Privacy Policy

1. Data controller

2. Categories of personal data

• Account data — organisation or personal name, e-mail address, hashed password, and the date and time you accepted the Terms of Service.
• DNS query logs — queried domain, filtering verdict, client source IP address, profile and timestamp. These are personal data.
• Billing data (company accounts) — legal company name, VAT ID, billing address including country, and optionally IČO and DIČ. Payment cards are processed by Stripe (see section 4); we store only the card brand, its last four digits and a payment token, never the card number.
• Support communications — the content of support tickets and related e-mail correspondence.
• Security logs — an audit trail of account actions (e.g. sign-in attempts) including IP address and browser user-agent.

3. Purposes and legal bases

• Providing and billing the service. Art. 6(1)(b) contract
• Security and abuse prevention. Art. 6(1)(f) legitimate interests
• Legal obligations such as accounting. Art. 6(1)(c) legal obligation

4. Recipients and processors

The service is hosted on our own infrastructure in the EU. We do not sell personal data. We use the following processors:

• Stripe Payments Europe, Ltd. — card payments and stored payment methods.
• Cloudflare, Inc. — the Turnstile CAPTCHA on the sign-up form, which processes your IP address and browser signals to distinguish humans from bots.
• SMTP2GO — delivery of transactional e-mail (verification, invoices, support replies).
• Google Ireland Ltd. — this website loads its fonts from Google Fonts, which discloses your IP address to Google when the page renders.

5. International transfers

Data is processed in the EU. Where a processor transfers data outside the EEA, it is under appropriate safeguards (Standard Contractual Clauses).

6. Retention and account lifecycle

DNS query logs are kept per plan, then deleted: Free 1 day, Home 30 days, Pro 90 days, Business 365 days. Account data is kept while the account is active and as required by law (e.g. accounting).

• Unverified accounts — an account whose e-mail address is never verified is deleted 30 days after registration.
• Dormant accounts — an account without an active paid subscription that has sent no DNS queries for 30 days is marked dormant; if it stays dormant for a further 180 days it is deleted together with its data. The mark is removed automatically when activity resumes.
• On deletion (self-service or lifecycle) all configuration, query logs and statistics are erased. Unpaid invoices are retained with the associated billing identity for as long as accounting law and the assertion of legal claims require.

7. Your rights

You have the right to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may lodge a complaint with the Czech supervisory authority Úřad pro ochranu osobních údajů (Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz) or the authority in your EU member state. Exercise your rights via info@dnsdome.com.

8. Whether provision is required

Account data and source-IP data are necessary to provide the service; without them the service cannot be provided.

9. Automated decision-making

None. We carry out no automated decision-making or profiling with legal or similarly significant effects.

10. Cookies

The customer panel sets a single strictly necessary session cookie (dnsdome_session) used solely to keep you signed in. We use no analytics, tracking or marketing cookies, so no cookie consent is required.