Privacy policy
Effective October 13, 2026
Peerborough, Inc. (“we”) processes personal data through the Genharden DMARC website (genharden.com), the service (emailsec.genharden.com, with sign-in at account.genharden.com), payments, meeting bookings and the contact form as described below.
Who operates this service
Company: Peerborough, Inc. Address: 5F v1116, 6, Teheran-ro 79-gil, Gangnam-gu, Seoul, Republic of Korea
What we collect and how
When you sign up we ask for your email address and your name (first and last name), and for your company name only if you choose to give it. When you sign up or sign in we process records of sending and checking the sign-in codes we email you and information about the device you sign in from (browser and operating system family, approximate country). For security and to respond to incidents we keep a sign-in record of sign-in attempts and their outcome (time, connecting IP address, approximate country, browser family, outcome and information that shows which account it concerns). So that the record can still be tied to an account after the account is deleted, we keep the deleted account's email address and the dates it was created and deleted separately. We also store the record of your agreement to the terms and this policy (whether you agreed, the versions, the time, the connecting IP address and approximate country) and your account settings (time zone and page language). A workspace holds its name, the domains it manages, its members' email addresses and roles, and join requests and invitations (the invited email address and role). To prevent abuse we limit the number of requests and briefly keep the connection records needed for that. The reports, check results, observations and the records members make as you use the service are described under “Domain reports and mail analysis” and “Domain checks, observations and notices”, and payment information under “Payments”. What we collect for meeting bookings and the contact form is described in those sections. If you email us, we process your email address and message.
Why we use this data and your consent
We use this data to create and sign in to your account, to run your account and workspace (member management and notices about join requests, invitations and approvals), to provide the service (receiving and analyzing reports, checking domains, showing observations and sending email notifications), to apply your plan and confirm payments, to prevent abuse, and to answer your inquiries. We show your name in the service and use it to address you when we contact you about inquiries or payments, and we use your company name to identify you as a customer and to support you. We may aggregate or anonymize the information the service processes so that it no longer identifies a customer, its domains or any individual, and may use the result to improve the service and to compile and publish statistics. We do not use that information to identify a customer or an individual again. The sign-up and sign-in pages present the terms and this privacy policy, and completing sign-up or sign-in records your agreement to the versions presented. You cannot use the service without agreeing. Your company name is optional: you can sign up and use the service without giving it.
Your account and workspace
Workspace members can see each other's names, email addresses and roles. When someone asks to join a workspace, its owners and admins see the requester's email address and receive a notice; inviting someone sends an invitation email to that address. What is done in a workspace (changes to members and roles, domains, senders, settings and the plan, among others) is kept as an activity record with the email address of the person who did it and of the person it was about, and the time. The workspace's owners and admins can read it. You can change your name and company name on the account page (My account), delete your account there yourself, and ask us to delete a workspace using the contact below.
Domain reports and mail analysis
When you put the service's report address in a domain's DMARC record or a similar record, mail receivers send reports about mail sent using that domain to the service. We receive, store and analyze these reports; workspace members can see the analysis and the aggregate reports as they were received. Aggregate (RUA) and TLS reports contain the sending servers' IP addresses and names, message counts, authentication results, and the reporting receiver's name and contact address; they do not contain email addresses or message content. To tell which sending service the mail came from, we look up public information about the sending servers' IP addresses and store it with the reports. Failure (RUF) reports describe a single message that failed authentication and may contain personal data such as the original message's addresses, subject or content. We store the items needed for analysis from them, and keep the email carrying a failure report like other report emails. When you send a test message to a workspace's check address, we analyze and store its headers, relay path, authentication results and what its body is made of (formats, links, attachment details and the like), and keep the original message. Members can see the analysis and the original, and can delete a received message themselves. A message sent to the address given by the website's check tool is analyzed for its headers and authentication results to show you the result; the message and the result are deleted within ten days. A test message may contain the sender's and recipients' addresses, the subject and the body, so please send one written for testing.
