Privacy Policy

1. Who we are

xteam is operated by X2 Consulting Ltd, a New Zealand company. We provide free email security tools and a cybersecurity blog for New Zealand businesses. You can contact us at hayden@xteam.co.nz or via the contact form.

2. What information we collect

Tools you use

• Domain checks (MailCheck, DMARC Analyzer, etc.) — we process the domain name you enter. This is not stored beyond the life of the request.
• Bulk MailCheck — we collect your email address to deliver results and your IP address for rate limiting. Bulk check results are deleted after 30 days.
• Email header analysis / TLS-RPT analyzer — the data you paste is processed server-side and not stored.

Contact form

When you use the contact form we collect your name, email address, company name (optional) and message. This is delivered to us by email and not stored in our database.

Newsletter

If you subscribe to our newsletter we store your email address, optional name, the date you subscribed, and your IP address (for abuse prevention). We store this until you unsubscribe. Every newsletter email includes an unsubscribe link.

Analytics and advertising (consent-gated)

If you accept analytics cookies we use Google Analytics 4 to collect anonymised usage data (pages visited, session duration, general location by country). We use Google AdSense to serve relevant advertising. These services are only activated after you provide consent via our cookie banner. You can withdraw consent at any time using the "Cookie preferences" link in the footer.

Server logs

Our web server automatically records IP addresses, browser type, and pages requested in access logs. Logs are retained for up to 30 days and used only for security and diagnostic purposes.

3. How we use your information

• To provide the tools and deliver results you requested
• To respond to contact form enquiries
• To send newsletters you have explicitly subscribed to and confirmed
• To prevent abuse (rate limiting by IP address)
• To understand how the site is used (analytics, with consent)
• To serve advertising that helps fund free tools (AdSense, with consent)

4. Who we share your information with

We do not sell your personal information. We share data only with:

• Google — Analytics 4 and AdSense (only if you have consented). See Google's Privacy Policy.
• Our hosting provider — for server infrastructure (New Zealand / Australia region).

5. Cookies and local storage

Name	Purpose	Expires
xteam_admin	Admin login session (admin users only)	Session
cookie_consent (localStorage)	Stores your analytics/advertising preference	Until cleared
Google Analytics cookies	Usage analytics (only if consented)	Up to 2 years
Google AdSense cookies	Advertising (only if consented)	Up to 1 year

6. Your rights under the NZ Privacy Act 2020

You have the right to:

• Ask whether we hold personal information about you
• Request access to that information
• Ask us to correct inaccurate information
• Ask us to delete your information (we will comply unless we have a legal reason to retain it)

To exercise these rights, email hayden@xteam.co.nz. We will respond within 20 working days as required by the Act.

7. Data retention

• Bulk check results and IP records: deleted after 30 days
• Newsletter subscribers: retained until unsubscribe
• Server logs: 30 days
• Contact form submissions: not stored (email only)

8. Security

We use HTTPS for all connections. Sensitive settings (API keys, passwords) are encrypted at rest using AES-256 (Fernet). We regularly review security practices. No system is 100% secure — if you discover a security issue, please disclose it responsibly to hayden@xteam.co.nz.

9. Third-party links

Our blog may link to external websites. We are not responsible for the privacy practices of those sites.

10. Changes to this policy

We may update this policy from time to time. The date at the top indicates when it was last revised. Continued use of the site after changes constitutes acceptance of the updated policy.

11. Contact

Privacy enquiries: hayden@xteam.co.nz or via the contact form.

Privacy Commissioner (NZ): privacy.org.nz