Privacy policy.

Qxir.com is operated by LeoManage, based in Israel. For purposes of applicable data-protection laws, the operator responsible for determining how and why personal information is processed is referred to in this Policy as the "Operator" or "data controller," where that term applies.

Privacy questions, data-rights requests, security concerns, and abuse reports can be sent to:

Email: hello@qxir.com

Website: https://qxir.com

Contact form: Available from the Qxir.com homepage

Qxir provides subdomain allocation and DNS management, not general-purpose web hosting for the sites and applications to which users point their subdomains.

This Policy concerns information processed by Qxir in operating its own website, infrastructure, accounts, DNS administration, security systems, and support channels. It does not govern the independent processing of personal information by websites, servers, applications, or other services operated by users or third parties through a Qxir subdomain. Those operators are responsible for their own privacy practices and legal obligations.

DNS is a public naming system. DNS records that a user publishes, including hostnames and target IP addresses, may be accessible to anyone using DNS tools or resolvers and may be copied, archived, or cached by third parties. Removing a DNS record or subdomain does not immediately erase information already obtained or cached elsewhere.

Depending on how you use Qxir, the information we collect or maintain may include the following categories.

A. Account and application information

• Full name, email address, and other information submitted during registration, application, or account administration.
• Requested and allocated subdomains; intended-use category; project descriptions; application and approval status; dates and times of registration, verification, approval, changes, suspension, and closure.
• Account identifiers, account status, administrative notes, and records of communications or decisions relating to applications or enforcement.

B. Authentication and account-security information

• Password verifiers stored in hashed form rather than as readable passwords, and technical information required to provide password-reset or multifactor-authentication features.
• Session identifiers, authentication/session records, security tokens or their protected representations, and related expiration or revocation information.
• Login, verification, password-reset, multifactor-authentication, logout, and account-recovery events, including successful and unsuccessful attempts and associated security metadata.

C. DNS and console information

• Subdomains, DNS record types and values, target IP addresses, record names, TTL values, and configuration changes.
• Timestamps, Account identifiers, and administrative or technical logs relating to DNS additions, modifications, removals, and attempted operations.
• Records of restrictions, takedowns, disputes, and other actions associated with a subdomain.

D. Technical, access, and security logs

We collect IP addresses and other technical data in connection with many Service interactions, including, as applicable, visits, account registration, sign-in attempts, email verification, password recovery, multifactor authentication, DNS management, contact-form submissions, abuse reports, requests rejected by security controls, and other sensitive or potentially abusive actions.

Logs may contain an IP address, date and time, requested path or action, request method, user-agent or browser information, available request metadata, related Account or subdomain identifiers, event status, rate-limit counters, and information reasonably needed to investigate errors or abuse. We may also maintain records of suspicious activity, access restrictions, repeated attempts, or enforcement actions.

Network and DNS infrastructure, including third-party infrastructure providers where applicable, may process technical connection or DNS-query information necessary to operate and secure DNS services. Such data can include queried names and source resolver IP addresses, which do not necessarily identify the individual end user making a DNS lookup.

E. Contact, support, and abuse reports

When you contact us, submit a form, or report a subdomain, we may collect your name, email address, message, IP address, submission time, the reported hostname or URL, and any information or evidence you choose to provide. We may retain correspondence, follow-up communications, investigation notes, and the outcome of a report.

F. Information received from others

We may receive information about a subdomain or Account from affected individuals, rights holders, infrastructure operators, security researchers, anti-abuse organizations, law-enforcement agencies, regulators, or publicly available sources. We may review this information and associate it with relevant Account, subdomain, or security records where appropriate.

We do not use MaxMind or GeoLite databases for this Service. Please do not include unnecessary sensitive personal information in application descriptions, DNS records, or support and abuse reports.

We process information as reasonably necessary for the following purposes:

• Providing the Service, processing applications, verifying contact details, allocating subdomains, publishing and administering DNS records, and managing Accounts.
• Authenticating users, maintaining sessions, providing multifactor authentication and password recovery, and helping prevent unauthorized access.
• Recording IP addresses and activity events to enforce rate limits, detect automated misuse, stop spam, prevent phishing and fraud, investigate abuse, respond to security incidents, and prevent repeat offenders from returning under new Accounts.
• Investigating complaints or suspected violations of our Terms and Conditions, including misuse of a subdomain for unlawful or prohibited activities, and making appropriate moderation or enforcement decisions.
• Maintaining reliable operation, troubleshooting faults, protecting infrastructure, and improving security and Service functionality.
• Communicating about applications, Account activity, security alerts, administrative changes, service-related notices, questions, and reports.
• Establishing, exercising, or defending legal claims; preserving evidence when lawful; complying with applicable legal obligations; and responding to requests from competent authorities under the law.

We may use relevant historical information, including information concerning an inactive, rejected, suspended, or deleted Account, to identify connected abuse patterns and enforce lawful restrictions. We aim to limit such use to purposes that are necessary and proportionate.

