← Back to home

Last updated 1 October 2026

Privacy Policy

This Privacy Policy explains how echo reply handles personal data on this website and in our products, DNS by echo reply and the availability-notification form for RADIUS by echo reply. It is the privacy policy for all of them.

1. Who is responsible

echo reply ApS (CVR 43548441), Gammel Kongevej 11, 5. Sal, 1610 København V, Denmark, is the data controller for the website, product-notification list, inquiries, customer accounts, billing, and our own security and business records.

For questions about personal data or to exercise your data-protection rights, contact privacy@echo-reply.net. This is a monitored address.

2. When our role changes

Our role depends on why data is processed. We act as a controller when we decide why and how to process account, billing, security, abuse-prevention, domain-registration, and support data.

Where a customer uses DNS by echo reply to process personal data in DNS content or other customer-controlled data for its own purposes, echo reply may act as that customer's processor. The customer remains responsible for its instructions, legal basis, and notices to affected people. Our standard data processing agreement is not currently incorporated into the service agreement. Contact privacy@echo-reply.net about processing terms. Registrars, registries, payment providers, and other recipients may act as independent controllers for data they receive.

Many ordinary infrastructure DNS records contain no personal data. Our data processing agreement applies only insofar as customer-directed processing involves personal data. Public availability does not itself remove data-protection rights: a publicly accessible DNS record may still identify a person. Public DNS records can also remain in third-party caches or datasets after we remove them from our service.

3. Data we handle and why

Context	Data and purpose	Legal basis
Site visits	IP address supplied by our reverse proxy, request and security-log data, and basic device/request information used to deliver the site, rate-limit forms, diagnose faults, and prevent abuse.	Our legitimate interests in operating and securing the site.
Product availability notifications	Your email address, confirmation and unsubscribe tokens, signup and confirmation times, status, and consent scope. We use these to verify your request and send one notification when the product you selected becomes available.	Your consent, which you provide through the form and double opt-in process.
Enterprise inquiries	Company and contact name, email address, estimated zone count, optional message, submission time, and related correspondence, used to respond and assess your inquiry.	Steps requested before a possible contract with you, or our legitimate interest in responding to an organisation’s business inquiry.
DNS customer accounts	Identity, contact, authentication, organisation, team membership, roles, permissions, and account settings used to provide and secure the service.	Performance of a contract with you, or our legitimate interests in administering an organisation’s account and securing access, and legal obligations where applicable.
DNS and domain services	Zones, records, nameservers, configuration, domain searches and orders, and registrant or administrative contact details used to host DNS and perform requested registration, transfer, renewal, and management actions.	Performance of a contract with you, or our legitimate interests in fulfilling an organisation’s requested services. Where we act as processor, we follow the customer’s lawful instructions. Statutory obligations apply where relevant. Registrar contract terms are not themselves statutory obligations.
Authoritative DNS telemetry	Query names, source addresses, timestamps, query types, response codes and transport information used to operate, secure and troubleshoot authoritative DNS and produce service statistics. Queries generally originate from recursive resolvers operated by internet service providers, public DNS services and other organisations.	Our legitimate interests in service reliability, security, incident investigation and capacity planning, insofar as the information is personal data. Customer-directed processing is assessed separately where we act as processor.
Billing	Plan, subscription, invoice, transaction, tax, country, and payment-provider identifiers used to take payment, administer subscriptions, keep accounts, and prevent fraud. Payment providers handle payment details under their own terms and notices.	Contract performance or our legitimate interests in administering organisational billing and preventing fraud, and legal obligations concerning accounting and tax.
Audit, security, and support	User and action identifiers, timestamps, affected resources, change history, technical and security events, abuse reports, support messages, and diagnostic information used for access control, auditability, incident response, support, and dispute handling.	Performance of our contract, our legitimate interests in reliable and secure operations, and legal obligations where applicable.

Providing an email address is necessary to request a product availability notification. The inquiry form requires your company, contact name, email address and estimated zone count; its message field is optional. Account, billing and domain-order forms identify the information needed for the requested service. If you do not provide required information, we cannot complete that signup, inquiry or order. Optional information is not a condition of service.

We also receive personal data from organisation administrators who invite or manage team members, customers who supply domain-contact details, and registrars, registries and payment providers that return information about requested operations. We use that information for the corresponding account, domain or billing purposes described above. If someone supplied your information, you may contact us to ask about its source and exercise your rights.