Domain checks, observations and notices
We regularly check the mail-related DNS settings, the registration data and the mail server security settings of the domains registered in your workspace and of their subdomains, and store the results and changes. To do so we look up public information such as DNS, domain registration data and network information; domain names and server IP addresses are passed to the services that provide it. We never send people's names or email addresses. Mail server checks send no mail. When a domain name or an IP address is entered in a tool of the service or the website, we look up public information in the same way and show the result. We do not store the result; we keep only the records needed to prevent excessive use and to look into use and errors. We analyze the reports and check results to find configuration errors and changes (observations) and, from them, show you the things to do. What members record about a sender, such as a decision and its reason, a name, an owner and a note, is stored with who changed it and when, and workspace members can see it. We email workspace members about changes and risks, things to do and regular summaries, and can also post notifications to an outside channel the workspace connects (for example Slack). Notifications contain workspace information such as domain and sender names and message counts, and we record what was sent to whom so that the same notification is not sent again. Each member can choose which notifications to receive. Messages the use of the service depends on, such as those about a trial or a plan's limits, are sent regardless of notification settings.
Payments
Online orders and payments for paid plans are taken directly by Paddle, the Merchant of Record. The seller is Paddle.com Market Limited (United Kingdom) or, depending on where the purchase is made, another Paddle group company named in Paddle's buyer terms. The email address, payment method, billing country and other details you enter in the checkout are collected by Paddle for payment, tax, receipts, refunds and fraud prevention, under Paddle's privacy policy. When the checkout opens we pass Paddle your workspace's identifier, the page language and the email address of the account you are signed in with (it fills in the checkout's email field, where you can change it), and we receive from Paddle what we need to link the subscription to your workspace and apply your plan (Paddle's customer, subscription and transaction numbers, plan and billing interval, amount and currency, subscription status and period, and whether a payment was refunded or charged back). When a plan is changed, we record the account that changed it, when, and what was changed. We never store card numbers or other payment method details entered in the checkout. If you ask to pay by bank transfer with a tax invoice in Korea, we collect the company name, business registration number, representative's name, business address, business type, the email address for tax invoices and a contact person's details to issue tax invoices and confirm payments. When we refund a payment made by bank transfer, we may ask for a copy of your bankbook to confirm the bank account the refund goes to. We use the bank name, account number and account holder's name on it only to make the refund, and keep the copy with the refund record.
Meeting bookings and visit requests
When you book an online meeting we collect your name, company name, email address, the meeting time and time zone you chose, the page language, your consent and the time of booking. Any note is optional. When you request an in-person visit we collect your name, company name, email address, phone number, the place to visit, your preferred times and the best time for a call; a note is optional. If you arrive from a link in a Genharden service screen, we connect the booking to that service record (for example, your workspace). When a booking or request is accepted we also store the connecting IP address, the approximate country, region and city derived from it, and the version of this policy you agreed to. We use the connecting country to decide whether an in-person visit can be offered. We use this information to send confirmation and cancellation emails for meetings and visits, to phone you when a visit needs arranging, to hold the meeting and to prevent abusive bookings. You can reschedule or cancel a meeting, and we keep a record of such changes. We retain meeting information for one year from the booking date and then delete it.
Contact form
When you send a message through the contact form we collect the topic, your name, email address and message, the page language, your consent and the time of submission. The company name is optional. When the message is accepted we also store the connecting IP address, the approximate country, region and city derived from it, and the version of this policy you agreed to. We use this information to read and answer your message by email, to handle the emails we exchange afterwards and to prevent abuse. If the address you write from has an account, we look up its workspaces and plan to help us answer. Our answer and the emails we exchange afterwards are kept with the inquiry. We retain inquiry information for one year from the date of submission and then delete it.
