Privacy Policy

Updated April 2026

Escudo is a protective DNS service. Our business model is subscriptions, not advertising. We have no incentive to collect, profile, or sell your data. This policy explains exactly what we store, why, and for how long.

What we collect

When your device sends a DNS query through Escudo, we record the following metadata:

• Timestamp of the query
• Domain name queried (e.g., example.com)
• Query type (A, AAAA, CNAME, etc.)
• Whether the query was blocked and the reason
• Source IP address (used for subscriber identification, not stored long-term)
• Response latency

For paid accounts, query logs are available in your dashboard for the duration of the retention period. Free accounts receive aggregate statistics only.

What we do not do

• We do not sell, rent, or share your data with advertisers or data brokers
• We do not run Google Analytics, Facebook Pixel, or any third-party tracking scripts
• We do not use tracking cookies or cross-site identifiers
• We do not inspect DNS query payloads beyond the domain name
• We do not log the content of your internet traffic — DNS reveals the domain, not the page or content
• We do not build advertising profiles or behavioral models from your queries

Data retention

DNS query metadata is retained for 30 days from the date of the query. After 30 days, records are permanently deleted from all systems including backups. There is no archive, no cold storage, no "anonymized" dataset kept indefinitely.

Account information (email address, subscription status) is retained for the duration of your account plus 90 days after deletion to handle billing disputes.

Data storage

Your data is stored in two locations:

• European Union: Hetzner data centers in Falkenstein and Nuremberg, Germany. Subject to EU GDPR protections.
• Brazil: Vultr data center in Sao Paulo. Subject to Brazilian LGPD protections.

DNS queries are processed by the resolver nearest to you. If you are in South America, your queries are processed and stored in Sao Paulo. If you are in Europe, they are processed and stored in Germany.

ISP customer privacy

When an internet provider deploys Escudo for their subscribers, we process DNS queries on behalf of the ISP. In this model:

• The ISP is the data controller; Escudo is the data processor
• ISPs receive aggregate reporting only — total queries, block rates, threat categories
• Individual subscriber query histories are never exposed to the ISP
• Subscribers can request their own data directly from us

Your rights

Under the Brazilian LGPD and European GDPR, you have the right to:

• Access all data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a machine-readable format
• Object to processing of your data
• Withdraw consent at any time

To exercise any of these rights, email privacy@escudo.network. We will respond within 15 days.

Cookies

The Escudo website uses session cookies only. These are required for the dashboard to function (authentication state) and expire when you close your browser. We do not use persistent cookies, analytics cookies, or advertising cookies.

Sub-processors

Provider	Purpose	Location	Data processed
Hetzner Online GmbH	Server infrastructure	Germany	DNS queries, account data
Vultr Holdings LLC	DNS resolver infrastructure	Brazil (Sao Paulo)	DNS queries
Have I Been Pwned	Breach detection alerts	Australia	Email hashes only (k-anonymity model)

Data controller

Escudo Security S.A., registered in Panama, is the data controller for all Escudo services. For European data protection matters, contact our UK entity Pulso Technologies LTD.

Changes to this policy

We will notify you of material changes at least 30 days before they take effect, via email to your registered address and a notice on the Escudo dashboard. Continued use of the service after the effective date constitutes acceptance.

Questions about this policy: privacy@escudo.network