When operational logs use a shortened hash of an email address, that value is pseudonymous, not anonymous. The underlying address is still personal data in the signup or inquiry system and is disclosed to the services described below where necessary.

Authoritative DNS telemetry does not ordinarily identify the individual behind a recursive resolver or provide that individual’s complete browsing history. However, direct queries or query names may contain personal data. We do not assume that all telemetry is anonymous merely because it concerns public DNS or originates outside a customer’s account.

4. Product availability notifications and earlier lists

If you request a product availability notification, we use your email address to confirm your request and notify you when that product is available. Each signup identifies the product. Your request does not subscribe you to unrelated product announcements or a general newsletter. DNS by echo reply is available. The current notification form is for RADIUS by echo reply.

Some addresses were collected under earlier notification wording that did not identify a specific product. Those records retain the consent scope shown when they were collected. We do not treat them as consent for RADIUS or a company newsletter. A separate operational resend queue may also contain addresses from that earlier list. It is deleted together with the earlier list, as described in section 6.

5. Verification, delivery, and other recipients

We disclose data only where needed to provide, secure, or administer the relevant service, comply with law, or act on a customer's instructions. Current website flows include:

• Plunk receives the full address entered in the RADIUS form so that it can check address and domain signals.
• The RADIUS signup performs a direct recipient-server check. The full address is sent in an SMTP RCPT TO command to the mail server advertised for the address's domain. The check may be visible in that server's logs even though it does not send a message.
• Our configured outbound email provider receives recipient addresses and email content to deliver confirmation messages.
• Enterprise inquiry data is stored by the landing service and sent through the configured email provider to our configured inquiry mailbox. Reply correspondence is then held by the mailbox service.
• Payment providers receive billing and payment data. Registrars and registries receive domain and registrant data needed to perform requested domain operations.
• Hosting, infrastructure, security, and support providers may process relevant technical or support data on our behalf.
• Authorities or other recipients may receive data where required by law or necessary to establish, exercise, or defend legal claims.

Provider register

The following providers and their service partners may receive personal data for the purposes described below. Some also act as independent controllers for their own purposes, such as fraud prevention or legal compliance. The list is drawn from our supplier register, updated 28 September 2026, and describes provider functions rather than every party's role for each data flow.

Registrars and registries, such as Punktum dk for .dk domains, and payment networks act as independent controllers for the data they receive. Their own privacy notices apply. Recipient mail servers contacted by the signup check are not our providers.

International transfers

Some providers, registrars, registries or recipient mail servers may process personal data outside the European Economic Area. This notice does not list the destination countries or the transfer mechanism for each provider. Contact privacy@echo-reply.net for information about transfers affecting your data and any applicable safeguards.

6. Retention and deletion

We retain data for the relevant service, security, recovery, accounting and dispute-handling purposes, according to the periods and criteria below.

These periods are our policy choices, not general retention periods set by NIS2 or DORA. GDPR storage limitation still requires each period to be necessary for its purpose. Where DORA incident-evidence rules apply, evidence must be kept no longer than necessary, taking account of the relevant business functions, supporting processes, information assets and any applicable legal retention requirement.

