Last updated: 29 October 2026
This Privacy Policy explains how SpamDuster (“we”, “us”) handles personal information in connection with the spamduster.com website, SpamDuster Cloud and the SpamDuster On-Premise appliances. SpamDuster is operated by PortWall, which also runs our billing portal and our website assistant.
SpamDuster filters email, so it handles two very different kinds of information: the limited information we hold about you as our customer (when you contact us, order, or use this website), and the email we filter for you. We treat them differently, and this policy says how.
For information you give us directly — contact, account, billing and support information, and questions you type into the website assistant — we are the data controller.
For the email SpamDuster filters, you are the controller. On SpamDuster Cloud we process that mail on your behalf, only to provide the service. On a SpamDuster On-Premise appliance it is processed on your own servers and stays under your control; we do not receive it.
Each SpamDuster Cloud customer has their own dedicated server, which we run for you on Linode (Akamai’s cloud platform) in the region you choose when ordering. On it, SpamDuster:
We access this information only to provide, secure and support the service, or when you ask us to. We do not read your mail for any other purpose, use it for advertising, or sell it.
When a service ends, mail is held off (senders retry later) for a short drain period, after which the server is removed. A disk image is kept for 15 days so that the service can be restored if it was ended by mistake, and is then deleted.
To catch malware and phishing that a single server cannot see on its own, SpamDuster can check messages with our hosted Cloud Scan Engine. For each message checked it sends a fingerprint: hashes of the attachments, the links in the message, its subject line and the results of its sender authentication checks (SPF, DKIM and DMARC). Where you turn on full scanning, it also sends the first part of the message itself. The Cloud Scan Engine uses this only to return a verdict and to improve detection.
Every SpamDuster server and appliance reports to us regularly so that we can deliver updates, keep it healthy and apply its licence: its software version, update status, disk, memory and certificate status, whether its services are running, and licence usage figures such as the number of mail servers, domains and active addresses in use. These reports contain no message content. We keep them for 90 days.
When your SpamDuster console sends you an alert or a password-reset email, the email address it goes to passes through our mail service to be delivered.
Your SpamDuster server downloads our phishing and threat lists. Downloading them sends us nothing about your mail.
We process personal information where it is necessary to perform a contract with you, where you have consented, where we have a legitimate interest (such as securing our website and our service), or where required by applicable law. Mail we filter on SpamDuster Cloud is processed on your instructions, to provide the service you ordered.
We do not sell personal information. We share it only with trusted service providers who help us operate — such as our cloud hosting provider, payment processing and email delivery — under appropriate confidentiality and data-protection terms, or where required by law or to protect our rights. Questions you type into the website assistant are sent to our AI provider, Anthropic, to generate the answer.
We keep personal information only for as long as necessary for the purposes described above, and to meet legal, accounting or reporting requirements and resolve disputes. The specific periods above apply where stated. When information is no longer needed, we delete or anonymise it.
We use reasonable technical and organisational measures to protect the information we hold: each Cloud customer has a separate server, connections to it are encrypted, and access is limited to those who need it. No method of transmission or storage is completely secure, but we work to safeguard your information.
We are based in the United Arab Emirates. Your SpamDuster Cloud server runs in the region you choose. Where information is transferred to or processed in other countries by us or our service providers, we take steps to ensure an appropriate level of protection consistent with applicable law.
Subject to applicable law, you may request access to, correction of, or deletion of your personal information, and may object to or restrict certain processing. To exercise these rights, contact us at [email protected]. We may need to verify your identity before acting on a request. If you are an email recipient whose mail is filtered by one of our customers, please contact that organisation first; we will help them respond.
spamduster.com uses only the cookies necessary to operate it. The website assistant uses no cookies. Your SpamDuster console uses a session cookie so that you can stay signed in.
Our website and service are intended for businesses and are not directed to children. We do not knowingly collect personal information from children.
We may update this policy from time to time. The version published at spamduster.com with the most recent “last updated” date applies. Material changes will be communicated where appropriate.
For privacy questions or requests, contact [email protected], or write to PortWall, Ajman Free Zone, Block A, Office A-1203, P.O. Box 16000, Ajman, United Arab Emirates.
