Effective date: January 1, 2026.
HireAmino ("Amino", "we", "us") is operated by WBVP Enterprises Inc. This page explains what information we collect, why, who we share it with, and the choices you have. We keep this short because we collect very little.
What we collect
- Waitlist sign-ups. If you join our waitlist, we collect the name and email address you provide, so we can send you updates about HireAmino.
- If you contact us — by email or by booking a call — we receive the information you choose to share (such as your name, email, and message).
- Basic technical data. Like any website, our hosting provider automatically logs standard request data (such as IP address, browser type, and pages requested) to deliver and secure the site.
The deliverability audit
Our open-source deliverability audit — available as a local skill and as a GitHub Action for CI — runs on your own machine or CI runner. It reads public DNS records for a domain you choose and shows you the results there. It does not send that data to us and never asks for your credentials. (The GitHub Action can optionally post its scorecard as a comment on your own pull request, using a token you provide — that stays entirely within your GitHub.)
If you use a hosted version of the audit on this site, you submit a domain name (not personal information) and we use it only to run that check and return the result. We do not use it to build a profile of you.
The header analyzer
If you use the header analyzer at /headers, you either send an email to our probe address or paste or upload a message's source. When you paste full source or upload a .eml, the whole message — including its body — is transmitted to our server so we can verify the DKIM signature (which requires the body). We process it transiently in memory and never store, log, or read the body's content — only the authentication records (SPF, DKIM, DMARC, routing, TLS) are used, to generate a deliverability scorecard. If you only want to analyze headers, paste the header block alone and no body is sent. Nothing about the message body is persisted. To keep it simple, send or paste a plain test message with no confidential content, quoted thread, or attachments.
To run the service and enforce a fair-use limit (five checks per 30 days), we keep a short record of each check: the sending domain, the email address you sent from, and the scorecard summary (which checks passed or failed). We use it only to deliver your result, prevent abuse, and improve the tool — we do not sell it. This record is automatically deleted after 30 days. If you paste or upload headers on the website instead of emailing us, the record is domain-only (no email address).
Email monitoring (Watchtower & DMARC reports)
If you enroll a domain in our monitoring service (at /monitor), we collect the domain you want watched and the email address for alerts, and we keep a history of that domain's authentication posture (its public SPF and DMARC records, our scorecard of them, and — only for DKIM selectors your own DMARC reports show you signing with — the state of those keys) so we can alert you when something changes. We confirm your email first by sending you a link to click; for DMARC-report reading we additionally ask you to prove you control the domain by adding a DNS TXT record.
If you enable DMARC report reading, you point your domain's DMARC reporting address at us, and mail providers (such as Google, Microsoft, and Yahoo) send us aggregate XML reports about messages that used your domain. These reports contain the IP addresses and authentication results of systems sending mail as your domain — which can include third parties or people spoofing you. We use this data only to show you who is sending as your domain and to alert you to problems; we do not use it to build a profile of you, and we do not sell it.
Monitoring retention has two different clocks, and it's worth stating them separately. Your enrollment — the domain and the alert email address — is kept for as long as monitoring is active, because that record is what the monitoring runs on; unsubscribe and it is deleted. Raw DMARC report attachments are held only long enough to parse them (and to replay a parse that failed), then dropped. The derived data — posture history and DMARC report rollups — rolls off after 30 days on a rolling basis on the free tier; longer history is a paid feature. Alerts are sent from report.hireamino.com and include a one-click unsubscribe, and you can stop monitoring a domain at any time from your dashboard.
The Agent Comprehension Score
If you use the Agent Comprehension Score at /agent, you paste an email you're writing (its subject and body), optionally tell us what you want the recipient to do, and give us an email address to send the result to. We email you a confirmation link first, and we only run the score after you click it.
To produce your scorecard, an AI model reads your pasted email blind — without being told what you intended — and a second call grades what it understood against your stated intent. We repeat that read three times and report the median, so the result reflects more than one run. This is a context-free simulation: the model has no prior thread, no information about your recipient, and no connection to their actual mail provider, so the score measures whether your message survives machine reading — it is not a prediction of what any specific inbox assistant will do. Every scorecard names the exact model and rubric version that produced it.
Scoring runs on Cloudflare Workers AI. Your content is used only to generate your result and is not used to train AI models. Because we email you a confirmation link before scoring, the email content you paste is transmitted to us and held until you click it — so please don't paste secrets, credentials, regulated data, or confidential threads.
