Last updated: October 18, 2026
This policy explains what Digital Checkmark LLC collects when you use this website and our free security tools, why we collect it, how long we keep it, and who else sees it. We have written it in plain language rather than legal boilerplate, because a privacy policy you cannot read protects nobody.
The short version. If you run one of our free tools and ask for the report, we store your email address, your IP address, and a summary of what the tool found. We keep it for 90 days (180 days for the email analyzer) and then it is deleted automatically. We do not sell your data, we do not run advertising, and we do not add you to a marketing list. You can ask us to delete your record at any time and we will do it.
Who we are
Digital Checkmark LLC is an IT and cybersecurity services company based in Tampa, Florida, United States. We are the controller of the personal data described in this policy.
For any privacy question or request, write to [email protected]. A person reads that inbox between 8am and 8pm Eastern Time.
What we collect, and why
1. When you use a free tool
Our free tools can be used without giving us anything, up to a daily limit. You give us an email address when you ask for the full report, when you go past the daily limit of a tool (we send a 6-digit code to confirm it is yours), or when you turn on breach monitoring. In Breach Checker the address you check is itself an email address, and it is kept with the result like any other tool record. In every case we then store a record that contains:
- The email address you submitted
- Your IP address
- The date and time, and which tool you used
- A summary of the result, which differs by tool (see the table below)
We collect the email address to deliver the report you asked for and so we can recognize you if you come back. We collect the IP address for one reason only: abuse prevention. These tools make outbound queries to third party services on your behalf, and without an IP we cannot stop somebody from using them as a free scanning engine.
| Tool | What the result summary contains | Kept for |
|---|---|---|
| Breach Checker | Number of breaches and pastes found, the names of the breaches, a risk level | 90 days |
| Email Health Check | The domain you analyzed, and how many findings fell into each severity level | 90 days |
| Email Analyzer | The subject line and sender address of the message you analyzed, its spam and threat scores, and how many indicators and attachments it contained | 180 days |
| Ransomware Tracker | The term you searched for, and how many results and groups matched | 90 days |
| Cyber Toolkit | Which utility you used and its category | 90 days |
| Voice Chk | Which voice and output format you used | 90 days |
The email analyzer deserves a specific note. To analyze a message you upload or paste it. The full analysis, which includes the body of the message and its attachments, is kept on our server for up to 2 hours so that the AI summary and the report you ask for can be built from it, and is then deleted automatically. What we keep after that is only the summary above, which does include the subject line and the sender address of the analyzed message. If the message you are analyzing is sensitive, please keep that in mind.
Breach monitoring. Breach Checker can warn you when your own address appears in a new breach. You can only turn it on for an address you manage: you tick a box saying so and type the 6-digit code we send to it. While it is on we keep your address, the list of breaches it already appeared in, and when we last checked, and we query Have I Been Pwned with it periodically. Turning it on also subscribes you to our newsletter, and the button says so before you do: unsubscribing from any of our emails stops the monitoring and deletes that record straight away.
Ransomware monitoring. The ransomware tracker can warn you when a name or domain you watch (your company, a supplier, a client) appears in a new post on a ransomware leak site, up to 5 per email address. Those posts are public, so any name can be watched; what we protect is the address that receives the alerts, which you confirm is yours with a 6-digit code. While it is on we keep your address, the names you watch and which posts we already told you about. It is part of our newsletter in the same way as breach monitoring, and each alert has a link to stop watching a single name.
2. When you contact us
The contact form on this site is served from our own customer system at crm.digitalchk.com and submits directly to it. It collects what you type into it, which normally means your name, your email address, and your message. We keep that for as long as we are in contact with you or have a business relationship, and we delete it on request.
3. When you simply browse
Our web server writes standard access logs containing IP address, timestamp, the page requested, and the browser user agent. This is ordinary server operation and is used for security and troubleshooting. Logs rotate and age out.
We also use Google Analytics 4 to understand which pages are read and how people arrive. This tells us that a page was viewed, roughly from where, and on what kind of device. We do not use it to build advertising profiles, we do not run ads on this site, and we have no advertising network connected.
4. When you subscribe to our newsletter
Subscribing is optional. You can use the tools, read the blog and write to us without ever joining a list. The one thing that comes with the newsletter is breach monitoring, described above.
When you sign up we store your email address, your first name if you gave one, the language you were reading in, and which list you joined. Nothing is sent until you confirm: we email you a link, and if you never click it the address is deleted after 30 days. If you have just confirmed the address with one of our 6-digit codes, that code already counts as the confirmation.