IP address collection and activity logging are significant parts of Qxir's security approach. We may associate an IP address with an Account, session, subdomain, request, failed authentication attempt, contact submission, or security incident where appropriate.

These records help us distinguish legitimate requests from repeated misuse, investigate attempted Account compromises, enforce submission limits, address prohibited content, and determine whether a previously restricted user may be trying to re-enter the Service.

An IP address is not a reliable proof of a person's identity; multiple people may use the same address, and addresses may change. We therefore consider other relevant information where practical rather than treating an IP address alone as conclusive evidence of wrongdoing.

Logging, screening, and investigation may involve automated controls and manual review. Automated security systems can temporarily restrict requests or Accounts. If a restriction appears to be incorrect, you may contact hello@qxir.com for review. Nothing in this section guarantees that every request or abuse report will be reviewed individually or that every threat will be detected.

Qxir uses or may use cookies and comparable technical identifiers that are necessary to operate and secure particular features of the Service. These may include temporary login and pre-authentication sessions, multifactor-authentication flows, authenticated console sessions, password-recovery flows, and related security checks.

Such identifiers may help us maintain the correct session state, recognize a request as belonging to a particular authentication flow, detect misuse, and protect Accounts. Depending on the feature, they may expire when the browsing session ends or remain until a configured expiration time.

Essential authentication and security features may not function if the relevant cookies are blocked or deleted. Browser settings may allow you to view, manage, or delete cookies.

The cookies described here serve authentication, functionality, and security purposes. If we introduce optional analytics, advertising, or other non-essential tracking, we will update this Policy and provide any notices or choices required by applicable law.

We may disclose information only where appropriate and permitted or required by applicable law, including in the following circumstances:

A. Service providers. To providers performing infrastructure, DNS, hosting, email delivery, security, technical support, or related functions on our behalf, to the extent necessary for those functions and subject to applicable confidentiality and data-protection obligations.

B. Law enforcement, courts, and regulators. To competent authorities when required by applicable law or valid legal process, or when otherwise lawfully permitted and justified, including for investigating suspected unlawful conduct, responding to emergencies, or protecting people and systems. We may preserve relevant records when legally required or otherwise lawfully justified. We assess requests according to applicable law; an informal request alone does not automatically entitle its sender to private user data.

C. Abuse and security investigations. Where legally permitted and reasonably necessary, to affected service providers, infrastructure operators, security-response organizations, or rights holders for the limited purpose of addressing abuse, protecting systems, enforcing rights, or investigating credible complaints. We assess the need for disclosure and seek to limit the information shared.

D. Legal protection. Where appropriate under applicable law to establish, exercise, or defend legal claims or protect the rights, property, and safety of users, the Operator, and the public.

E. Business or service transfers. In connection with a legitimate transfer or reorganization of the Service, subject to applicable legal requirements and protections.

F. At your direction or with your valid consent, where applicable.

We do not make private Account records public merely because a user has been accused of misconduct. Publicly queryable DNS records are different: their publication is an inherent part of the DNS Service, as described in Section 2.

When an Account is deleted, closed, or permanently disabled, the user loses access and the Account becomes unusable for normal Service operations. However, deletion or closure of the Account does not necessarily mean that its underlying database record and all associated information are immediately or completely erased.

For security, fraud and abuse prevention, enforcement of prior restrictions, investigation of complaints, defense of legal claims, and compliance with applicable law, we may retain information associated with closed, deleted, refused, or suspended Accounts. Depending on the circumstances, retained information may include an internal Account identifier, email address, prior subdomains, application and enforcement history, relevant IP address logs, DNS-change history, and security or abuse evidence.

Retained Accounts are not treated as active Accounts and do not provide continued access to the Service. Historical records are retained for defined operational or legal purposes, not to keep a functioning Account open after deletion. Where information is no longer reasonably necessary, we aim to delete, reduce, or de-identify it, subject to lawful retention obligations or preservation requirements.

A request to erase personal information will be evaluated under applicable law. Some information may need to remain where retention is lawful and necessary, including to prevent documented repeat abuse, comply with legal obligations, or establish, exercise, or defend legal claims. We will not assume that every deleted Account requires permanent retention of every historical detail.

We retain different categories of information for different periods, assessed by their purpose and the applicable legal requirements:

• Active Account and DNS-management information: generally while needed to provide the Service and manage the Account or subdomain.
• Disabled or deleted Account records: for as long as reasonably necessary and legally permitted for the specific abuse-prevention, security, enforcement, legal, or dispute-resolution purposes described above. Some records may therefore remain after the Account has been deleted.
• Routine access, authentication, rate-limiting, and technical logs: for periods reasonably necessary for security monitoring, troubleshooting, investigations, and protection against recurring abuse; relevant incident records may be retained longer.
• Abuse reports, enforcement decisions, and supporting evidence: while reasonably necessary to investigate and resolve the issue, enforce restrictions, defend legal claims, or satisfy legal obligations.
• Contact and support communications: while necessary to handle the request and any related operational, security, or legal matters.
• Backups: until replaced or deleted under applicable backup cycles, except where lawful preservation is necessary.

