Privacy Policy

Last updated: 8 October 2026

1. Controller

Piremus Cross LLC, 1209 Mountain Road Pl NE STE N, Albuquerque, NM 87110, USA
E-Mail: privacy@hiddenprimary.ch

2. Data We Collect

We collect and process the following personal data:

  • Account data: Name, e-mail address, hashed password (or OAuth provider ID).
  • Billing data: Subscription plan, payment references via our payment provider (Stripe). We do not store credit card numbers.
  • Zone data: DNS zone names, primary server IPs, TSIG keys (encrypted at rest), zone transfer history.
  • Usage data: Aggregate DNS query statistics per zone (no individual query logs).
  • Technical data: IP address, browser user agent, and session identifiers for authentication and rate limiting.

3. Purpose and Legal Basis

  • Contract performance: Account management, DNS zone hosting, billing.
  • Legitimate interest: Security (rate limiting, abuse prevention), service monitoring, aggregate statistics.
  • Legal obligation: Bookkeeping and tax records as required by Swiss law.

4. Data Sharing

We do not sell personal data. Data is shared only with:

  • Stripe: Payment processing (billing data only).
  • Infrastructure providers: Server hosting in Swiss and European data centres.
  • Authorities: Only when legally required by Swiss law.

5. Data Retention

  • Account data is retained for the duration of the account plus 30 days after deletion.
  • Zone transfer history is retained for 12 months.
  • Query statistics are aggregated and retained for 12 months.
  • Billing records are retained for 10 years as required by Swiss law.

6. Security

Passwords are hashed with bcrypt. TSIG secrets are encrypted at rest with AES-256-GCM. Connections to the website, the API and our mail server use TLS. Zone transfers (AXFR/IXFR) and DNS queries use the standard DNS protocols: transfers are authenticated with TSIG, and like all conventional DNS traffic they are not encrypted. Sessions are protected with HMAC-SHA256 signatures and CSRF tokens.

7. Your Rights

Under Swiss data protection law (nDSG), you have the right to access, rectify, or delete your personal data. You can delete your account yourself under Account. Deletion is scheduled rather than immediate: the account keeps working for 30 days, you can call it off during that time, and on that date we remove every zone from our nameservers, delete the zone data and the account, and end any active subscription. You may also request data portability or object to processing based on legitimate interest.
Contact: privacy@hiddenprimary.ch

8. Cookies & Analytics

We use only essential cookies for session management and CSRF protection. We do not use tracking cookies or third-party advertising.

We count visits with GoatCounter. GoatCounter runs on our own web server, so no usage data goes to a third party. It sets no cookies and does not track you across sites.

We store aggregated counts only, never individual visits: the page, the referring page, browser and operating system, screen size, and country. For visits from the USA, Russia and China we also store the region. Country and region come from your IP address. We do not record query strings. To avoid counting repeat views twice, GoatCounter uses your IP address together with your browser's user agent for at most 8 hours and then deletes it. We never store your IP address permanently. Pages whose address contains a one-time link (password reset, email verification, team invitations) are not counted at all. This processing is based on our legitimate interest in understanding website usage.

9. Changes

We may update this policy from time to time. The current version is always available at this URL.