Privacy Policy

last updated: august 2026. domainposture.com is operated by hikmah technologies. this policy supplements the parent hikmah technologies privacy policy; where the two overlap the parent policy governs. the trust & security page covers the same ground from the security side, including the full list of subprocessors.

what we collect

the free tools work without an account. buying a report or a subscription requires one, so what we hold depends on how you use the site.

• account and billing records. your email address, any name you give us, and the organisation and client names you create. sign-in is by emailed link, so we store the email address you sign in with. payments are taken by stripe (outside india) or razorpay (india) — card details go to them and never reach us; we keep the order, the amount, and the subscription state.
• domains you submit. the domain names you scan and the results of the public DNS, TLS and HTTP lookups we run against them — the same lookups any recipient mail server performs. we never ask for or accept credentials to your systems.
• reports we issue. the signed PDF and JSON artifacts and their manifests, kept so a report you were issued stays retrievable and verifiable later. see retention.
• messages you send. the contact form sends the name, email and message you provide to hikmah technologies via Resend. we retain contact messages only as long as needed to respond.

tools that look up your IP read standard HTTP headers forwarded by our hosting provider and display them back to you. we do not store them. when you use the "ip lookup" tool we call ipinfo.io with the IP you submit; ipinfo.io's privacy practices apply to that request.

analytics and advertising tags

we use google analytics 4 (GA4) to measure traffic and how tools are used. GA4 captures page views, a tool_executed event when you run a tool in the browser (recording the tool slug and whether it succeeded), and a mcp_tool_call event when a remote MCP client invokes a tool on our server. event parameters never include the text you typed into a tool — only the tool's identifier and a success flag. IP addresses are anonymized by GA4 before storage. GA4 is processed by google under the EU-US data privacy framework; google's privacy policy applies to that processing.

we also load a google ads conversion tag, but only on the two pages where a purchase can complete — /buy and the order page you land on afterwards. it measures whether an ad led to a purchase. it is not loaded on the rest of the site.

we do not sell advertising space and we serve no ads — no adsense, no ad network, nothing that displays an advert to you on this site.

cookies and consent

GA4 sets first-party cookies (_ga, _ga_*) to distinguish visitors and sessions, and the google ads tag may set its own cookies on the two checkout pages above. signing in sets a session cookie, which is strictly necessary and is not used for measurement.

analytics and ads storage are governed by google consent mode v2. in the EEA, the UK and switzerland they default to denied until you accept, because consent is legally required there. elsewhere they default to granted. either way your explicit choice in the cookie banner wins in both directions — accepting in the EEA turns storage on, declining anywhere turns it off — and we store that choice in a dp_consent cookie so we can honour it on your next visit. you can also disable cookies in your browser settings, opt out of GA via the google analytics opt-out browser add-on, or block analytics with your preferred tracker-blocker.

retention

evidence records and the reports issued from them are kept indefinitely, by design. a report you handed to a reviewer last year has to still resolve and still verify this year, so we do not expire them. deletion is available on request and is handled manually by a person — email the address below — but note that deleting a record also destroys the verifiability of any report issued from it.

your rights

under GDPR you may request access to, correction of, deletion of, restriction or objection to the processing of, or portability of your personal data. under CCPA you may request disclosure of data collected, deletion, and non-discrimination. email [email protected] to exercise these rights.

children

domainposture.com is not directed at children under 13 and we do not knowingly collect personal data from children under 13.

contact

privacy questions: [email protected]. general questions: /contact.