Privacy Policy

Effective date: 10 October 2026

The short version

• We collect what we need to run a business email filtering service: account, billing, support and website data. We don't sell personal data or run ads. We don't use tracking cookies or third-party analytics; we count page visits with our own cookie-less, aggregate counter.
• For the email we filter for our customers, the customer is in charge and we act as its processor under our Data Processing Agreement. Filtered email is processed in the United States, and message history is kept for 30 days.
• Several free tools run entirely in your browser. The domain checks don't keep the domains you enter, and the Email Deliverability Test deletes your test message as soon as it's read and keeps its report for 24 hours.
• Emails to our own addresses may be read and categorised by an automated assistant, which may answer routine questions. Anything about accounts, billing, security, privacy or legal matters is handled by a person.
• You can ask to access, correct or delete your data, and more, at privacy@iblockspam.com.

1. Who we are

iBlockSpam is an email filtering service for businesses. It is a product of BroadNet, operated by BroadNet Technologies LLC ("iBlockSpam", "we", "us", "our").

This table is the reference for our company details in all of our legal documents.

2. What this Policy covers, and our two roles

This Policy explains how we handle personal data when you visit iblockspam.com, use our free tools, contact us, create an account, pay for a subscription, or use the iBlockSpam service (the "Service"). We handle personal data in line with applicable data protection laws, including the GDPR and UK GDPR where they apply.

We handle personal data in two different roles:

• As a controller. For website, free tool, inquiry, account, billing and support data, we decide why and how the data is used. This Policy is our notice for that data.
• As a processor. When we filter, quarantine, spool, deliver and relay email for a customer's domains, we process the personal data in that email on the customer's behalf and on its instructions. The customer is the controller, and our Data Processing Agreement ("DPA") governs the processing. Section 7 describes it for transparency.

If you work for one of our customers, or you send email to one, and you have a question about email we filtered, please contact that organization first. If you contact us, we'll pass your request on and help it respond.

3. Personal data we collect

We don't ask for sensitive personal data, such as health information or government ID numbers, for our own purposes. It may appear in email that our customers' users send or receive; we process it only as a processor, to provide the Service.

IT partner access

If your organization gives an IT partner (an MSP or web host approved as an iBlockSpam partner) access to your account, that partner's staff can see your account's domains, setup status, mail statistics, Domain Watch changes, DMARC reports, lookalike domains and the domain, billing-status and partner events in your activity log (not your team's sign-ins or security changes), and with full access can make the domain changes your owners and admins can, including opening the filtering panel. They can't see or change billing, security settings or partner access, and can't delete the account. Each action they take is recorded in your activity log with their name and email address. Your account owners decide whether a partner has access and can remove it at any time from IT partners in the account. We keep partner applications while we review them and partner records for as long as we work with the partner; to have an application we didn't go ahead with deleted, email privacy@iblockspam.com.

