1. Who We Are
DNSZone.io is a DNS management and DDoS protection platform operated from the Netherlands. We act as the data controller for the personal data described in this policy.
Contact: info@dnszone.io · Discord
2. What Data We Collect
We collect only the data necessary to provide and secure our services.
| Category | Data | Why we collect it | How long we keep it |
|---|---|---|---|
| Account data | Name, email address, hashed password, registration date, preferred language/theme | To create and manage your account and authenticate you | Until you delete your account, then 30 days |
| Domain data | Domain names, DNS records (A, AAAA, CNAME, MX, TXT, etc.), proxy settings, firewall rules, SSL certificates | To provide DNS hosting, reverse proxy, and protection services | Until you delete the domain or your account |
| Traffic & analytics | Request counts, blocked request counts, bandwidth usage, top countries (country code only, no IP stored in analytics), request timestamps | To show you your domain's traffic statistics and detect attacks | Aggregated stats: 90 days. Real-time data: not stored persistently |
| Attack logs | Attacker IP address, request count, timestamp, type of mitigation applied (block, challenge, iptables ban) | To show you attack history and power the automatic mitigation system | 30 days, then automatically deleted |
| Firewall rules | IP addresses, CIDR ranges, country codes, user agents, URL paths — as entered by you | To enforce the rules you create to protect your domain | Until you delete the rule or your account |
| Session data | Encrypted session token stored in a browser cookie | To keep you logged in securely | Session duration, or until you log out |
| Notification settings | Discord webhook URL (if configured), email address | To send you attack alerts via Discord or email | Until you remove them or delete your account |
| Plan & billing | Current plan tier (free/starter/enterprise), plan activation date | To determine which features you have access to | Until your account is deleted |
3. What We Do NOT Collect
- We do not log or store the full content of HTTP requests passing through our proxy
- We do not store payment card details (payments are handled manually via Discord)
- We do not sell, rent, or share your personal data with third parties for marketing purposes
- We do not use advertising trackers or third-party analytics on the dashboard
- We do not store visitor IP addresses in your analytics — only anonymized country codes
4. How We Use Your Data
We use your data exclusively to:
- Operate your DNS zones and proxy configuration
- Detect and mitigate DDoS attacks and malicious traffic targeting your domains
- Send you attack notifications (only if you configure this)
- Authenticate you securely and maintain your session
- Show you traffic analytics and attack history for your own domains
- Communicate with you about your account (e.g. security alerts, service changes)
- Comply with legal obligations
5. Legal Basis (GDPR)
We process your personal data under the following legal bases:
- Contract (Art. 6(1)(b) GDPR) — Processing necessary to provide the service you signed up for
- Legitimate interest (Art. 6(1)(f) GDPR) — Security logging and attack mitigation to protect our infrastructure and your domains
- Consent (Art. 6(1)(a) GDPR) — Optional notification features (Discord webhook, email alerts) which you can withdraw at any time
- Legal obligation (Art. 6(1)(c) GDPR) — Retaining data where required by Dutch law
6. Data Storage & Security
All data is stored on servers located in the Netherlands (EU). We take the following measures to protect your data:
- Passwords are hashed using bcrypt — we never store plaintext passwords
- All connections are encrypted via HTTPS/TLS
- The database is not publicly accessible and is protected by firewall rules
- Access to production systems is restricted to authorized personnel only
- Attack logs and analytics are automatically purged after their retention period
7. Data Sharing
We do not sell your data. We may share limited data only in the following circumstances:
- Legal requirement — If required by a court order or legal authority under Dutch law
- Infrastructure providers — Our VPS provider (server hosting) may have access to server-level data as part of their infrastructure role. They are not permitted to use this data independently.
- Discord notifications — If you configure a Discord webhook, attack data is sent to the Discord API. Discord's own privacy policy applies to that data.
8. Cookies
We use a single session cookie to keep you logged in. This cookie is:
- Strictly necessary — no consent required under GDPR
- Encrypted and httpOnly
- Not used for tracking or advertising
We do not use any third-party cookies, tracking pixels, or analytics scripts on the dashboard.
9. Data Retention
We retain your data only as long as necessary:
- Account data: retained until account deletion, then purged within 30 days
- Attack logs: automatically deleted after 30 days
- Traffic analytics: aggregated data retained for 90 days
- DNS records and domain settings: deleted immediately upon domain removal
- Session data: expires at the end of your session or when you log out
10. Children
DNSZone.io is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has created an account, please contact us and we will delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be announced in our Discord server and the "Last updated" date at the top of this page will be revised. Continued use of the Service after changes constitutes acceptance of the updated policy.
12. Contact
For privacy-related questions or requests:
- Email: info@dnszone.io
- Discord: discord.gg/Vn54nU3SuT