registrable domain is sent to the official registry RDAP service to query public expiry information. URL paths, account details and portal cookies are not sent to that registry. The checks use public DNS resolution and public website endpoints.

Requested reports and renewal alerts

You can opt into monthly scans and daily certificate/domain expiry checks for your saved websites. We store your choices, permission confirmation, schedule, check timestamps and email submission records. Reports and alerts go to your verified account email through our configured mail service. Monthly emails may include a PDF attachment and a private report link. You can stop these emails in your account; they are separate from marketing consent. A deletion request pauses these subscriptions. Registry expiry is public evidence and may differ from the registrar renewal date.

Requested email tests

For private email-infrastructure tests we store your chosen sender address, message type, random receiving address, timestamps and report findings, including selected header evidence and the message subject. The portal parses test messages in memory and does not retain raw message bodies or attachments. The receiving SmarterMail server is a separate storage system: its operator must configure dedicated test-mailbox cleanup and appropriate retention. A test address has a one-hour reporting window; later messages are ignored by the portal. Reports follow the configured report-retention and account-deletion processes. Send only a harmless sample without passwords, OTPs, financial statements or confidential customer data.

Suspected email abuse complaints

Sender labels and complaint drafts are private to your organisation account. Preparing a draft sends the selected public IP to RIPEstat to find published abuse contacts. With your explicit approval, the portal sends the displayed complaint, technical observations, original email attachment and reply-to account email to the first listed abuse contact. Uploaded original emails may contain confidential or personal information: review them before sharing. They are encrypted in the portal and removed after 30 days; drafts and case records follow configured report retention. Deleting a local case or account cannot recall evidence already sent to a provider. SMTP acceptance does not establish delivery, investigation or takedown. Provider replies and references are recorded manually.

DKIM selector discovery

Automatic discovery checks a bounded list of likely selectors using public DNS and provider hints. For email/header uploads, the browser extracts the header section locally; the server processes DKIM-Signature fields in memory and discards the submitted headers. Only selected selector names, signing domains and public DNS observations may be retained in saved assessments. Discovery is incomplete, and key presence does not verify current use or message authenticity.

Email security and TLS reports

Private email-security assessments store DNS, public HTTPS policy, logo/certificate observations and inbound SMTP TLS evidence. Referenced public endpoints may receive requests from our server. TLS reporting uses the customer-specific RUA mailbox and the same bounded IMAP collection, or a manual JSON report upload. We store only matching-domain policy summaries, session counts, selected sending/receiving IPs, MX names and failure types; raw emails and original TLS attachments are not retained in portal storage. Optional per-domain email failure alerts go to your verified account for newly received reports after you enable them. They are separate from marketing consent and can be disabled. Reports are unverified receiver observations and do not establish an attack. Account exports, deletion and configured report retention include TLS reports and saved assessments.

DMARC receiving mailboxes

When you request dedicated reporting addresses, we store your domain, private RUA/RUF addresses, setup status and DNS observations. Generated mailbox credentials are encrypted server-side and excluded from account downloads. The receiving SmarterMail server stores received reports separately; its operator must configure retention and cleanup. RUF failure reports may contain message content and are requested only if you select that option. When enabled, secure IMAP collection downloads messages in memory and stores aggregate report results, limited failure-report metadata and processing checkpoints. Raw emails, original message bodies and failure-report original headers are not stored in the portal. Original mail remains in SmarterMail under the operator’s retention policy. Account deletion requires the operator to remove the remote reporting mailboxes and retire their local registrations first.

DMARC report uploads

Uploaded DMARC aggregate reports are parsed in memory. We store the reporting organisation, domain, report ID, reporting period, source IPs, message counts and authentication/disposition results in the private database. Original XML and compressed files are not retained. Reports are user-supplied and their authenticity is not independently verified. Visitor reports are accessible through the browser cookie and transfer to the account on sign-in. Account exports, deletion, backups and configured report retention include these records. You can also delete individual DMARC reports.

Email tools and provider connections

Public email tools send the queried domain or IP to DNS resolvers, registry services, certificate-log services or administrator-configured DNSBL providers. Pasted headers are parsed in memory and are not saved; downloads rerun public checks where stated. Saved email domains retain their DNS verification challenge and verification timestamp in the private database and are included in account exports, deletion and backups. Google Postmaster and server-intelligence requests require a fresh DNS ownership check and configured provider credentials. Domain names or resolved public IPs are sent to the selected provider. Provider results are returned for viewing/download without saving metrics in the portal. Administrator API credentials are encrypted at rest and are not returned to customers.

DNS and security monitoring

Optional hourly monitoring stores your verified domain, public DNS/security baseline, pending changes and alert history. Two consecutive changed observations create an in-app notification; optional email is sent to your account address. Optional browser push stores an encrypted browser subscription. Push providers receive encrypted generic alerts; detailed findings stay in the portal. You can disable browser push or pause monitoring at any time. Public DNS and registry queries are sent from the monitoring worker. Monitoring data is included in account exports and deleted with the account.

Cookies and sessions

Essential cookies identify an anonymous visitor browser and maintain signed-in sessions. They are HttpOnly, use SameSite=Lax and are Secure when the service is served over HTTPS. Sign-in sessions expire after at most 30 days and can be ended by signing out. Cookies may be deleted by your browser, so identification cannot be guaranteed. No advertising or analytics cookies are installed by this application.

Use of your information

We use account and contact details to operate the service, provide access to reports and respond to service requests. Marketing contact is optional and is recorded separately from registration. You can change your marketing preference in your account profile.

Storage and access

Customer information is stored in the service database. Reports are stored in private server folders and served only after an access check. Authorised NetGains administrators can view customer registration and website records. If network limits are enabled, a hashed network identifier is stored to prevent abuse. Report files are not publicly indexed.

Retention and requests

The current report-retention setting is 365 days. Eligible finished reports are removed during scheduled maintenance after their applicable retention cutoff, or earlier through authorised deletion. Some sensitive module records have shorter limits. Configuration, consent/access and audit records have separate operational lifecycles; this is not a promise to delete every record at the same age. Visitor-identification cookies expire after 30 days; this does not itself delete server records. You can download your account information and submit a deletion request from your account. Marketing consent is withdrawn when you request deletion. Live customer data and reports are removed after administrator approval; existing protected backups expire under the infrastructure operator’s applicable backup policy. The portal’s legacy backup-retention setting does not prove Neon point-in-time recovery or Vercel Blob backup retention, and the portal does not create those backups. Provider mailbox and exported/emailed copies are separate. Authenticator secrets are encrypted, recovery codes are hashed, and security events are recorded to protect accounts. For assessment-scope and abuse reports, contact support@netgainstechnologies.com. Use the account deletion workflow or contact the service operator for access, correction, retention or deletion requests.

Third-party development tools

Downloading a remediation pack does not send it to a third party. If you choose to import it into Figma Make or another development tool, that tool’s privacy terms apply. Direct connector access must be configured explicitly and is scoped to a customer account.