MailSolid Privacy policy

Edition: 2026-11-06 · Digital Checkmark LLC

Who processes data

Digital Checkmark LLC, based in Tampa, Florida, United States, operates MailSolid. We are the controller of the data of console accounts and of the people who use the public tools on mailsolid.com. We process the data in a business's workspace, and the data collected by the tools a business puts on its own website, on behalf of that business. For questions and requests write to privacy@mailsolid.com. If you left your email in a tool on another business's website, contact that business first: it decides how your information is used, and we help it respond.

Account data

We process your email address, your name if you add it, your sessions (time, IP address and browser), your sign-in methods (codes sent by email, passkeys and the authenticator app, kept encrypted), the workspaces you belong to and your role, your notification preferences, your plan and usage, and the records of what you do in a workspace. If you sign in with Google or Microsoft we keep only the identifier of that account and its email address: no token, name or photo from the provider. We record the edition of the terms you accepted, its language and the time. We never see a payment card number: when there are paid plans, the payment provider collects payment details.

Workspace data

A workspace holds what its team adds and what MailSolid generates for it:

• the domains it checks and watches, the history of each check and the changes found;
• the DMARC aggregate reports that providers send to the workspace's report address, received by our own mail node: they list sending IP addresses, message counts and authentication results, not the content of messages;
• the TLS reports sent to the workspace, and the hosted DMARC and MTA-STS policies it publishes;
• the messages (.eml files) uploaded for analysis and the messages sent to a mail-test address: the message itself is deleted within 24 hours, and the report kept does not include the body or the content of attachments;
• the team, invitations, branding, settings and alert destinations (Slack, Microsoft Teams, Telegram, webhooks and the PSA services it connects), whose secrets are stored encrypted;
• the contacts that people leave in the public tools the business embeds on its website: email address, the domain checked and the verification of that address.

The business decides what to monitor and who is on its team, and is responsible for the notices and lawful basis that apply to the data it adds.

Public tools

The public tools (domain health and mail test) work without an account. We process the domain or message you submit and your IP address, to answer and to limit abuse. A public result can be opened with its link for 7 days.

The AI second opinion

Message analysis can ask an AI model for a second opinion. It is off by default and only a workspace can turn it on. When it is on, we send Anthropic the text of the message that a person would see, with personal data masked, and the facts found by our own engine; attachments are never sent. We do not use workspace data to train AI models.

Email we send

We send sign-in codes, invitations, alerts, weekly summaries and account notices. Before sending to an address for the first time we may check that it can receive mail. Each alert and summary email has a link to stop that kind of email.

Providers and transfers

We use providers for hosting and storage, email delivery and address verification, our mail nodes, the AI second opinion when it is on, and payments when there are paid plans. The list, with what each one receives, is in Subprocessors. To check domains we also query public DNS resolvers and domain registries with the domain names and IP addresses involved. The sign-in provider you choose verifies your identity. Data may be processed in the United States and in other countries where these providers operate. Contact us before subscribing if you need a specific location, a processing agreement or particular international transfer safeguards; we do not claim that one certification or mechanism applies automatically to every case.

Purposes and legal bases

We process data to perform the contract and provide the service, to meet legal obligations, and to protect security and prevent abuse based on our legitimate interests. Optional functions, such as the AI second opinion or the emails you can turn off, depend on your choice. Accepting the terms does not subscribe you to advertising. Data in a workspace is processed under the business's instructions and the lawful basis it determines.

Retention

A deleted workspace or account can be recovered for 7 days and is then purged with its data; signing in during that period restores an account. Deleting an account may require transferring or deleting the workspaces you own first. Acceptance records stay with the account and are deleted when it is purged. Tax records or evidence required by a legal obligation or a claim may be kept separately, limited to that purpose.

Your rights

You may request access, correction, deletion, portability, objection or restriction under applicable law. In My account, Your data lets you export your data and delete your account. You can also write to privacy@mailsolid.com; we verify your identity before disclosing or changing data and answer within the applicable legal deadline. You may complain to your data protection authority. If you left your data with a business that uses MailSolid, ask that business to handle your request.

Cookies and browser storage

The console uses only necessary cookies: the session cookie and the short-lived cookies of signing in with Google or Microsoft and of the second step. It stores in the browser your language, your theme and display preferences such as the last workspace you opened, and keeps drafts in the browser tab. To tell people from bots, sign-in and the public tools use a human check (Cloudflare Turnstile, or our own check when it is not available). The website and the console have no advertising cookies and no third-party trackers.

Security and children

We use encrypted connections, roles, isolation between workspaces, encrypted secrets, activity records, two-step verification and passkeys. No system can guarantee the complete absence of incidents. MailSolid is for businesses, and accounts are for people aged 18 or older.

Changes

The date and the edition identify this policy. We publish changes and communicate material ones where appropriate. You can read these documents without signing in.