Why you received this, and what we keep

Who we are

mailcounsel is a trading name of Northstar Infinity Works Ltd, company no. 17326480, registered in England and Wales. Registered office: C/O ELSG Ltd, Regus, Building 2, Marlins Meadow, Watford, England, WD18 8YA. We are registered with the Information Commissioner’s Office under reference ZC194241. You can reach us at [email protected] for any question about this notice, and at [email protected] to stop hearing from us.

What we hold about your firm

• Registered details from public registers: firm name, registered address, registration status.
• Public DNS records for your domain and the dates we read them. These are published settings, readable by anyone.
• Whether a letter was posted, returned, or its page opened — without your IP address and without your browser details.
• If you become a client: the contacts you give us, encrypted, and the changes we make together.

Why

To offer help with your firm’s email authentication, and to show you what we found and when. We rely on our legitimate interest in offering a business service to a business, balanced against your interest in not being contacted. You can object at any time and we will stop.

How long

• If you do not reply: your address and any named contact are erased twelve months after the last letter. Aggregate counts remain.
• Public DNS scans are kept as a dated history, because their value is the comparison over time.
• If you ask us to stop, we keep the minimum needed to make sure we do not write to you again.

This website

We count page views without cookies and without storing anything on your device to do it. Your internet address and browser details are combined into a code that changes every day; neither is stored. We keep the page, the website that sent you, a country, and whether the device is a phone, for twelve months.

If a request looks for weaknesses — an address that exists only on other kinds of websites, such as a WordPress login page, or an attempt to break in through the address itself — we keep its internet address, the address it asked for, its browser details and a country, and we may refuse further requests from that internet address, here and at Cloudflare, which carries this website’s traffic: for 30 days (90 if it comes back), or until we lift the block when the request was aimed at this website in particular. We keep the same details, without any block, when a form on this website is sent by a script rather than a person. We do this to keep the website secure. These records are deleted after 90 days, and a block 90 days after it ends.

If you contact us

When you request a scope call through the form, we keep your name, your work email address, your firm’s domain, your message and, if you give it, your phone number. We use them to answer you and to arrange the call you asked for, which are steps you asked us to take before any agreement. They are stored encrypted, with the rest of our correspondence.

When you book a call through the calendar on the contact page, we keep the same details, any note you add and the time you chose, encrypted in the same way. We send the calendar invitation from [email protected]. The booking, with your name, email address, firm’s domain and note, also goes into the Microsoft 365 calendar of the person you will speak to, and the call takes place on Microsoft Teams. The calendar shows only which times are free: it shows nothing about anyone’s other appointments.

The request form and the booking calendar use Cloudflare Turnstile to check that a person, not a script, is sending them. To make that check, Cloudflare receives technical information from your browser, such as your internet address and browser details, and may also use it to improve its bot detection, under its own privacy terms. It runs on the contact page and the sign-in page only.

If you do not become a client, we delete the conversation 24 months after our last exchange, and a booked call 24 months after its date.

If you have an account

You can sign in to your firm’s page with your work email address, using a code we email you or a passkey. We keep your email address (encrypted), the domain it belongs to and when you signed in. For each device that is signed in we keep the kind of browser and system (for example “Chrome on Windows”), a country and a code made from your internet address — never the address itself, and never your browser’s full details. For a passkey we keep its public key and the name you give it; the private key never leaves your device. We record security events on your account — sign-ins, invitations, changes to members and passkeys — and you can see the latest on your Account page.

Signing in uses three cookies, set only when you sign in: one keeps you signed in for up to 30 days (14 days without a visit), one lets a sign-in code work only in the browser that asked for it (15 minutes), and one holds a passkey request (5 minutes). They are needed for the service you asked for, so we do not ask for consent to them.

We use your account to provide your firm’s service and to let its people reach it, and we keep the security record because protecting accounts is in our and your firm’s legitimate interest. Sign-in codes are deleted a day after they expire, ended sessions after a week, answered invitations and requests after 90 days, and security events after twelve months. An account that belongs to no firm is deleted 30 days after its last sign-in. You can delete your account yourself on the Account page: it goes at once, and the security record keeps no link to you.

Your rights

You can ask what we hold, ask for it to be corrected or erased, and object to us using it. Write to [email protected]. If you are not satisfied with our answer you can complain to the Information Commissioner’s Office at ico.org.uk.