Privacy Policy

Last updated 19 September 2026

How KumoDNS handles personal data in connection with KumoDNS

1. About this Policy

This Privacy Policy explains how KumoDNS (“we”, “us” or “our”) collects, uses, discloses, protects and retains personal data in connection with KumoDNS websites, customer accounts, DNS hosting and related services (the “Services”). “Personal data” means data, whether true or not, about an individual who can be identified from that data or from that data together with other information to which an organisation has or is likely to have access.

This Policy should be read with the KumoDNS Terms of Service and Acceptable Use Policy. It does not apply to a customer’s independent handling of personal data outside KumoDNS’s Services, or to third-party sites and services governed by their own policies.

2. Our data-protection roles

KumoDNS as an organisation

KumoDNS acts for its own purposes when it manages accounts, contracts, billing, website operations, security, support, abuse reports, legal compliance and business administration. In that role, KumoDNS determines the purposes and means of handling the relevant personal data and is responsible for applicable obligations under Singapore’s Personal Data Protection Act 2012 (“PDPA”).

KumoDNS as a data intermediary

KumoDNS may process personal data on behalf of a business customer when the customer uses the Services to host or manage DNS data or supplies personal data for support or service operations under written instructions. In that role, the customer remains responsible for its notices, lawful basis, instructions and responses to individuals, while KumoDNS is responsible for obligations applicable to data intermediaries and the parties’ contract. If a request concerns customer-controlled data, KumoDNS may refer the requester to that customer.

3. Personal data we collect

Depending on how the Services are used, KumoDNS may collect the following categories:

Account and identity data

Name, username, organisation, job title, business contact details, account identifiers, authentication settings and records needed to verify identity, authority or domain control.

Contract and billing data

Plan, order, subscription, invoice, payment status, billing contact and transaction reference. Payment-card details may be collected directly by an external payment provider rather than stored by KumoDNS.

DNS and service data

Domain names, hosted zones, DNS records, nameserver configuration, DNSSEC-related data, record-change history, API activity, query metadata and service usage. Query statistics are aggregate daily totals for each zone — the number of queries answered and how many resolved normally, returned no such name, or failed. They are not per-query records and identify no individual.

Device and website data

IP address, browser and device type, operating system, referring page, pages or features used, session identifiers, approximate location inferred from IP address, and cookie or similar-technology data.

Support and communications

Emails, tickets, calls or chats, attachments, diagnostic information, survey responses, preferences and records of notices or consent.

Security and abuse data

Login attempts, access logs, threat indicators, fraud signals, reported domains or records, evidence supplied by reporters, investigation notes and communications with customers, providers, authorities or affected parties.

Information from third parties

Data from authorised users, resellers, payment providers, registrars, registries, security researchers, threat-intelligence providers, public sources, law-enforcement bodies or other persons who report or help resolve an issue.

Please do not provide personal data that is unnecessary for the relevant purpose, particularly in DNS records, support attachments or abuse reports. Public DNS records can be queried globally and should not be used to publish secrets or private personal information.

4. How we collect personal data

• Directly from individuals who create accounts, communicate with KumoDNS, submit a request or report, attend an event, or subscribe to communications;
• From customers, account administrators, resellers or other authorised users;
• Automatically when a person visits the website, signs in, uses an API, changes a zone, sends a DNS query to KumoDNS infrastructure, or interacts with the Services;
• From payment, identity, security, infrastructure and support providers; and
• From public records, domain and network information, courts, regulators, law-enforcement agencies and other lawful sources.

5. Purposes for handling personal data

KumoDNS may collect, use or disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances, including to:

• Create, administer, secure and support accounts; verify identity, authority and domain control; authenticate users; and recover access;
• Accept orders, provide and configure the Services, operate nameservers and APIs, monitor service quality, manage usage and process billing;
• Respond to enquiries, support cases, complaints, access or correction requests, and other communications;
• Detect, investigate, prevent and respond to fraud, phishing, malware, attacks, unauthorised access, service abuse, policy violations and security incidents;
• Maintain reliability, perform troubleshooting, analyse capacity, improve features and develop Services using aggregated or appropriately de-identified information where practicable;
• Manage vendors, professional advisers, insurance, audits, corporate transactions and internal administration;
• Send operational, security, account, billing and policy notices, and send marketing communications where permitted and subject to available opt-outs;
• Establish, exercise or defend legal claims; preserve evidence; enforce agreements; protect users, KumoDNS and the public; and comply with law, court orders, regulatory directions and lawful authority requests; and
• Carry out another purpose notified at collection, authorised by the individual, reasonably necessary for a requested service, or otherwise permitted by law.

