Privacy Policy
Privacy Policy
Draft updated: August 31, 2026
Information incomplete: this draft distinguishes inspected code from dated production evidence. Recipients, backup retention and the final retention policy must be completed before it can describe the deployed service as a final privacy notice.
1. Controller
MAIKO BOSSUYT, Entrepreneur individuel (EI)
Service name: le_dns
SIREN confirmed by the operator: 834180911
Contact: privacy@ledns.eu
The owner-confirmed professional address and telephone are listed in the Legal Notices.
2. Public resolver data
The resolver necessarily receives the source IP address and DNS question required to answer a request and apply immediate security controls.
At the last verified production snapshot on 2026-08-29, the service still used the legacy stack. That dated evidence is not proof of current live state; reverify the deployed service before making a current claim. The inspected legacy operational logging pipeline was capable of processing source IP, qname, query type and transport metadata. These records, when emitted, are restricted to service operation, abuse response and incident investigation. The repository configures a 31-day operational-log retention threshold with asynchronous deletion; this is not a verified maximum lifetime for every stored copy. le_dns does not claim that the v2 RAM-only analytics boundary is deployed.
The planned v2 analytics path aggregates observations in memory and releases a closed row only after it reaches 100 queries by default. A released row may contain a registered domain or eligible normalized qname, masked /24 IPv4 or /48 IPv6 network, ASN and organisation, country and subdivision, transport, response result, TTL, query count and an approximate source count. ODoH rows omit source-network attribution. Public-recursive hourly rows expire after 30 days and daily rows after 90 days. Separately stored authoritative customer aggregates expire after 180 days hourly and 730 days daily for capacity and reliability purposes; customer plan windows only limit reporting access and are not storage-deletion schedules.
Restricted source-IP records for authentication, DDNS and administrative security audits are a separate data class. They are not used for public-resolver analytics, customer statistics, marketing or profiling.
3. Account, zone and security data
Managed DNS can process:
| Data | Purpose |
|---|---|
| Email address and authentication factors | Account access, verification and recovery |
| Session source-network prefix and hashed user-agent data | Account security and session management |
| API-key prefix, hash, last-used time and source-network prefix | Authentication, revocation and security audit |
| Domain, DNS records and primary-server address | Primary or secondary DNS service |
| TSIG key name and secret | Authenticated transfers or dynamic updates |
| Magic-link requester IP and hashed user agent | Abuse prevention and account recovery |
| DDNS audit source IP and administrative audit source-network prefix | Attribution of authenticated changes and incident response |
| Team, SAML, approval and WebAuthn metadata | Optional access-control features |
DNS records are customer-provided content and may themselves contain personal data. Customers should not publish sensitive or special-category personal data in DNS records.
4. Paddle billing and historical archives
The new v2 implementation prepares subscriptions through Paddle. le_dns retains Paddle customer, transaction and subscription references; plan, amounts, currency and states; paid and grace periods; and local order/account references. Historical Mollie documents and evidence remain separate; the active Mollie engine is retired. Live sales remain closed during qualification.
The server sends Paddle the selected price, currency, an opaque order reference, environment and merchant-account reference, plus an existing Paddle customer reference where available. DNS-zone content is not sent. Paddle Checkout collects necessary buyer and payment information; loading it contacts Paddle services from the browser. Paddle acts as reseller and controller for its own sale, payment and compliance purposes; its privacy notice describes those activities. Deployment, actual recipients and any international transfers still require verification before commercial opening.
The portal pricing estimator is optional. Only after an explicit request, the browser loads Paddle.js and sends the selected country and postal code to Paddle for a consumer estimate in EUR. Paddle also receives the browser’s network request information. No customer, payment or subscription is created by this preview, and le_dns does not save the selected location to the account. The marketing site does not load Paddle for its static France reference prices.
5. Website requests
The homepage embeds a GitHub Sponsors button. Loading it sends normal request metadata, including an IP address and browser headers, to GitHub. Following other external links is subject to the destination’s privacy policy. The site does not run first-party advertising or behavioural analytics.
