Privacy Policy.
Short version: NW collects what you send and the minimum needed to run the site safely. Nothing is sold, there are no cookies and no ad tracking, and you can ask for your data to be deleted at any time.
Last updated 31 October 2026.
Who is responsible
This site and its services are run by NW Cybersecurity, operated as a sole trader, Hay Al Inara Bloc A, Oujda, Morocco. NW is the controller of the personal data described here. Contact for anything in this policy: [email protected].
What is collected, and where it comes from
The free domain check. The check runs in your browser, which asks Cloudflare’s public DNS service (cloudflare-dns.com) for your domain’s public records. The domain you type is not sent to NW and is not stored. NW only records that a check ran and which result category it got (for example “no DMARC” or “p=reject”), as described under the event log below.
Forms you fill in.
- Free report: your name, work email and domain. When the request arrives, NW also saves a copy of that domain’s public DNS records at that moment, to write the report.
- Booking the Done for you service: the same, plus your DNS host, mail provider, the services that send email as you, anything that sends monthly, your notes and whether you want monitoring.
- Kit intake: your Payhip order number plus the same details as a booking.
For every form, NW also stores a salted hash of your IP address (a one way code that can’t be turned back into the address) to limit spam and repeated requests. The raw IP address is never stored.
Payments. Done for you and monitoring are invoiced through PayPal. The $39 kit, ebooks and templates are sold through Payhip. PayPal and Payhip handle your payment details as independent controllers under their own privacy policies. NW receives order details such as your name, email, amount and order number, never your card or bank details.
Emails. Messages you exchange with [email protected], including any information you choose to include.
Monitoring customers. If you subscribe to monitoring, your domain’s DMARC aggregate reports are sent to a report service NW uses. These reports come from mailbox providers and list the servers that sent mail as your domain, with their IP addresses and message counts. They don’t contain message content.
Cloudflare Web Analytics. Counts visits without cookies and without fingerprinting. It records things like the page, the referring site, browser type, country and load time. NW does not see or store your IP address through it.
The event log. NW keeps its own count of a few actions: a check was run (with its result category), a report was requested, a booking or kit intake was sent, an outbound link was clicked, or the language was switched. Each row holds only the event type, the page, the language, a campaign tag if the link you arrived on had one, your country (from Cloudflare) and the time. It never holds your IP address, browser details, name, email or the domain you checked.
Turnstile. The forms use Cloudflare Turnstile to stop bots. To do that, Cloudflare processes signals from your device and browser. See Cloudflare’s privacy policy for details.
Server logs. Cloudflare hosts the site and, like any host, processes technical request data (such as IP address and browser type) to deliver pages and protect the service. NW does not keep these logs.
If NW emailed you first
NW sometimes contacts businesses about the email security of their domain. For this, NW uses business contact details that the business publishes on its own website (business name, a business or role email address, the website domain) and the domain’s public DNS records. NW does this on the basis of legitimate interest: offering a relevant business service, using information the business chose to make public. Messages are about your domain only, and every message says how to opt out.
If you reply “no thanks”, unsubscribe, or ask by email, your address or domain goes on a suppression list and you won’t be contacted again. That list is kept permanently so the opt out keeps working. You can also ask for any other data about you to be deleted.
Why it is used, and the legal basis
- Answering report requests, bookings and intakes, and delivering the services you order: performing a contract, or steps you asked for before one.
- Keeping the site safe, limiting spam and abuse: legitimate interest.
- Counting visits and actions to improve the site and outreach: legitimate interest, with no cookies and no personal identifiers.
- Contacting businesses about their domain, as described above: legitimate interest, with an opt out in every message.
- Keeping invoices and order records: legal obligation under tax and accounting law.
Who processes it
NW never sells or rents personal data and doesn’t share it for advertising. It is processed by these providers, only as needed:
- Cloudflare: hosting, DNS, the database that stores form submissions and the event log, Turnstile, Web Analytics, and the internal notification emails sent to NW.
- Google (Gmail): the inbox where NW receives internal notifications of new requests, which include the details you sent.
- Namecheap (Private Email): NW’s business mailbox.
- PayPal and Payhip: payments and digital product delivery, as independent controllers.
- The DMARC report service: monitoring customers only.
- Kit: the newsletter, only if you subscribe to it.
Where it is processed
NW operates from Morocco. The providers above process data in the United States, the European Union and other countries. Where data leaves the EU or UK, NW relies on the safeguards those providers offer for international transfers, such as the European Commission’s Standard Contractual Clauses.
How long it is kept
- Free report requests that don’t become an order: deleted after 90 days.
- Orders, invoices and the records needed for them: as long as tax and accounting law requires.
- Monitoring data: while monitoring is active, then deleted within 90 days of cancellation.
- The event log: 13 months.
- Spam limit records: deleted within a day.
- Emails: as long as needed to handle your request or the service, then deleted.
- The suppression list: kept so opt outs keep working.
Your rights
You can ask NW to show you the data held about you, correct it, delete it, limit how it is used, or send it to you in a portable format. You can object at any time to processing based on legitimate interest, and an objection to direct marketing is always honored. Email [email protected]. You get an answer within one month. NW may ask you to confirm the request comes from you, for example by replying from the address concerned.
If you are in the EU, you can also complain to the data protection authority where you live or work. In the UK, that is the Information Commissioner’s Office (ICO).
Cookies and storage
This site sets no cookies. It saves your language choice in your browser’s local storage, and keeps a campaign tag (if the link you arrived on had one) in session storage until you close the tab. Turnstile may store its own data to do its anti bot check. There are no ad networks and no cross site tracking.
Security
NW never asks for your passwords. Paid work uses access limited to the job, such as a DNS token for one domain with a short expiry, and you are asked to revoke it when the work is done. Data is stored with the providers listed above, behind access controls.
Children
The site and services are not directed at children under 16, and NW doesn’t knowingly collect their data.
Changes
If this policy changes, the new version is posted here with a new date. Significant changes affecting active customers are also sent by email.