4. Our free tools

• In-browser tools. The Email Header Analyzer, the DMARC Report Analyzer and the DKIM Key Generator run entirely in your browser. The headers, reports and keys you use with them are never uploaded to us.
• Domain checks. The MX Lookup, SPF, DMARC, DKIM, MTA-STS and BIMI checkers, Blacklist Checker, Reverse DNS Lookup and Email Health Check query public DNS for the domain or address you enter. Our usage log records only which tool ran and the resulting score, never the domain, your IP address or the results. Results are cached for five minutes to keep the tools fast, and result pages are excluded from search engines. To prevent abuse, we keep rate-limit counters linked to your IP address, which expire within 24 hours. Like any web request, the request for a results page (including its address) is recorded in our server logs, which are deleted after 14 days.
• Email Deliverability Test. When you send a test message to check@iblockspam.com, we read its headers only and delete the message file immediately. We keep the analysed report (sender address, sending IP address and server name, authentication and spam-filter results, never the message body) for 24 hours so you can open it, then delete it.
• SMTP error code search. The code or text you search for isn't stored.
• Free Domain Watch. If you sign up at /free-monitoring, we keep your email address, the domain you chose, the public DNS records we observe for it (MX, SPF, DMARC, MTA-STS) and their change history, and the times you confirmed or unsubscribed. We use them only to send the alerts and monthly reports you asked for (each monthly report includes a short note about iBlockSpam's paid protection; we send no separate marketing email), based on your consent, which you can withdraw at any time with the link in every email. Unsubscribing deletes your sign-up and its history immediately. Sign-ups that are never confirmed are deleted after 48 hours, together with the IP address recorded at sign-up (kept only to prevent abuse). We don't ask for proof that you own the domain; we only read its public DNS and only email the address you confirmed. These emails are sent through our own mail infrastructure.
• DMARC monitoring. For domains where monitoring is on, and for our own domains, we receive the aggregate reports that mailbox providers send to dmarc@iblockspam.com. They contain sending IP addresses, message counts, SPF/DKIM/DMARC results, the From and envelope domains, and the reporting organization's name and email. We look up public reverse DNS and registration (RDAP) data for the sending IPs, only to show you who sends as your domain. Raw report emails are deleted as soon as they're parsed (unreadable ones are kept up to 14 days to troubleshoot), parsed data is kept for 13 months, and reports for domains without monitoring are discarded. While monitoring is on we publish a public DNS record that names your domain (<domain>._report._dmarc.iblockspam.com), hosted by Cloudflare, so receivers will send us your reports. Turning monitoring off, or removing the domain, deletes its stored reports.
• Shared Email Health Check reports. If you choose "Share this report", we save a snapshot of that check at a private, unlisted link (/report/…). It contains only the domain checked, the public DNS results shown on the page and when it was created, not your IP address, browser details, email address or account. Anyone with the link can view it; it is marked noindex and deleted automatically 90 days after creation. To prevent abuse we count how many links come from each IP address in short-lived counters that reset within 24 hours and aren't linked to the report. To have a report removed sooner, email privacy@iblockspam.com with the link.
• Status page. Our status page (iblockspam.com/status) and its mail-flow probe process no personal data and load no third-party scripts.

4A. Website statistics

We count visits to our public pages with our own first-party counter. No cookies are set and no third-party scripts are loaded. When a page loads, your browser sends us the page address (without its query string, apart from campaign tags such as utm_source), whether the page had other parameters, and the website that linked to you (its domain only). We use your browser's user-agent only to classify the device as mobile or desktop and to leave out automated traffic, then discard it. We also count actions such as running a free tool, starting or completing sign-up, verifying a domain, starting checkout, confirming Free Domain Watch or sending the contact form.

We store only daily totals (date, page or action, referring domain, campaign tag, device type, count). We don't store IP addresses, identifiers or anything that links a visit to you, and we don't combine visits into profiles. If your browser sends Do Not Track or Global Privacy Control, we don't count your visits. Pages in the account and admin areas are never counted. Daily totals are kept for up to 400 days. Legal basis: our legitimate interest in understanding how the website is used in aggregate.

5. Why we use personal data, and our legal bases

Where the EU GDPR, UK GDPR or Swiss data protection law applies, we rely on these legal bases for the data we control:

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for details of that assessment. Providing account and billing data is necessary to enter into a subscription; without it we can't provide the Service.

6. Support email and our automated assistant

Emails sent to our addresses, such as support@iblockspam.com or sales@iblockspam.com, may be read and categorised by an AI system that helps us respond quickly. It may draft a reply, and for routine questions about the product or setup it may send an automatic reply, which is clearly labelled as written by our automated assistant.

• A person handles anything sensitive. Messages about accounts, billing, security, privacy or legal matters are reviewed by a person. Messages to privacy@, security@ and legal@ are never answered automatically.
• Safeguards. Automatic replies are sent only within fixed rules: for example, only to an authenticated sender, never to a different address, only a limited number per conversation, and never with wording we haven't approved.
• You can always reach a person. Reply to any automatic message and a team member will follow up.
• Provider. The AI model is provided by Anthropic, listed on our Subprocessors page. The assistant sees the conversation it is working on and our public website content. It can't access your account, your billing details or the email we filter for customers.

The assistant doesn't make decisions about you that have legal or similarly significant effects.