Retention is reviewed in light of the nature of the information, sensitivity, risks, recurring-abuse patterns, the continuing need for a record, applicable limitation periods, and legal preservation duties. We may restrict access to historical records or remove information that is no longer needed. We do not promise that Account closure immediately removes all related logs or backups.

Providing registration, application, or contact information is generally voluntary, unless a specific legal requirement applies. However, if you do not provide the information necessary for a particular feature, we may be unable to process your application, register or verify an Account, allocate a subdomain, authenticate you, or respond to a report.

Technical information such as the IP address from which a request originates may be necessary for communications with our systems, security monitoring, rate limiting, and fraud prevention.

Where the EU or UK General Data Protection Regulation applies, the relevant legal grounds may include performance of a contract or taking requested pre-contractual steps; our legitimate interests in operating and securing the Service and preventing abuse, subject to the applicable balancing of rights; compliance with legal obligations; and consent where legally required for a particular optional activity. Consent is not presumed to be the legal basis for every security or operational log.

We apply technical and organizational measures intended to protect personal information against unauthorized access, misuse, alteration, loss, and disclosure. These may include access controls, authentication safeguards, logging, and restrictions on access to administrative or historical records, as appropriate to the Service and the risks involved.

No internet service or storage system is completely secure. We cannot guarantee that unauthorized access, disclosure, loss, or disruption will never occur. We will assess security incidents and provide notices to users or competent authorities where required by applicable law.

Depending on the laws that apply to you and the circumstances of a request, you may have rights to ask what personal information we hold about you, access information, request correction of information that is inaccurate or incomplete, request deletion, or exercise other rights such as objection, restriction, or data portability where available.

In Israel, applicable law provides rights relating to access and correction of personal information held in databases. Other rights may apply under EU, UK, or other privacy laws where those laws apply to the processing.

To make a request, email hello@qxir.com. Please describe the information or right involved. We may request proportionate information to verify your identity and authority before disclosing or changing private records. Requests will be assessed and answered in accordance with applicable law.

Certain records may be withheld from disclosure or retained rather than erased where an applicable legal exception or lawful basis permits, including for the rights of others, ongoing security investigations, legal claims, and required preservation. If we cannot fully comply with a request, we will explain the decision where required by law.

Where available under applicable law, you may also raise a complaint with a competent data-protection supervisory authority.

Qxir is operated from Israel. The Service may rely on third-party providers that process or store information in other jurisdictions, depending on the infrastructure and services used. Different countries may have different data-protection rules.

Where international data transfers are subject to legal restrictions, we will seek to use the contractual, statutory, or other safeguards required by applicable law. You may contact us for information about the relevant arrangements where required and available.

If you believe a Qxir subdomain is being used for phishing, malware, fraud, unlawful content, adult content prohibited by our Terms, rights violations, or other abuse, report it using the Contact Us form on the homepage or by emailing hello@qxir.com.

Include the relevant subdomain or URL, a description of the issue, and any evidence reasonably necessary for assessment. We may use your report to investigate, contact relevant parties, preserve evidence, restrict a subdomain, or cooperate with competent authorities where legally permitted or required.

We cannot promise anonymity or absolute confidentiality to a reporter: depending on applicable law and the nature of the investigation, information may need to be disclosed to an authority or another party. We will seek to avoid unnecessary disclosure of a reporter's personal information.

Qxir Accounts and subdomain allocations are intended for people aged 18 or older, as stated in our Terms and Conditions. We do not knowingly invite children to register Accounts. If you believe that a minor has provided us with personal information in violation of our requirements, contact hello@qxir.com so we can review and take action consistent with applicable law.

A Qxir subdomain may point to an independently operated website, email server, API, or other service. We do not control how those operators collect, use, or share information. Their collection of visitor IP addresses, cookies, analytics, messages, or other personal information is governed by their own practices and legal obligations, not by this Policy.

Similarly, external links or services accessed from Qxir may have separate privacy notices. Please review them when appropriate.

We may revise this Policy to reflect changes in the Service, security practices, legal requirements, or the information we process. We will publish the revised version on Qxir.com and update the date above. For material changes, we will provide additional notice or seek consent where required by applicable law.

The version applicable at a particular time is the version then in effect, subject to any requirements under applicable law. This Policy is intended to inform you about data practices; it does not replace or limit rights that the law gives you.

Operator: LeoManage (Qxir.com)

Country: Israel

Email: hello@qxir.com

Website: https://qxir.com

Abuse reports: Contact Us form on the homepage or hello@qxir.com

Privacy and data-rights requests: hello@qxir.com

Related document: Qxir.com Terms and Conditions, available on Qxir.com.