Privacy Policy

1. Who we are

Quathos Monitor is a domain monitoring platform: you add a domain hosted anywhere and we read, at the interval of your plan, what it already publishes in public DNS, in the registry (RDAP), in Certificate Transparency logs and over TLS, alerting you when it changes. Optionally, and in the same plan, we also act as your managed authoritative DNS: you delegate your domain’s nameservers to ns1.qflaryx.com and ns2.qflaryx.com, and we host and answer for your zones and DNS records, including DNSSEC signing and an API. Quathos Monitor is owned and operated by Quathos LLC, a company based in Dallas, Texas, United States. For any privacy request, write to contact@quathos.com.

Quathos Monitor is a multi-tenant service organized around organizations. When your organization is the customer, it decides which zones and records it publishes through the platform; Quathos LLC operates the infrastructure that serves them.

2. Data we collect

We collect only the data needed to operate the Service:

• Account data: name, email address, and a hash of your password. We never store passwords in plain text.
• Organization data: organization name, members, and their roles.
• DNS data: the zones and records your organization creates and publishes through the platform.
• DNS query metadata: technical, aggregated operation data about queries our nameservers answer — query volume, response codes (rcodes), and record types. This will power the analytics feature, which is rolling out.
• Audit logs: a record of the actions taken on zones, records, and organization settings.
• API keys: stored only as hashes. The plaintext is shown once, at creation.
• Technical cookies: session and preference cookies. See the Cookie Policy.

3. DNS records are public by nature

One thing is specific to DNS and worth stating plainly: the records you publish in a zone hosted on Quathos Monitor are public data. That is the purpose of authoritative DNS — our nameservers answer queries from any resolver on the internet, without authentication. Anyone who queries your domain receives the records you chose to publish.

This Policy therefore protects your account, organization, and operational data. It cannot make published DNS records private, because the protocol itself makes them public. Do not put secrets in DNS records.

4. How we use data

We use the data we collect to:

• Host your zones and answer DNS queries for them, including DNSSEC signing.
• Authenticate users and API keys, and keep organizations isolated and secure.
• Show query analytics for your zones (rolling out), built from aggregated query metadata.
• Send transactional emails (account confirmation, onboarding, security notices).
• Send news about Quathos products (marketing) — only if you opted in, in your Quathos Account sign-up or profile. This never applies to transactional email such as invoices, security notices, or password resets, which are sent regardless of that preference.
• Prevent fraud and abuse, and comply with legal obligations.

5. Legal bases

Depending on the law that applies, we process personal data on these bases: performance of a contract, our legitimate interest in operating and securing the Service, compliance with legal obligations, and, where required, your consent. For customers in Brazil, processing follows the LGPD (Lei nº 13.709/2018). For residents of U.S. states with comprehensive privacy laws — including California (CCPA/CPRA), Virginia, Colorado, Connecticut, and their successors — we process personal information to provide the Service you requested and for the compatible purposes described in this policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the CCPA. Query analytics are aggregated technical data about DNS traffic to your zones; we do not use them to profile individuals.

Marketing communications about Quathos products rely exclusively on your consent (for Brazil, LGPD art. 7º, I and art. 8º): a separate opt-in, unchecked by default, collected in your Quathos Account. You can withdraw it at any time and free of charge — with the “Quathos communications” toggle in your Quathos Account profile, or through the one-click unsubscribe link included in every marketing email. Withdrawing consent does not affect the Service or transactional messages.

6. How we share data

We do not sell personal data. We share it only with service providers that help us run the platform, such as cloud hosting and email delivery — transactional emails are sent through qsendyx, the email service of our own ecosystem, operated by Quathos LLC. Those providers work under terms that limit how they use the data. We may also disclose data when the law requires it, or to protect our rights and our users.

Published DNS records are, by design, disclosed to any resolver that queries them. That is the Service working as intended, not a data-sharing decision we make case by case.

7. International transfers

Quathos LLC is based in the United States. We may process data there and in other countries where our providers operate — DNS is a globally distributed system by nature. Where the law requires it, we apply appropriate safeguards for international transfers.

8. Data retention

We keep account and organization data while your account or your organization’s account is active, and for as long as we need it to provide the Service.

Zones and records you delete stop being served and are removed from the platform. Audit logs are kept for accountability while the organization exists.

Query metadata is used in aggregated form for analytics and operational monitoring, and is not kept longer than needed for those purposes.

When you close your account, you can first export your zones in BIND format. Deletion requests are honored within the limits of applicable law, which may require us to keep certain records to comply with legal obligations.

9. Security

We apply technical and organizational measures. These include organization-level isolation of data, password hashing, API keys stored only as hashes, DNSSEC to protect the authenticity of the answers our nameservers give, and audit logging of changes. No system is perfectly secure, but security is built into the platform’s design.

10. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data. You may also request portability, information about how we process it, and, where processing relies on consent, its withdrawal. To exercise these rights, write to contact@quathos.com.

If you are a California resident, you also have the right to know what personal information we collect and how we use and disclose it; to delete it; to correct it; to opt out of sale or sharing (we do neither); and not to be discriminated against for exercising any of these rights. Residents of Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws have equivalent rights, including the right to appeal a decision on your request — to appeal, reply to our decision at the same address.

We verify requests before acting on them, since honoring an unverified deletion request would itself be a security incident.

11. Children

The Service is not intended for individuals under 18, and we do not knowingly collect their personal data.

12. Changes and contact

We may update this Policy. When changes are material, we will update the effective date above and, where appropriate, give notice within the Service.

Questions about privacy? Email us at contact@quathos.com.