At the moment you subscribe we also write one consent record, and another if you later leave. It holds your IP address, your browser user agent, the page you subscribed from, and the exact wording of the consent you were shown. That record exists for one reason: it is our evidence that you asked to hear from us, and yours that we did not add you ourselves. It is the one place on this site where we deliberately keep an IP address for the long term, and it is the last thing we would delete, because without it we could not show that you agreed.
Once you are subscribed we record, for each message, whether it was delivered, whether it was opened, and which links in it were clicked. That tells us which subjects are worth writing about. It is kept per message and per link. We do not follow you around the web, and we do not know what you do on other sites.
Every email carries a one click unsubscribe link and a link to a preference page where you can change which lists you are on or leave altogether. Those links stay valid for 180 days. You never have to write to us to get off a list, although you always can.
5. When you use the chat
The chat is optional. When you write to it we keep the conversation: your messages, the replies, the page you wrote from, the language, your IP address and your browser. The IP address and the browser are only used to stop abuse, with hourly and daily limits.
Automatic replies are written by an artificial intelligence provider. To do that we send it your message, the earlier messages in that conversation and the passages of our pages that are relevant. We never send it your IP address or your email. Our team can also ask the same kind of provider questions about recent conversations, to see what visitors need; email addresses and phone numbers are removed before anything is sent.
At some point in the conversation, for example before passing it to a person, we may ask for your name and email, and we confirm the email with a code. A member of our team reads the conversation and replies in the chat. If you are no longer on the page, or you wrote outside our business hours or while nobody was available, we send the reply to that email, and when the conversation is closed we send you a copy. Files you attach go to a private folder that only the people handling your conversation can open. If you rate the help you got, we keep that rating.
When you leave your email you will see a box to receive the newsletter. Outside the European Union it may come already ticked: untick it if you do not want the newsletter. If the box is not ticked when you send the form, we do not subscribe you. Conversations, their attachments and the contacts left through the chat are deleted automatically after 90 days.
While you have a page of this site open, the chat tells our team which page you are on, the site you came from (without its search terms), your country and whether you use a phone or a computer, so we can offer help at the right moment and, if needed, write to you in the chat. Your browser keeps a random identifier for 30 minutes so the pages of one visit count as one visitor. We do not store your IP address for this, and these records are deleted a few minutes after you leave, within a day at the latest. When you start a chat, our team may get a notification with your first question and the page you are on.
Text messages (SMS)
We send SMS messages to clients about their IT services. This section describes that program specifically, because a privacy policy that only covers a website does not tell you what happens to your phone number.
The part people ask about first. We do not sell your phone number, and we do not share mobile opt-in data, consent records or phone numbers with any third party for marketing or promotional purposes. The only companies that see your number are the ones that have to, in order to deliver a message to your handset.
What we collect for SMS
- Your mobile number
- A record of your consent: when you gave it, and how
- The messages sent to you and their delivery status
- Your replies, including STOP and HELP
How you opt in
We only send SMS to a number whose owner has agreed to receive them. That agreement comes from one of these:
- A signed services agreement that includes SMS notification consent
- A form on this site where you gave us your number and checked the SMS consent box
- Replying YES or START to a message confirming your enrollment
- Asking our team directly, in writing, to be notified by SMS
What we send
Service messages only. Support ticket updates, appointment reminders for scheduled visits, security alerts, account activity notices, and service outage notifications. Frequency depends on your service activity and is typically one to five messages per month.
We do not send marketing or promotional text messages.
How to stop
Reply STOP to any message. We stop immediately and send one confirmation that you have been unsubscribed. Reply HELP for contact information. You can also write to [email protected] and we will remove your number.
Message and data rates may apply, and are set by your carrier, not by us. Carriers are not liable for delayed or undelivered messages.
Who sees your number
Our messaging provider and the mobile carriers, because a message cannot reach you otherwise. They act on our instructions for that single purpose. Nobody else receives it, and it is never part of any list we share, rent or sell.
Who else sees your data
We use a small number of outside services to make the tools work. Each one receives only what it needs to do its job. We do not sell personal data to anyone, and we never have.
