Privacy Policy: what changed

Every field in the fiveform subsections that follow is one you typed yourself, with one exceptionexceptions named where itthey occursoccur: what comes back from the phone lookup, the payment references and status records Stripe returns, and the partner records described below. The fourother subsections after them describe what else this site records that you did not type, and what we send you: where a request came from, whether an email we sent you was opened, the offers we may email you and the stop that ends them, and what a text message to you led to.

Buying through Escrow.com, or paying monthly

When you submit an offer, an Escrow.com purchase, or a referral form, or open aan Escrow.com checkout, we store — alongside what you typed — the IP address the request came from and the country, region, city, and network operator that Cloudflare, which serves this site, derives from it. We use this for online fraud prevention: to assess whether a submission is genuine before acting on it. It is shown to the seller next to the submission, it is never used to decide automatically — a person reads it, and every offer is answered by a person. It is never used for advertising. It reaches only the seller — by email and, for offers, through the seller's private Telegram chat (see Telegram in Section 3) — and no one else in Section 3 besides Cloudflare, which produced it. Offers sent through Telegram carry no such record; Telegram does not pass an address to us.

Email we send you about your offer or purchase — a counter, a message from the seller, a payment prompt, a thank-you code — contains a tracking image and tracked links. When your mail client loads the image, or you follow a link, we record the time, the IP address, and the same derived location as above. We use this for online fraud prevention and to know whether a counter or a payment prompt actually reached you, so a stalled negotiation can be followed up rather than assumed dead. Every such email says so in its footer. The offers we start, described below, are sent the same way and carry the same image, the same tracked links, and the same footer line. Reading the plain-text version, or blocking remote images, prevents the open from being recorded while the email still works; the links still work either way, and following one is recorded. Many mail providers load images through their own servers, in which case the location recorded is theirs, not yours, and we mark it as such. This tracking does not apply to the confirmation, deal-subscription and partner emails described above.

For the offer, purchase and referral form subsections, the legal basis under the GDPR is the performance of, or steps taken at your request before entering into, a contract — for the sale of a domain name, or, for a referral, the referral commission arrangement described at Refer a buyer [/refer/] (Article 6(1)(b)); a text about your offer is a step in that same negotiation and rests on the same basis. Answering a purchase inquiry also falls under Article 6(1)(b); for other contact messages we rely on our legitimate interest in answering correspondence (Article 6(1)(f)). For the request record, the email engagement record, and the phone lookup result, the basis is our legitimate interest in preventing online fraud and in conducting the negotiation you started (Article 6(1)(f)); you may object to any of them at any time by writing to the address in Section 1, and where your local law requires consent for email tracking, the footer of each email is where we tell you and how to avoid it. The offers we start rest on Article 6(1)(f) too, for the different interest named in that subsection above, and the stop link in every such email is the simplest way to object to them. Where your local law requires consent for text messages, the offer form says next to the phone field that the number may be texted, and STOP withdraws that consent at any time. For the analyticsadvertising, and advertisingfor Google Analytics when you visit from the European Economic Area, the United Kingdom or Switzerland, both described in Section 4, the basis is your consent (Article 6(1)(a)), which you may withdraw at any time. When you visit from anywhere else, Google Analytics rests on our legitimate interest in knowing how visitors find and use the site (Article 6(1)(f)); Cookie settings or a Global Privacy Control signal is how to object to it. Cloudflare's cookieless page measurement, also described in Section 4, rests on our legitimate interest in knowing how many people visit which pages and how quickly they load (Article 6(1)(f)); a Global Privacy Control signal is how to object to it, and it stops the measurement on every page.

Escrow.com — the escrow facilitator for everytransactions non-directusing salethe Escrow.com route. Receives your email address and, once you are on their site, whatever their own process asks of you. Stripe — processes monthly card payments, stores the payment method used for future installments, and supplies the payment records described in Section 2. Receives your email, plan references and amounts, and the details you enter on its hosted checkout.

