Never leaves your browser: pasted email headers and MAC addresses are analysed locally on your device and are not sent anywhere.
Sent to third parties to perform the lookup: DNS, blacklist and email health queries go to Google Public DNS (dns.google); WHOIS queries go to rdap.org and the relevant domain registry; ping and traceroute targets go to Globalping (globalping.io), whose probes run the test. These services see the domain, IP or hostname you entered, subject to their own privacy policies.
Results are kept in memory only while the page is open and are discarded when you close or refresh it.