SimpleACME1. Controller and contact
SimpleACME, Weierweid 9, 6122 Menznau, Switzerland, is responsible for personal data processed in operating this service. Contact support@simpleacme.com for privacy questions or rights requests. Swiss data protection law applies, together with other data protection laws where they are applicable to our processing.
2. Account and service information
We process account email addresses, account identifiers, optional profile details, password hashes for email-created accounts, authentication and account-security records, and optional two-factor authentication settings. If you use Microsoft, Google or Apple sign-in, we process the identity and email details needed to authenticate your account. This sign-in does not give SimpleACME access to your inbox or calendar.
We store registered domain names, plan and access status, assigned ACME-DNS registration details, CNAME check results, challenge TXT values and update activity. Credentials and secrets are protected using appropriate access controls and encryption where implemented. Your ACME client keeps certificate private keys; SimpleACME does not need those keys to process DNS updates. Never place private keys or unrelated secrets in a DNS TXT value or support message.
3. Purchases and support
We receive Paddle customer, transaction and subscription identifiers, payment and adjustment status, billing period information and relevant purchase details. Paddle processes payment information as merchant of record under its own privacy policy. We do not receive your full payment card details from Paddle.
We process support correspondence and optional affiliate attribution where applicable. If you enable renewal-related email notifications, we use your email and observed DNS activity to send those notices. A DNS activity notification does not independently confirm certificate issuance.
4. Website statistics and cookies
We use a first-party visitor cookie named simpleacme_visitor, with a one-year lifetime, to count browser visitors and relate public-page visits to account creation, domain creation and first paid activation. The server stores a keyed hash of the visitor identifier rather than the raw cookie token. These are browser-based unique counts, not a guarantee of unique people across devices or cleared cookies.
Statistics include public page paths, timestamps, first and last landing pages, campaign parameters such as UTM values, and the referring website's hostname. Marketing analytics do not store raw IP addresses or use device fingerprinting. First-party statistics currently operate automatically; Do Not Track and Global Privacy Control signals are respected. Clearing or blocking cookies also limits browser attribution. Operational session, authentication, OAuth and account-security cookies support the account and checkout workflows.
We do not currently use third-party advertising pixels or sell personal data. Paddle checkout and a sign-in provider you select may process information under their own policies. Infrastructure and security logs may contain IP addresses, user-agent details and request information independently of marketing statistics. Authentication abuse controls may use hashed network identifiers.
5. Purposes and legal grounds
We use information to create accounts, deliver and secure DNS update access, check CNAME configuration, process subscriptions, provide support and send necessary service communications. Where applicable, these activities rely on performance of a contract, steps taken at your request, legal obligations, and legitimate interests in security, fraud prevention, service reliability and proportionate business measurement. Where consent is required for a particular optional activity, the applicable consent requirements apply; you may withdraw consent without affecting earlier lawful processing.
Optional email settings can be changed in your account. Necessary security, billing and service notices may still be sent. We do not make decisions producing legal or similarly significant effects solely through profiling; payment status does automatically control the service access you purchased.
6. Recipients, public DNS and international processing
Authorized hosting, infrastructure and email providers process information needed to operate the service. Paddle receives purchase data as merchant of record. Microsoft, Google or Apple receive sign-in requests when you choose their authentication option. Affiliate accounting may use attributed customer and commission references; we restrict access to what is needed for the program. We may disclose information where legally required or necessary to protect legitimate rights and service security.
DNS records are public by design. CNAME and challenge TXT records can be queried, cached and retained by DNS resolvers and other parties outside our control. Avoid putting personal information into public DNS unnecessarily.
Some recipients, including payment and identity providers, process information internationally, including in the United Kingdom, European Economic Area and United States. The applicable safeguards depend on the recipient and destination, including recognized adequacy decisions or appropriate contractual safeguards where required. This is not a promise that all data remains in Switzerland. Contact us for current supplier and transfer details relevant to your account.
7. Retention and deletion
We retain account and operational information for as long as needed to provide the service and address security, support and legal obligations. Billing and accounting records may need longer retention under applicable law. Backups and restricted security records can remain for their established operational or legal purpose after an account closes.
The visitor cookie expires after one year; this does not automatically erase related server-side statistics or attribution records. Those records do not currently have a fixed automated deletion period. We review deletion requests and retention needs by purpose, including whether records must be retained or can be de-identified. Contact us to request deletion of data linked to your account. Public DNS copies held by third parties cannot be recalled by deleting your account.
8. Security and your choices
We use safeguards such as transport encryption, password hashing, restricted access and protection of stored secrets. No online service can guarantee absolute security. Protect your login and API credentials, use available two-factor authentication, and tell us promptly if you suspect unauthorized access.
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to relevant processing. Send requests to support@simpleacme.com using your account email. We may request proportionate identity verification to protect your information. Exceptions may apply to legal, billing, security or third-party rights requirements. You can complain to the Swiss Federal Data Protection and Information Commissioner or your competent local supervisory authority.
9. Children and policy changes
The service is intended for adults and authorized business users, not children under 18. Contact us if you believe a child has provided personal information. We will update the date above when this policy changes and give appropriate notice of material changes.