Cloudflare — serves every page, delivers our email, and runs the security checks in front of them. Processes your IP address and request metadata as part of delivering the site, and derives from the address the country, region, city, and network operator we store, as described in Section 2. With your analytics choice, itIt also receives the performancepage measurements described in Section 4.

Telegram — in two ways. The seller reads and answers offers and, contact inquiries and installment-status notifications from a private Telegram chat, so the details you type into the offer or contact form, and the offer request record described in Section 2 are delivered to the seller through Telegram's service, under Telegram's own privacy policy. And if you choose the "Send in Telegram" button — a deliberate act on your part — your conversation with the seller runs there too. Approved partners see only their own authorized opportunities, mandate versions, sale milestones and commission statements. They do not see competing claims, other partners' records or our internal rejection reasons. Public shortlist links show catalog facts and optional approved partner branding; they contain no client identity, briefs, private prices or commission details. Anyone with a share link can forward it. A partner can revoke the link, but revocation cannot erase a copy someone already made. We do not sell personal data, and we do not share it for cross-context behavioral advertising beyond the advertising cookies described below. No personal data is transferred to anyoneothers notexcept onthe processors and authorized partner views described in this listsection.

Optional Google Analytics and Google AdSense scripts load onlyloads on eligibleour homepage, catalog and domain pages and on our static informational pages (the policies and the blog). Optional Google AdSense loads only on the static informational pages. If you visit from the European Economic Area, the United Kingdom or Switzerland, each runs only after you choose theirits purposespurpose, and the two are chosen separately. TheyFrom doanywhere notelse, loadGoogle Analytics runs without asking, and you turn it off from Cookie settings or with a Global Privacy Control signal; AdSense still waits for your choice. We tell which applies from the country Cloudflare attributes to your connection, and when it cannot tell, we ask. Neither loads on our catalog, search, domain, referral, contact form, contact receipt, checkout, or recovery pages., Evenand on an eligibleevery page, a query string or fragment in the address, including a search, prevents loading. Once it loads, Google Analytics also records events on that page automatically: scrolling, clicks on links to other sites, starting and submitting a form, file downloads, and page changes made without a reload, so a catalog search or filter can be reported as a page address and a site search. A form event names the form and where it is sent, never what you typed into it. A domain page can show a purchase form, a signing button and a recovery link after it loads. The signing address opens from a button, not a link, and the recovery link is text for you to copy, so neither is reported. Analytics measures visits; advertising selects and measures ads. Both may use Google cookies. Declining either purpose leaves the rest of the site working. Cloudflare Web Analytics can measuremeasures the homepage, catalog, domain, blog, and policy pages afterfor aevery fresh analytics opt-invisitor. ThisIt is a cookieless measurement script, separate from Google Analytics, and it is not one of the cookie choices: it sets no cookie and stores nothing in your browser. A Global Privacy Control signal stops it on every page. It records page loading and interaction timing, layout stability, page and referrer addresses, browser/device information and country, and diagnostic information about page elements and resources involved in those timings. Cloudflare processes the network request needed to receive those measurements; this is not a claim that no IP address is processed in transit. We do not send form fields, account details, messages, or purchase credentials to this measurement service. We exclude domain purchase pages, contact and referral forms, receipts, checkout and recovery routes, previews, and staff test sessions. A browser that blocks this site's storage is excluded too, because the check for a staff test session cannot run there. A query string or fragment in the page address prevents loading, as does a referrer containing parameters or an unapproved path. Search terms are not added to measurements. The script does not measure single-page navigation., Existingand Google-onlyit grantsreads requiretimings, not what you type or which links a newpage choice before this added service can run; an explicit refusal of both purposes is preservedshows. Measurements cover only visitors who opt in and eligible pages only, so they do not represent every visitor or every purchase flow.

Use Cookie settings in the footer to reopen the controls. Outside the European Economic Area, the United Kingdom and Switzerland no banner appears, and Cookie settings is where you turn Google Analytics off. Turning off a loaded purpose requires a reload to remove its scripts; the page warns before reloading if it contains entered form data. Finish or copy unsent entries first. Global Privacy Control overrides both purposes to off. An old combined acceptance requires a new choice; an old refusal remains a refusal.

