CustomDomain privacy & data

we play two roles: a controller for our own customer accounts and site visitors, and a processor for the end-user and domain data our customers send us.

Identity and login: name, email address, and either a hashed password or a Google sign-in identifier

Registrant details (registrar feature only): if a customer uses the domain-purchase feature, the registrant contact information required by the registry (name, postal address, email, phone) is processed to register the domain.

Billing data: plan, subscription status, and usage counts.

From the request: the IP address, and the country, region and city our network provider (Cloudflare) derives from it

Session recordings (only if you accept analytics): With your consent, we record how you use CustomDomain™ (clicks, scrolling and page views, never what you type other than a domain name) to improve it.

the device type (phone, tablet or computer), operating system and browser, read from the browser's user agent, which itself is not kept.

Support and communications: messages you send us and related metadata.

We use them for security, abuse prevention and support, and not to advertise to you or to sell.

We use the totals to see which pages help people, not to identify you or to advertise to you

Only to connect the domain: to find its zone, write the records, show you the result

Account data: for the life of your account, then deleted or anonymized within a reasonable period after closure, except where we must retain records (for example, tax and accounting).

Session recordings are deleted after 30 days.

Guided provider sign-in records are deleted within 90 days.

IP addresses (domain lookups, connect widget steps and sessions, sign ins and audit events) are kept for as long as the account exists

End-user email address: kept only while the connection exists, and deleted with it.

We are based in, and primarily host the Service in, the United States (our infrastructure runs in a U.S. region).

we rely, as applicable, on the EU-U.S. Data Privacy Framework and its UK Extension and Swiss-U.S. framework where a recipient is certified

otherwise on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum)

See the current Sub-processors list (AWS, Stripe, Cloudflare, Let's Encrypt, and the domain registrar, among others).

You can remove a device in Settings at any time, which deletes them.

you may have the right to access, rectify, erase, restrict, or object to processing, to data portability, and to withdraw consent.

you may have the right to know, access, delete, and correct personal information

to opt out of sale/sharing and of certain targeted advertising and profiling

We do not sell personal data