Draft for review. Before launch: confirm the data controller identity, appoint a contact for privacy requests, and have counsel review against GDPR and India's DPDP Act.
What we collect
- Account data — email, password hash (argon2id, never the password itself), optional recovery email, session records with IP and browser for security.
- Registrant contact details — name, address, phone, email. Registries require these for every domain; they are not optional and we pass them to the sponsoring registrar.
- Billing data — invoices, amounts, tax identifiers. Card details are handled by our payment provider; we never see or store full card numbers.
- Service data — domains, DNS records, sites you publish, and logs of actions taken on them.
- Site analytics — for hosted sites we count daily page views and bandwidth only. No visitor IPs, no user agents, no cookies, no cross-site tracking.
Why we're allowed to hold it
Contract performance (you asked us to register and run things for you), legal obligation (ICANN/registry requirements, tax and invoice retention), and legitimate interests (security, fraud prevention, keeping the service running). Marketing email is consent-based and separately opt-in — compliance notices about your own domains are not marketing and cannot be switched off.
WHOIS and privacy protection
WHOIS privacy is free and on by default, so your personal details are redacted from the public record. Registries and registrars still hold the underlying data as ICANN policy requires, and it can be disclosed where policy or law compels it.
Who we share with
Our registrar partner (registrations), payment provider (payments), email provider (sending), cloud infrastructure provider (hosting the platform), and authorities where legally required. We do not sell personal data. Ever.
How long we keep it
- Invoices and tax records: as long as tax law requires (typically 7+ years).
- Notification history: kept as evidence of required registration notices.
- Security logs: about 90 days.
- Sessions: 30 days idle, or until you revoke them.
- Account and service data: while your account is open, then deleted or anonymised.
Your rights
Access, correction, deletion, export, objection and withdrawal of consent. Email us and we will action it — subject to the legal retention above, which we will explain rather than hide behind. If you are unhappy with how we handle a request you can complain to your data protection authority.
Cookies
We use strictly necessary cookies only: your session, your cart, and your currency preference. No advertising or analytics cookies on our own site — which is why you have not seen a consent banner demanding you accept anything.