7. Email filtering (our processor role)

To provide the Service, our filtering infrastructure receives mail sent to a customer's domains, scans it for spam, viruses, malware, phishing and spoofing, and delivers clean mail to the customer's mail server. Mail may also be quarantined, spooled during a mail server outage, recorded in message history, or sent through the outbound relay.

• Where. Email is processed in the United States by a US-based filtering subprocessor that operates our filtering infrastructure under a written agreement with us. See our Subprocessors page.
• Purpose limits. We process email only to provide, secure and support the Service, on the customer's instructions. We don't sell email content, use it for advertising, or use it to build profiles of individuals.
• Human access. No one at iBlockSpam reads message content as a matter of course. Staff look at a specific message only when the customer asks us to help with it, when needed to deal with a security incident or abuse, or when the law requires it.
• Customer control. The customer's administrators decide which domains are protected, how filters are configured, and who can see quarantines and message history.

8. Automated processing

Spam filtering is automated. The Service classifies messages, for example as clean, spam or containing a virus, and delivers, quarantines or rejects them according to the customer's settings. It doesn't make decisions about individuals that produce legal or similarly significant effects, so it isn't automated decision-making of the kind covered by Article 22 of the GDPR. Users can review their quarantine and release legitimate messages, and administrators can adjust filters and sender lists.

9. Who we share personal data with

We share personal data only with:

• Our subprocessors and service providers, who help us run the Service and act under written contracts that limit their use of the data to the services they provide to us: our US-based filtering subprocessor, Stripe (payments), Cloudflare (network and security), Vultr (hosting) and Anthropic (support email assistant). The current list, with what each one does and where, is on our Subprocessors page.
• Your organization. Administrators of your account can see account, quarantine and message history data for its domains.
• Professional advisers, such as lawyers, accountants and auditors, under confidentiality duties.
• Public Certificate Transparency logs. For Lookalike Domain Watch we look up domain names that resemble our customers' domains (never email addresses or message content) in public certificate logs through the crt.sh search service, to spot look-alike sites. Domain names are already public.
• Authorities and others where the law requires, for example in response to a valid court order, or where needed to protect the rights, property or safety of our customers, the public or us. Where the law allows, we'll tell the affected customer before disclosing its data.
• A successor business, if we're involved in a merger, acquisition or sale of assets. The successor must handle the data in line with this Policy, and we'll tell affected customers.

We don't sell personal information, and we don't share it for cross-context behavioral advertising.

10. International transfers

We serve customers internationally. Personal data is processed in these places:

• Our company and staff: the United Arab Emirates, where we are established. Our staff run and support the Service from there and may access personal data remotely for those purposes.
• Email we filter: the United States.
• Our website, portal and administration systems, and our own @iblockspam.com mailboxes: a server hosted by Vultr in France (EU).
• Website traffic: Cloudflare's global network, which serves each visitor from a nearby location.
• Payments: Stripe, mainly in the United States.
• Support email assistant: Anthropic, in the United States.

When personal data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, including to us in the United Arab Emirates and to our subprocessors in the United States, we use the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum or the Swiss amendments where they apply, or rely on another valid mechanism such as the EU-US Data Privacy Framework where the recipient is certified. For customer email, these safeguards are part of our DPA. You can ask for a copy of the relevant safeguards at privacy@iblockspam.com.

11. How long we keep personal data

We keep personal data only as long as we need it for the purposes above, then delete or anonymize it.

We may keep data longer where the law requires it, or where needed to establish, exercise or defend legal claims.

12. Security

We protect personal data with technical and organizational measures appropriate to the risk, including HTTPS for all access to our website and portal, encryption of mail in transit whenever the other server supports it, multi-factor authentication for administrator accounts, role-based access, staff access limited to what's needed, logging, and encrypted backups. Our Security page explains these in plain English. No system is completely secure. If a personal data breach affects you, we'll notify you and the relevant authorities as the law requires.

