Last updated 31 October 2026
Privacy policy
How Harbour handles information about you and the email reports our customers send us.
How Harbour handles information about you and the email reports our customers send us.
Harbour (useharbour.io) helps businesses check and monitor their email security settings. For questions about privacy, email privacy@useharbour.io.
When our customers send us DMARC aggregate reports, those reports include the IP addresses of servers that sent email using our customers' domains. Where a server fails DMARC checks for a customer's domain, we add its IP address to a shared threat dataset. We use this dataset to tell each customer how many other Harbour customers the same IP address has sent failing or spoofed email to.
The IP address, the number of distinct Harbour customers it has targeted, and when we first and last saw it. We do not keep the content of any email, and we never share one customer's name, domains or reports with another customer. Customers only ever see counts.
An IP address can sometimes identify a person, for example where a home connection or compromised device is used to send spoofed email. We process this information on the basis of our legitimate interests, and those of our customers, in detecting and preventing email spoofing, phishing and fraud, and in protecting the security of email networks. We have assessed these interests against the rights of anyone who could be identified, and concluded that the limited data involved and the security benefit justify the processing.
We keep each IP address in the shared dataset for 12 months from when we last saw it in a failing report, then delete it.
If you believe an IP address in our dataset relates to you, you can ask for access to it, ask us to correct or delete it, or object to our processing. Contact privacy@useharbour.io. You can also complain to the Information Commissioner's Office at ico.org.uk.
See also our terms of service.