Privacy Policy: what changed

For the offer, purchase and referral form subsections, the legal basis under the GDPR is the performance of, or steps taken at your request before entering into, a contract — for the sale of a domain name, or, for a referral, the referral commission arrangement described at Refer a buyer [/refer/] (Article 6(1)(b)); a text about your offer is a step in that same negotiation and rests on the same basis. Answering a purchase inquiry also falls under Article 6(1)(b); for other contact messages we rely on our legitimate interest in answering correspondence (Article 6(1)(f)). For the request record, the email engagement record, and the phone lookup result, the basis is our legitimate interest in preventing online fraud and in conducting the negotiation you started (Article 6(1)(f)); you may object to any of them at any time by writing to the address in Section 1, and where your local law requires consent for email tracking, the footer of each email is where we tell you and how to avoid it. The offers we start rest on Article 6(1)(f) too, for the different interest named in that subsection above, and the stop link in every such email is the simplest way to object to them. Where your local law requires consent for text messages, the offer form says next to the phone field that the number may be texted, and STOP withdraws that consent at any time. For theGoogle analyticsAnalytics and advertising, described in Section 4, the basis is your consent (Article 6(1)(a)), which you may withdraw at any time. Cloudflare's cookieless page measurement, also described in Section 4, rests on our legitimate interest in knowing how many people visit which pages and how quickly they load (Article 6(1)(f)); a Global Privacy Control signal is how to object to it, and it stops the measurement on every page.

Cloudflare — serves every page, delivers our email, and runs the security checks in front of them. Processes your IP address and request metadata as part of delivering the site, and derives from the address the country, region, city, and network operator we store, as described in Section 2. With your analytics choice, itIt also receives the performancepage measurements described in Section 4.

Optional Google Analytics and Google AdSense scripts load onlyloads on eligibleour homepage, catalog and domain pages and on our static informational pages, (the policies and the blog). Optional Google AdSense loads only on the static informational pages. Each runs only after you choose theirits purposespurpose, and the two are chosen separately. TheyNeither do not loadloads on our catalog, search, domain, referral, contact form, contact receipt, checkout, or recovery pages., Evenand on an eligibleevery page, a query string or fragment in the address, including a search, prevents loading. Once it loads, Google Analytics also records events on that page automatically: scrolling, clicks on links to other sites, starting and submitting a form, file downloads, and page changes made without a reload, so a catalog search or filter can be reported as a page address and a site search. A form event names the form and where it is sent, never what you typed into it. A domain page can show a purchase form, a signing button and a recovery link after it loads. The signing address opens from a button, not a link, and the recovery link is text for you to copy, so neither is reported. Analytics measures visits; advertising selects and measures ads. Both may use Google cookies. Declining either purpose leaves the rest of the site working. Cloudflare Web Analytics can measuremeasures the homepage, catalog, domain, blog, and policy pages afterfor aevery fresh analytics opt-invisitor. ThisIt is a cookieless measurement script, separate from Google Analytics, and it is not one of the cookie choices: it sets no cookie and stores nothing in your browser. A Global Privacy Control signal stops it on every page. It records page loading and interaction timing, layout stability, page and referrer addresses, browser/device information and country, and diagnostic information about page elements and resources involved in those timings. Cloudflare processes the network request needed to receive those measurements; this is not a claim that no IP address is processed in transit. We do not send form fields, account details, messages, or purchase credentials to this measurement service. We exclude domain purchase pages, contact and referral forms, receipts, checkout and recovery routes, previews, and staff test sessions. A browser that blocks this site's storage is excluded too, because the check for a staff test session cannot run there. A query string or fragment in the page address prevents loading, as does a referrer containing parameters or an unapproved path. Search terms are not added to measurements. The script does not measure single-page navigation., Existingand Google-onlyit grantsreads requiretimings, not what you type or which links a newpage choice before this added service can run; an explicit refusal of both purposes is preservedshows. Measurements cover only visitors who opt in and eligible pages only, so they do not represent every visitor or every purchase flow.

An operator test token in local storage, copied into a tab's session storage duringwhen that tab loads one of our pages, only in a browser our staff use for rehearsals, kept until they end the session. It is sent with rehearsal requests to distinguish tests from real purchases, and while it is present, analytics from that browser is marked as test traffic and excluded from our reports.

Google controls its cookies and product retention. Cookie expiry and server-side analytics retention are different; some cookie lifetimes may renew with use. Our explicit analyticsThe page address we send to analytics when a page loads excludes query strings and fragments, and its referrer is reduced to the origin. OurPage restrictedviews recorded automatically after an in-page coveragechange, alsosuch avoidsas buyera formscatalog filter, can include the query string. What you type into a form, the signing address and the recovery linkslink are not reported. Google property settings, automatic events and advertisingAdvertising consent-management configuration areis a separate controlscontrol; this custom banner is not a claim of Google CMP certification.

Wherever you live, you may ask us to show you the personal data we hold about you, correct it, delete it (with one exception: the row that records your telling us to stop emailing you offers, which Section 5 explains), or send it to you in a portable form. You may object to processing based on legitimate interests — including the request record, the email engagement record, the phone lookup result, and the offers we start, and Cloudflare's page measurement, which a Global Privacy Control signal stops — and you may withdraw consent to analytics and advertising without giving a reason and without affecting anything you have already done on the site.