Privacy Policy
Effective October 26, 2026 · Belvic Group, 1-456 Carlton Street, St. Catharines, ON L2M 4X1, Canada
Belvic Group ("Belvic", "we") provides email and domain security checks, fix guides, fixes and monitoring. This policy explains what personal information we collect, why, who we share it with, and your choices. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL).
1. What our security checks look at
Our free tools and monitoring read only public information about a domain: DNS records, domain registration details, the public website, public certificate logs and public blocklists. Email headers pasted into the Fake Email Detector are checked in your browser and never sent to us. We never log into your systems, test passwords or access email content. Scan results about a domain are business information, not personal information, but we treat them carefully too.
2. Information we collect
| When | What | Why |
|---|---|---|
| You ask us to email a report | Email address, optional name, the domain checked, the date, and whether you agreed to tips and offers (with the exact wording you agreed to) | To send the report you asked for; to keep a record of your consent; to follow up only if you opted in |
| You contact us | Name, email, phone (optional), business domain, your message | To reply and provide the service you asked about |
| You buy a package | Payment details are handled by Square; we receive your name, email, amount and what you bought, then the business name, domain, contact email and DNS provider you give us on the setup form | To deliver the service, send your guide and reports, and keep business records |
| You're an IT partner | Company name, contact email, logo address, and the client domains and client names you add | To monitor those domains and send you alerts and reports |
| We monitor a domain's DMARC reports | Aggregate reports from email providers: sending server addresses, message counts and pass/fail results (no email content) | To show how many fake emails used the domain and alert you to problems |
| Business research | Business names, websites and email addresses that businesses publish on their own websites or in public listings | To study small-business email security in aggregate and, where the law allows, to contact businesses about relevant services |
We publish study results only in aggregate, never naming a business, and keep industry or country figures to groups of at least 20.
3. Email and consent (CASL)
- We send you a report only when you ask for one, and service emails (setup, alerts, reports) only while you're a customer.
- We send tips and offers only if you ticked the box agreeing to them, or where CASL otherwise allows (for example, an existing business relationship).
- Every marketing email identifies Belvic Group, includes our mailing address, and has a working unsubscribe link. We act on unsubscribes promptly and keep a do-not-contact list so you aren't contacted again.
4. Who we share it with
We don't sell personal information. We use these service providers, which process information on our behalf:
- Square (payments and subscriptions)
- Resend (sending email)
- GitHub (secure, private storage of customer, order and report records)
- Cloudflare (website hosting and domain)
- Google Public DNS, Cloudflare DNS, RDAP registries, crt.sh certificate logs and public blocklist services (to run checks on domains, not on people)
- Our email provider, for the mailbox that receives replies and DMARC reports
Some of these providers store information outside Canada, mainly in the United States, where it may be accessed by authorities under local law. We may also disclose information if required by law.
IT partners: if your IT provider monitors your domain through Belvic, your alerts and reports go to them, and we don't contact you about our own services.
5. How long we keep it
- Report requests and consent records: up to 3 years, or until you ask us to delete them (we keep the fact that you unsubscribed so we don't contact you again).
- Customer and order records: as long as you're a customer, then up to 7 years for tax and accounting.
- DMARC report summaries: up to 24 months.
6. How we protect it
Records are stored in private repositories with access limited to Belvic, private links in our emails are signed so they can't be guessed, and our service accounts use strong passwords and two-factor authentication. No method is perfect, and we'll notify you and the Privacy Commissioner where the law requires if a breach creates a real risk of significant harm.
7. Your choices and rights
You can ask to see, correct or delete the personal information we hold about you, withdraw consent to marketing at any time, or ask questions about this policy. Email [email protected], and we'll reply within 30 days. If you're not satisfied, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.
8. Cookies
Our website doesn't use advertising or tracking cookies. Our hosting providers may keep standard technical logs (such as IP address and time of visit) for security.
9. Changes
We'll post any changes here with a new effective date, and tell customers by email about significant changes.
Contact
Privacy questions: Beltus Bejanga, Belvic Group · [email protected] · 905-353-5279 · 1-456 Carlton Street, St. Catharines, ON L2M 4X1