6. Consent, deemed consent and withdrawal

Where consent is required, KumoDNS will notify the individual of the relevant purposes and obtain consent in an appropriate form. Consent may also be deemed under the PDPA in applicable circumstances, including where an individual voluntarily provides personal data for an evident purpose, where handling is reasonably necessary to perform a contract, or where notification and opt-out requirements for deemed consent by notification are satisfied. KumoDNS may also handle personal data without consent where an exception under law applies.

An individual may withdraw consent for future collection, use or disclosure by contacting the DPO with reasonable notice. KumoDNS will explain likely consequences and will cease the relevant handling after a reasonable period unless continued handling is required or permitted by law. Withdrawal may prevent KumoDNS from maintaining an account, delivering a feature, providing support or fulfilling a requested transaction. It does not affect lawful handling that occurred before withdrawal.

7. Cookies and similar technologies

The KumoDNS website and control panel use cookies and similar technologies for authentication, security and session continuity. The bot check on the signup and contact forms is provided by Cloudflare Turnstile, which sets its own. These are necessary for a service the user has requested: blocking them prevents sign-in and form submission from working.

The public website at www.kumodns.com also uses Google Analytics 4, which sets its own cookies (_ga and _ga_<id>) to measure how the site is used — pages visited, referring source, approximate location from IP address, and device and browser type. It is used to understand and improve the website. It is not used for advertising or remarketing, and the analytics data is not combined with a customer’s account. Google acts as a processor for this data; see how Google uses data from sites that use its services. Analytics is not used in the control panel.

Cookies can be controlled through browser settings, although blocking the cookies described above will prevent sign-in and form submission from working. Analytics cookies can be refused without affecting the website, and Google publishes a browser add-on that opts out of Google Analytics on every site. KumoDNS does not use cookies or similar technologies for advertising or marketing measurement. If that changes, this Policy will be updated and any consent required will be obtained before the change takes effect.

8. Marketing communications

KumoDNS does not currently send marketing communications. Operational, security, account, billing and policy notices are not marketing and are sent as part of providing the Services. If KumoDNS begins sending marketing, this Policy will be updated first, every message will carry a working opt-out, and any marketing calls, texts or faxes to Singapore telephone numbers will comply with applicable Do Not Call requirements, consent rules, identification requirements and opt-out obligations.

9. Disclosure of personal data

KumoDNS may disclose personal data only where reasonably necessary for the purposes described above, including to:

• KumoDNS personnel, affiliates and contractors who need access and are subject to appropriate duties;
• Cloud, network, DNS, security, monitoring, support, communications, analytics, identity and payment providers;
• Registrars, registries, upstream providers, CERTs, threat-intelligence services and other technical parties needed to operate or protect the Services;
• Professional advisers, auditors, insurers, banks and prospective parties to a financing, reorganisation, merger or sale, subject to appropriate safeguards;
• Complainants, rights holders, affected parties or other providers where reasonably necessary to investigate and remediate an abuse, security or legal issue; and
• Courts, regulators, law-enforcement bodies and public authorities where disclosure is required or permitted by law, or reasonably necessary to protect rights, safety, security or the integrity of the Services.

KumoDNS does not sell personal data for monetary consideration.

10. Overseas transfers

KumoDNS is based in Singapore, but service providers, infrastructure, support personnel or recipients may be located outside Singapore. Where KumoDNS transfers personal data overseas, it will take appropriate steps required by the PDPA to ensure that the recipient is bound to protect the transferred data to a standard comparable to the PDPA, unless a lawful exception applies. Measures may include contractual obligations, due diligence, recognised certifications or other legally enforceable safeguards.