Retention and deletion
Unless a specific lawful reason requires a different period, account and workspace information and records of agreement to the terms and this policy are kept until completion of withdrawal and closure of the relevant account or workspace. The record of a signed-in device is deleted when that device signs out. The sign-in record is kept for security and incident response for as long as we operate the service; it remains after an account is deleted, together with the deleted account's email address and the dates it was created and deleted. Service data is kept for the same periods on every plan. The reports and report emails we receive, test messages received in a workspace and their analyses, records of changes, the latest check results, observations, the records members make, notice records and the workspace's activity record are ordinarily kept until completion of withdrawal and closure of the relevant account or workspace; data may be deleted earlier when a domain or workspace is deleted, a member deletes something themselves, a lawful deletion request is made or the relevant processing purpose ends. Sign-in code records and records used to limit requests are deleted within two days of their last use; mail sent to a report address that we refuse because it is neither a report nor a test message, after 7 days; and stored lookups of public information and check records without changes, after 90 days. The original of a test message a member deletes is ordinarily removed within two days. Any shortening of an announced retention period will be notified at least 30 days in advance, except where earlier deletion is required by law. Deletion from active systems is completed as part of withdrawal or workspace closure without undue delay. If return is requested by an authorised person, we securely transmit the data that person is entitled to receive or provide access to a usable copy for a reasonable notified period; actual download or acknowledgement is not a condition for completing the return. When an individual member withdraws while a workspace remains in use, that member’s personal data, other than the sign-in record described above, is deleted or otherwise lawfully handled, and other workspace data is retained only to the extent lawfully necessary to provide the service to its customer. After closure, retention is limited to records required by law, the sign-in record and the deleted account's email address and dates described above, residual copies in protected backups, and data strictly necessary for a return or transition expressly requested by the customer. Backup copies are isolated from ordinary use and deleted at the earliest practicable point in their deletion cycle; if restored, the relevant deletion is applied again. Copies held for a requested return or transition are limited to that purpose and a notified period and are then deleted without undue delay. Payment and refund records and tax invoice information are kept for five years as required by Korea’s Act on Consumer Protection in Electronic Commerce and Framework Act on National Taxes where applicable. Retention for meetings and inquiries is described in those sections. Once the purpose is fulfilled or deletion is required, we delete the information without undue delay, unless retention is required by law. Electronic records are deleted using methods intended to prevent recovery. Printed records are shredded or otherwise destroyed. Information that must be retained by law is kept separately for the required purpose and period.
Website analytics
We use Google Analytics 4 (GA4) to analyze visitor counts, approximate countries and cities, referral sources and campaigns, and page views on the website (genharden.com). GA4 distinguishes browsers using random cookie identifiers and processes page URLs, referring pages, browser and device information, and usage events. Google uses connection IP addresses to derive approximate locations and operate its services, including spam detection, and states that raw IP addresses are discarded after use. City estimates may differ from your actual location. We do not include your name, email address or domain in analytics events, and the service app does not use GA4. Google Signals and advertising personalization signals are disabled. Analytics event retention follows the GA4 property retention settings. See Google’s explanation of how it uses this information.
Processors and external services
Supabase Pte. Ltd.: sign-in authentication and database hosting for account, workspace, service, meeting booking and inquiry data. Vercel Inc.: hosting and server functions for the website and the service apps. Amazon Web Services Korea LLC: sending sign-in codes, workspace and domain notices, meeting confirmations and answers to inquiries; receiving and storing report emails, test messages and inquiry emails. Cloudflare, Inc.: protection against automated and abusive sign-ups, bookings and messages. Fly.io, Inc.: running the server used for mail server checks. Google LLC: website (genharden.com) traffic and acquisition analytics through GA4. Paddle, which handles payments, is not our processor: it processes payment data itself as the seller (see “Payments”). We manage processing so it is limited to the work entrusted to each provider. We will provide relevant information if connecting another service changes how personal data is processed.
International infrastructure
Our website and service app servers, the Supabase database, and the Amazon Web Services used to send and receive email and store reports use infrastructure in the United States. When you visit the website or use the service, the information needed to provide it is transmitted and processed over encrypted connections. Retention is described above. Mail server checks run on Fly.io infrastructure in the United States. Payment information is collected by Paddle directly in its checkout and, together with what we pass when the checkout opens, processed on infrastructure Paddle operates outside your country, including the United Kingdom. GA4 analytics information is transmitted to Google over encrypted connections when you use the website and may be processed on Google infrastructure outside your country, including the United States. Contact support@genharden.com with questions or requests to suspend processing involving external infrastructure. Restricting processing required to provide the service may prevent us from providing it.
Your rights and data protection
You may request access, correction, deletion, suspension of processing, or withdrawal of consent using the contact below. We handle requests without undue delay after verifying your identity and explain any restrictions required by law. We limit access to personal data to those who need it for their work and apply encrypted connections and database access controls.
Privacy contact
Privacy inquiries and requests: Peerborough, Inc. Email: support@genharden.com Address: 5F v1116, 6, Teheran-ro 79-gil, Gangnam-gu, Seoul, Republic of Korea When this policy changes, we publish the changes and effective date on this page.