Legal

Privacy

This page describes what the Gradefort account stores. The free grade on the check page stores a cached report for the domain, not an account.

Account

When you use a sign-in link, we store the email address, a session, and a plan. The session cookie is HTTP-only. We store the time and network address of a verification, a monitoring confirmation, and a fix, because those actions require a record of authorization.

Domains and scans

For each domain on the account we store the name, a verification token, whether it is verified, scan reports, score history, DNS snapshots used to notice changes, lookalike names, and alert text. Supplier domains you add are stored with the same kind of passive grade.

Breach data

Breach information is sensitive. When a breach provider is configured, Gradefort asks it about a verified domain and stores a count and the names of the breaches. It does not store the mailbox names returned by that provider. If the provider is not configured, the product says the check is not enabled.

Provider tokens

A Cloudflare API token is encrypted before it is stored, using a key that is not in the repository. The token is used only to read and change the zone you connected, and to undo a change you confirm. You can disconnect it from the dashboard.

Payments

Stripe processes card payments. Gradefort stores the Stripe customer id, the plan, and the billing status. Card numbers are not stored on Gradefort.

We do not sell personal information

Scan results, account details, and breach counts are used to run the product. They are not sold. A data processing agreement for agencies is planned for a later release and is not offered yet.

Retention

Account data stays while the account is open. Deleting a domain deletes its scans, alerts, lookalikes, token, and change log. Deleting the account deletes the remaining rows for that account. Sign-in links expire after 20 minutes. Sessions expire after 14 days. Cached public grades expire after one hour.

Deleting your information

Sign in and delete the account from the dashboard. That is the way to remove the stored account. This site does not publish a contact address.