11. Retention

KumoDNS retains personal data only for as long as needed for the purpose collected or another legal or business purpose. Retention depends on the account lifecycle, contract and limitation periods, security needs, dispute or investigation holds, financial record requirements, backup cycles and customer instructions. When personal data is no longer needed, KumoDNS will delete it, anonymise it, or remove the means by which it can reasonably be associated with an individual.

The periods below apply unless a longer one is required by law, or by an unresolved dispute, investigation, legal hold or regulatory request. Where a record is needed for more than one purpose, the longest applicable period governs it.

12. Security

KumoDNS will make reasonable security arrangements to protect personal data in its possession or control against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. Measures may include access controls, authentication, encryption where appropriate, network and endpoint safeguards, logging, vulnerability management, backups, vendor controls, staff confidentiality and incident response. Security is a shared responsibility: customers must protect credentials, assign access carefully, review account activity and avoid placing sensitive personal data in public DNS records.

No system is completely secure. Individuals should notify Contact us promptly if they suspect unauthorised access or a privacy or security incident.

13. Data breaches

KumoDNS maintains procedures to identify, contain, assess and remediate data breaches. Where KumoDNS is the responsible organisation and a breach is notifiable under the PDPA, KumoDNS will notify the Personal Data Protection Commission as soon as practicable and no later than the applicable statutory deadline after determining that notification is required, and will notify affected individuals as soon as practicable where required. Where KumoDNS acts as a data intermediary, it will notify the relevant customer or public agency without undue delay after it has credible grounds to believe a breach has occurred, so that the responsible organisation can assess its notification obligations.

14. Accuracy

KumoDNS will make reasonable efforts to ensure that personal data it collects is accurate and complete where it is likely to be used to make a decision affecting an individual or disclosed to another organisation. Account holders should keep profile, billing, administrative and recovery contacts current and notify KumoDNS of material errors.

15. Access and correction requests

Subject to the PDPA and applicable exceptions, an individual may request access to personal data about the individual in KumoDNS’s possession or control and information about how it was used or disclosed during the preceding year. An individual may also request correction of an error or omission. KumoDNS may verify identity and authority, request information needed to locate the data, charge a reasonable access fee after giving a written estimate, or refuse or limit a request where permitted or required by law.

Requests should be made through KumoDNS's privacy request form, marked for the attention of the Data Protection Officer, and should include the requester's name, contact details, relationship with KumoDNS, account or ticket reference, the data or correction requested and suitable identity verification. KumoDNS will respond as soon as reasonably possible and within applicable statutory timelines. If more time is needed, KumoDNS will provide the required written notice. Where KumoDNS holds data solely for a customer, the request may need to be directed to that customer. A request covers the restricted archive described in section 11 as well as live systems: data held there for accounting or legal reasons is still personal data, and is searched and reported like anything else.

16. Children

The Services are intended for businesses and persons at least 18 years old. KumoDNS does not knowingly offer accounts directly to children. If KumoDNS learns that it collected a child’s personal data without appropriate authority or another lawful basis, it will take reasonable steps to delete or otherwise address the data. A parent or guardian may contact the DPO with a concern.

17. Third-party links and services

KumoDNS may link to or interoperate with third-party websites, registrars, registries, payment providers and other services. Their privacy practices are governed by their own notices. KumoDNS is not responsible for independent third-party processing, although KumoDNS remains responsible for its own vendor selection and transfer obligations where the third party processes personal data for KumoDNS.

18. Changes to this Policy

KumoDNS may update this Policy to reflect legal, regulatory, technical or operational changes. The current version will be posted at https://www.kumodns.com/privacy.php with its effective date. KumoDNS will provide appropriate notice of material changes and obtain fresh consent where required. Earlier versions should be archived for accountability.

19. Questions and complaints

Questions, complaints, withdrawal requests and access or correction requests should first be directed to KumoDNS through its contact form, marked for the attention of the Data Protection Officer. KumoDNS will investigate and respond within a reasonable time. Individuals may also contact the Personal Data Protection Commission through its official channels if they remain concerned, but KumoDNS encourages direct contact first so it can attempt to resolve the matter.