We delete the email content you paste as soon as we've scored it — and within 24 hours at the latest, even if you never confirm. After that we keep only the email address you gave us, to deliver your result, enforce a fair-use limit (two per day), and honor unsubscribes. We never sell it and never use it to build a profile of you. This record is deleted after 30 days on a rolling basis, or whenever you ask. Results are sent from report.hireamino.com with a one-click unsubscribe; unsubscribing also stops us sending new scorecards to that address.
The Email Cryptographic Posture report (CBOM)
If you use the CBOM generator at /cbom, you give us a domain name and, optionally, one or more DKIM selector names. Unlike our Contact List Reality Check, this tool runs on our server, not in your browser — so those values are sent to us in the web address, and on to Cloudflare's public DNS resolver to perform the lookups. Everything we read is already public: your DNS records, and the MTA-STS policy you publish over HTTPS. It is the same information any mail server reads before delivering a message to you.
The scan is read-only and nothing about it is stored. We do not write to your DNS, we send no mail, and we keep no record of the domains scanned or the reports generated — the report is built on the fly and handed straight to you. There is no account, and we never ask for an email address. Result pages are marked so search engines don't index them. No email content, credentials, private keys or files are involved at any point.
Two things to be aware of. First, because the domain travels in the web address, it can appear in your own browser history and in ordinary web-server request logs, which are retained only as long as needed to operate and secure the site. Second, we apply a fair-use limit of 8 reports per hour per visitor; to do that we store a one-way hash of your IP address with a counter that expires automatically about an hour later. We can't recover the address from it.
The Contact List Reality Check
If you use the Contact List Reality Check at /list, your contact list is analyzed entirely inside your own browser. When you drop in a CSV or paste addresses, the file is read locally and every check — syntax, disposable domains, role addresses, duplicates, likely typos — runs on your device. Your list is never uploaded to us. The addresses are never transmitted anywhere, and we never see, receive, or store them. You can confirm this yourself: open your browser's developer tools, watch the Network tab, and you'll see that analyzing a list makes no network requests. Any "clean list" you download is generated on your device.
To flag dead domains and show which mail providers your recipients use, your browser looks up the bare domain names from your list (for example gmail.com) — never the email addresses — by querying Cloudflare's public 1.1.1.1 DNS resolver directly from your device. Those queries go to the public resolver, not to us; we do not see, receive, or store them, and no email address is ever included. This is standard public DNS, the same lookup any mail server performs to deliver a message.
How we use information
- To send you the updates you asked for when joining the waitlist.
- To respond to your messages and run audits you request.
- To run the header analyzer, return your scorecard, and enforce its fair-use limit.
- To run the Agent Comprehension Score on an email you paste, return your scorecard, and enforce its fair-use limit.
- To monitor a domain you enroll, read its DMARC reports if you enable that, and alert you when its posture changes.
- To operate, secure, and improve the site.
Who we share it with
We do not sell your information. We share it only with service providers that help us run HireAmino, and only as needed:
- Cloudflare — website hosting, security, and the AI model (Workers AI) that generates your Agent Comprehension Score.
- GetLaunchList — waitlist sign-ups.
- HubSpot — if you book a call with us.
- Resend — sends your header-analyzer scorecard, Agent Comprehension Score, and monitoring-alert emails.
- Google Fonts — serves the fonts used on the site.
We may also disclose information if required by law.
Cookies and tracking
We do not use advertising or cross-site tracking cookies on this site. Third-party services we embed (such as the waitlist form or booking link) may set their own cookies when you use them, governed by their own privacy policies.
How long we keep it
We keep waitlist and contact information until you ask us to remove it or unsubscribe. Technical logs are retained only as long as needed to operate and secure the site. Header-analyzer records (the sending domain, the address you emailed from, and the scorecard summary) are automatically deleted after 30 days. For the Agent Comprehension Score, the email content you paste is deleted as soon as it is scored and within 24 hours at the latest, even if you never confirm; your email address is deleted after 30 days on a rolling basis. For monitoring, the enrolled domain and alert email are kept while monitoring is active (deleted when you unsubscribe), while the derived posture history and DMARC report data roll off within 30 days.
Your choices
You can unsubscribe from our emails at any time using the link in each message. You can also ask us to access or delete the information we hold about you by emailing [email protected].
Security
We take reasonable measures to protect the limited information we hold. No method of transmission or storage is completely secure, but we work to keep your data safe.
Changes to this policy
We may update this policy from time to time. When we do, we'll revise the effective date above.
Contact
Questions about this policy? Email [email protected].