• Product availability notifications: unsubscribe deletes the relevant subscription immediately. We delete a product’s signups 30 days after sending its one-time availability notification. If a product does not become available, its list is deleted on its expiry date. The earlier list and its resend queue are handled the same way and keep their original consent scope until deleted. We do not reuse a list for another product or send requests to re-subscribe.
• Enterprise inquiries: we keep an inquiry for 12 months after the last correspondence, unless a continuing business relationship or documented legal need justifies longer retention. That reason is recorded against the inquiry. We delete expired inquiries from the website’s database. Inquiry mailbox copies are handled separately and do not have an automated deletion schedule.
• Security-relevant audit records: our policy is to retain security-relevant action records for five years from the recorded action, together with the minimum identifiers needed to attribute them to an account and credentials used. This supports investigation of malicious activity, customer accountability and dispute handling, including after an employee leaves or an account is deleted. It does not prove which human acted if credentials were compromised. Five years is our policy choice, not a claim that NIS2 or DORA universally requires that period.
• Automated detection evaluations: evaluations that did not trigger a potential incident are kept for 90 days to check detection quality. Triggered evaluations are kept for five years, or until a linked incident alert expires if that is later. New detection evidence excludes raw email addresses, IP addresses and user-agent values; source login and export records have their own five-year retention. Legacy copied IP and device values are removed from detection evidence when the linked source records expire.
• Incident alerts: open alerts are kept while the incident is being handled. A resolved alert is kept for five years after resolution; an alert withdrawn as not an incident is kept for one year. An alert with a pending authority report is not expired. A documented, active investigation or legal hold may extend retention, with an owner and review date. NIS2 incident reporting rules do not set these general record-retention periods.
• Account deletion and audit attribution: deletion removes the person’s access but does not by itself erase retained audit evidence or cancel an organisation’s services. Access to retained identifiers is restricted to authorised purposes. When a deleted account no longer has retained source events, its email is replaced by a keyed pseudonym in legacy incident evidence and the retained identity is deleted. Longer retention requires a documented continuing investigation, legal claim or applicable obligation. At the end of the justified period, personal data must be deleted or effectively anonymised.
• DNS telemetry: raw authoritative-query data is retained for 90 days, hourly aggregates for 365 days and daily aggregates for 730 days. Raw data includes query names and source addresses; aggregates retain information derived from source addresses and are not assumed to be anonymous. Deletion can lag the configured period while storage cleanup runs. Backup copies can retain older data, as explained below.
• Billing and accounting: accounting material is generally retained for five years from the end of the financial year to which it relates, subject to applicable requirements. This period does not automatically apply to unrelated logs or all account data.
• Other customer, domain and support data: we retain information for as long as needed to provide the active service, complete requested domain operations, meet applicable obligations, and address documented security or dispute needs. We delete or anonymise it when those purposes no longer require it.

We retain protected backup copies to recover our services and customers’ DNS configuration after failures, attacks or malicious changes. Deleting data from an active system does not immediately remove every backup copy. Backup copies age out under the retention schedules of the systems that hold them.

Before restored landing services resume public traffic or outbound mail, later unsubscribes and valid erasure requests must be reapplied and expired notification lists and inquiries removed. Inquiry mailbox copies are reviewed separately. An older unsubscribe does not remove a later, separately confirmed subscription. If current deletion records for the recovery point are unavailable, restoration uses an empty database so erased records are not reactivated.

You may request deletion or object to processing now by contacting us. We will assess your request, delete or restrict data where required, and explain any information we must retain and why.

7. Cookies and local browser storage

echo reply does not use advertising pixels or analytics cookies on this site. Our site stores your light/dark theme preference in your browser's localStorage. The pricing page also stores your selected currency and billing period there. echo reply's site code uses these values locally to restore your display choices.

The DNS application uses cookies to maintain your signed-in session and protect requests against forgery. If you choose to trust a device during multi-factor authentication, it also uses a cookie to recognise that device under the applicable account or organisation security policy. Blocking these cookies can prevent sign-in or protected actions. You can remove cookies and local storage through your browser settings; doing so may sign you out or reset saved preferences.

Our site serves its styling and the ALTCHA anti-bot component itself, not from a third-party content-delivery network, so loading our pages does not disclose your IP address or browser headers to one.

8. Security

We use organisational and technical measures intended to protect personal data, including access controls, rate limiting, audit records, and pseudonymous identifiers in application logs where supported. No internet service is completely secure. Please report suspected account compromise to support@echo-reply.net and suspected abuse to abuse@echo-reply.net.

9. Your rights

Depending on the circumstances, GDPR gives you rights to:

• access your personal data and receive information about its use,
• correct inaccurate or incomplete data,
• request deletion or restriction,
• object to processing based on legitimate interests,
• receive data you provided in a portable format where the legal conditions apply, and
• withdraw consent at any time, without affecting processing already carried out lawfully.

Send a request to privacy@echo-reply.net. We may need enough information to verify your identity and locate the relevant records. If echo reply processes data only on a customer's instructions, we may direct the request to that customer or assist it in responding.

You may also complain to the Danish Data Protection Agency (Datatilsynet). We encourage you to contact us first so that we can investigate.

10. Changes to this policy

We will update the date and wording when this policy changes. Material changes that affect an active service will be communicated through an appropriate service or account channel.