| Service | What it receives | Why |
|---|---|---|
| Cloudflare | Your IP address and request metadata | Serves and protects the site, and runs the anti-bot challenge on the tools |
| Cloudflare DNS | In the email health check, the domain you analyze and the names of its mail servers. Not your IP address or your email address | Looks up DNSSEC and DANE, which our server cannot query directly |
| Reoon | The email address you submit | Confirms the address is real and deliverable before we send a report to it |
| Artificial intelligence providers (a main one and a backup) | The technical findings of your analysis and, in the email analyzer, also the content of the analyzed message | Write the plain language explanation, the action plan and the summary in your report |
| Emailit | Your email address and the report. If you subscribe to the newsletter, also your first name, the language you read in, your country, whether you are still subscribed, and how you signed up | Delivers our email. For the newsletter it also keeps a copy of the list, so that our system and the one that actually sends are never out of step |
| Have I Been Pwned | Your email address, in the form their API requires | Performs the breach lookup you requested |
| ransomware.live | Your search term | Provides the ransomware group and victim data |
| Chat artificial intelligence providers (a main one and a backup) | Your chat messages and the relevant passages of our pages | Write the automatic replies in the chat |
| Voice providers | The text you type in the voice generator | Turn it into the audio file you download |
| Google Analytics | Page view data from your browser | Site statistics |
Some things that might look like third parties are not. Our PDF report generator runs on our own server and your report never leaves it during conversion. Our customer system and the email analyzer backend are likewise our own infrastructure.
Beyond the above, we disclose personal data only when the law requires it, or to protect our rights or the safety of others.
What we do not do
- We do not sell or rent your personal data.
- We do not add you to a mailing list because you used a free tool. The email you give us is used to send the report you asked for, and nothing else. You only join the newsletter with its box ticked, or by turning on breach or ransomware monitoring, which subscribes you as well and says so. In some forms, outside the European Union, that box comes already ticked, and you can untick it.
- We do not run advertising or advertising trackers on this site.
- We do not keep the body or attachments of messages submitted to the email analyzer beyond the 2 hours needed to build your summary and report.
How long we keep things
Tool records are deleted automatically once they pass the retention period shown in the table above: 90 days for most tools, 180 days for the email analyzer. This runs on a schedule, it is not something we have to remember to do. Separately, the full result of each check is kept on our server for up to 2 hours after you run it, so that the report you ask for is built from exactly what the tool found; after that it is deleted automatically, whether or not you asked for the report. Chat conversations, their attachments and the contacts left through the chat are deleted after 90 days. Contact enquiries and client records are kept for as long as the relationship or our legal obligations require, and deleted on request.
Newsletter subscriptions last until you unsubscribe or ask to be deleted. Breach and ransomware monitoring last as long as your subscription, and their records are deleted when you unsubscribe. An address that never confirms is removed after 30 days. The sending log, which records that a message went out and whether it was opened, is kept for 180 days, and the raw delivery events behind it for 30. Consent records are kept for as long as you are subscribed, for the reason given above.
Cookies
This site uses a small number of cookies:
- Google Analytics sets two cookies,
_gaand_ga_W5YRYJGN9V, to distinguish one visit from another for statistics. pll_language, to remember whether you are reading the English or the Spanish version.- WordPress sets session cookies only if you log in, which applies to our staff, not to visitors.
- The anti-bot check on our tools runs from
challenges.cloudflare.comand keeps its state there, not on this domain.
You can block or delete cookies in your browser settings. The tools rely on the anti-bot challenge, so blocking those particular cookies may prevent them from running.
Your rights
Wherever you are, you can ask us to:
- Tell you what we hold about you
- Send you a copy of it
- Correct it if it is wrong
- Delete it
Write to [email protected] from the address concerned, or tell us which address to look up. We will confirm within 30 days, and normally much sooner. We do not charge for this and we will not ask you why.
If you are in the European Economic Area or the United Kingdom, the GDPR applies to you. Our lawful basis is your consent when you submit an email address to receive a report, and our legitimate interest in preventing abuse of the tools when we log an IP address. You also have the right to object to processing, to request portability, and to complain to your national supervisory authority.
If you are a California resident, the CCPA and CPRA apply to you. You have the right to know what is collected, to delete it, to correct it, and to opt out of sale or sharing. As stated above, we do not sell or share personal data, so there is nothing to opt out of, but the right to know and to delete applies and we honor it.
Where your data goes
We are based in the United States and our infrastructure is hosted in Europe. The services listed above operate internationally. If you are writing to us from outside the United States, your data will be processed in the United States and in the European Union.
Security
The site runs over HTTPS with modern transport security. Administrative access requires two factor authentication. Tool submissions pass an anti-bot challenge and an email verification step before any report is generated. Access to stored records is limited to the people who need it.
No system is perfect. If we ever discover a breach affecting your personal data, we will tell the people affected and the relevant authorities as the law requires, and we will tell you what actually happened rather than a sanitized version of it.
Children
This site and these tools are intended for business use by adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, write to us and we will remove it.
Changes to this policy
If we change how we handle personal data, we will update this page and change the date at the top. For a change that materially affects people whose data we already hold, we will say so clearly rather than quietly editing the text.
Contact
Digital Checkmark LLC
Tampa, Florida, United States
[email protected]