6. Purposes and legal bases
- Resolver delivery and immediate security controls: legitimate interests in providing and protecting the service.
- Account and zone data: performance of the requested managed-DNS service.
- Restricted security audit: legitimate interests in account, service and incident security; any claimed statutory retention duty must be confirmed separately.
- Billing: performance of the paid subscription and compliance with applicable accounting obligations.
The operator must document the necessity and balancing of legitimate interests and identify the exact text and data categories for any statutory-retention duty. The 90-day security-audit default is a product setting, not proof of a legal obligation.
7. Recipients and locations
In the production snapshot inspected on 2026-08-29, infrastructure used OVHcloud and Scaleway in France, Germany and Poland. Reverify the deployed inventory and contracts before treating that as current. Paddle is the intended reseller for new v2 sales; the deployed checkout and transmitted data remain to be verified. GitHub receives request data when the Sponsors embed loads. Email-delivery provider and hosting details must be added here if production configuration uses an external provider.
No blanket “no third-country transfer” claim is made while the current recipient inventory, contracts and production configuration remain incomplete.
8. Retention
| Data | Current or planned retention |
|---|---|
| Operational logs | Configured retention threshold of 31 days; asynchronous deletion, not a verified maximum for every copy |
| v2 public-resolver hourly / daily aggregates | 30 days / 90 days after v2 deployment |
| v2 authoritative customer aggregates | 180 days hourly / 730 days daily; customer reporting is independently clamped to the current plan’s 7/30/90-day window |
| Portal sessions | Eight-hour default validity; expired database records become eligible for batch deletion after seven days |
| Restricted administrative and DDNS audit | 90 days by default |
| Revoked credential history | 90 days by default |
| Probe evidence | 48 hours by default |
| Completed BYOK transitions and approval mutations | 365 days by default |
| Active account and zone data | While needed to provide the service |
| Archived deleted-zone metadata | The prepared v2 correction excludes TSIG secrets and adds age-bounded deletion with a 30-day diagnostic default. It is not yet production deletion evidence; contact privacy@ledns.eu for erasure review. Backups require separate treatment. |
| Complete renewal-cancellation confirmations and email outbox | Prepared v2 policy: one year after issue; then body, subject, recipient and delivery queue are purged in batches. Separate mailbox/provider copies and backups require their own verified deletion policy. |
| Minimal cancellation evidence | Prepared v2 policy: linked account/subscription identifiers, confirmation kind and dates, for five years after the later of issue or end of service for dispute handling. This is not a requirement to retain complete emails five years, and does not replace purchase-contract or invoice retention. |
| Billing/accounting records | According to applicable accounting and legal obligations |
These settings describe deletion eligibility and retention targets in the inspected configuration. Actual deletion depends on successful periodic processing. Backup and replica retention must be documented separately; no verified maximum is available here. The service must not promise an automated 30-day zone purge until that job exists and is verified.
9. Billing continuity
Cancellation or failed payment does not cause DNS parking, advertising, answer rewriting or automatic zone deletion. A failed recurring payment receives a seven-day grace period. After the paid period or grace period, the account returns to Free limits; existing zones continue serving, while new creation and paid-only controls can be restricted.
10. Cookies
The management portal uses a Secure, HttpOnly, SameSite=Strict session cookie. The v2 default lifetime is eight hours. The site does not use advertising cookies.
11. Your rights
Subject to GDPR conditions and exceptions, you may request access, correction, erasure, restriction, portability or objection. Contact privacy@ledns.eu. Requests are answered within the GDPR Article 12 timeframe, normally one month, with an extension where legally permitted.
You may complain to the CNIL or another competent EU supervisory authority.
12. Security and incidents
Security reports go to security@ledns.eu. Applicable breach notification duties will be handled under GDPR Articles 33 and 34; this policy does not promise notification where the legal threshold is not met.
13. Changes
Material changes affecting managed-DNS customers will be communicated through the account email or service interface before they take effect where required.