13. Your rights in the EEA, UK and Switzerland

If the GDPR, UK GDPR or Swiss data protection law applies, you have the right to:

1. access the personal data we hold about you and get a copy;
2. correct inaccurate or incomplete data;
3. delete your data in certain circumstances;
4. restrict how we use your data in certain circumstances;
5. object to processing based on legitimate interests, and to direct marketing at any time;
6. data portability: receive your data in a structured, machine-readable format, or have it sent to another organization; and
7. withdraw consent at any time where we rely on consent, without affecting earlier processing.

You can also complain to a data protection supervisory authority, in particular where you live or work, or where an alleged breach happened. We'd appreciate the chance to address your concern first.

14. Your rights in the United States

California. This section applies to California residents under the California Consumer Privacy Act, as amended ("CCPA").

• What we collect. In the past 12 months we have collected: identifiers (such as name, email address and IP address); customer records and commercial information (such as billing details and subscription history); internet or network activity (such as pages requested and log data); professional information (such as company and job role); and, as a service provider to our customers, the content of email we filter for them. Sections 3, 5, 9 and 11 describe the sources, purposes, recipients and retention for each category.
• Disclosures. We disclose these categories to the service providers and contractors in section 9 for the business purposes in section 5.
• No sale or sharing. We don't sell or share personal information, as the CCPA defines those terms, and haven't in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16.
• Sensitive personal information. We use account login credentials only to provide the Service and for other purposes the CCPA permits, and don't use any sensitive personal information to infer characteristics about you.
• Your rights. You may ask to know what personal information we collect, use and disclose and get a copy; ask us to delete or correct it; and opt out of sale or sharing (there's nothing to opt out of, because we do neither). We won't discriminate against you for exercising these rights. You may use an authorized agent; we'll ask the agent for proof of authority and may ask you to verify your identity directly.

Other US states. Residents of other states with consumer privacy laws, such as Colorado, Connecticut, Oregon, Texas, Utah and Virginia, may have similar rights to access, correct, delete and obtain a copy of their personal data, and to opt out of targeted advertising, sale and certain profiling. We don't sell personal data, use it for targeted advertising, or carry out that kind of profiling.

Appeals. If we decline your request, you can appeal by emailing privacy@iblockspam.com with "Privacy appeal" in the subject line. We'll respond within the time your state's law requires. If you're not satisfied with the outcome, you can contact your state attorney general.

15. How to exercise your rights

• Email: privacy@iblockspam.com
• Contact form: iblockspam.com/contact
• Account holders: email us from the address on your account, so we can verify the request quickly.

We'll verify your identity before acting on a request, normally by confirming you control the email address on file. We respond within one month under the GDPR and UK GDPR and within 45 days under US state laws, and may extend these periods where the law allows, telling you if we do. Requests are free unless they're clearly unfounded or excessive.

If your request concerns email we filtered for your employer or another organization, we'll pass it to that organization, because it is the controller, and help it respond.

16. Cookies and similar technologies

We use only the cookies our website and portal need to work. We don't use analytics cookies, advertising or retargeting cookies, social media pixels, or third-party cookies for cross-site tracking. Our cookie-less page counter is described in section 4A. We honor Do Not Track and Global Privacy Control by not counting your visits, and as a request to opt out of sale and sharing, although we do neither. Our Cookie Policy lists each cookie.

17. Marketing email

We send product news or marketing email only where you've opted in or the law otherwise allows it. Every marketing email includes an unsubscribe link, and you can also opt out by emailing privacy@iblockspam.com. While you have an account you'll still receive service email, such as receipts, renewal reminders, setup reminders (for example, if you haven't confirmed your email or verified a domain yet), alerts and security notices. You can turn setup reminders off with the link in each one.

18. Children

The Service is for businesses and isn't directed at children. We don't knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact privacy@iblockspam.com and we'll delete it.

19. Links to other websites

Our website and guides link to other sites, such as standards bodies and mail platform documentation. Those sites have their own privacy practices, which we don't control.

20. Changes to this Policy

We may update this Policy. We'll post the new version here with a new effective date. For material changes, we'll notify account owners by email before the changes take effect.

21. Contact

Questions or concerns about this Policy or our handling of personal data: privacy@iblockspam.com. Our full company details, and our representatives in the EU and UK, are in the table in section 1.