Google controls its cookies and product retention. Cookie expiry and server-side analytics retention are different; some cookie lifetimes may renew with use. Our explicit analyticsThe page address we send to analytics when a page loads excludes query strings and fragments, and its referrer is reduced to the origin. OurPage restrictedviews recorded automatically after an in-page coveragechange, alsosuch avoidsas buyera formscatalog filter, can include the query string. What you type into a form, the signing address and the recovery linkslink are not reported. Google property settings, automatic events and advertisingAdvertising consent-management configuration areis a separate controlscontrol; this custom banner is not a claim of Google CMP certification.

Offers and the correspondence around them are kept while the domain is still for sale and for 24 months after the last message between us, so that a returning buyer's history is intact and so a disputed negotiation can be reconstructed. Records of a completed sale — the agreement, the parties, the amount — are kept for seven years, under our records-retention policy. The applicable legal obligations and any specific hold are assessed separately. A referral lead is kept as part of our commercial records — the row is the ledger for whether, and how much, commission is owed on it, so it is not deleted once its window lapses; a sale that syncs late can still be matched against it. We use a lead's contact details to attribute the referral and to reach out to them about the domain(s) named, never for anything unrelated. The request record, the email engagement record, and, for an offer, the phone lookup result and the text messages described in Section 2 are kept with the offer, purchase, or lead they belong to, under that record's window above, and are included in its disposal review. The one record that outlives everything else is the opt-out itself: the suppression list holds only the address, the reason (link, one-click, reply, or manual), the campaign it came from and the date, and is retained indefinitely because it exists to honor the opt-out — deleting the row would put the address back in reach of the next campaign. The access, correction, and erasure rights in Section 6 apply to all of it, whether you are a buyer, a referrer, or the person referred; the one exception is erasure of that suppression row, which we keep for the reason just given. You can still ask to see it, and to have a mistyped address in it corrected. Disposal of the negotiation and financial records described here is an operator-reviewed process,; notthe ansubscription-only automaticcleanup timerabove is scheduled. Before removing an eligible nonfinancial negotiation we verify that its domains are no longer for sale, the last correspondence date, the absence of financial or commission evidence and any applicable hold. Missing or conflicting evidence keeps the record on hold for review. Linked conversations, financial records and referral ledgers require separate review; we do not delete transaction or duplicate-prevention evidence merely because a request expires. Deletion from active records is distinct from deletion of mailbox, processor, export and backup copies. Those copies have separate disposal and backup expiry processes; restored records must be checked against prior erasure requests. Provider retention and any required longer hold are reviewed when we handle a request. Google retains analytics under its product configuration. Private service-operation accounting uses keyed identifiers, which may still be linkable, to prevent abuse and duplicate operations. Time-window accounting has bounded cleanup; stable duplicate-prevention records need a separate review before disposal. Optional observation collection is off until a finite, capacity-limited campaign is configured. Monthly card-plan authorizations and financial records are retained while the plan is being collected or reviewed, and completed-sale records follow the seven-year policy above. An expired checkout does not erase its payment or duplicate-prevention evidence. Refund, dispute, processor and backup copies remain subject to the separate review and hold process described above.

Wherever you live, you may ask us to show you the personal data we hold about you, correct it, delete it (with one exception: the row that records your tellingask us to stopdelete emailing you offers, which Section 5 explains)it, or send it to you in a portable form. We assess erasure requests against ongoing obligations, documented financial and agreement purposes, and holds described in Section 5. We retain the permanent promotional suppression record to honor your opt-out. You may object to processing based on legitimate interests — including the request record, the email engagement record, the phone lookup result, and the offers we start, Cloudflare's page measurement, which a Global Privacy Control signal stops, and Google Analytics where it runs without asking, which Cookie settings or a Global Privacy Control signal turns off — and you may withdraw consent to deal subscriptions, analytics and advertising without giving a reason and without affecting anything you have already done on the site.

Every page and every form is served over HTTPS with HSTS. Offer, purchase, referral, and contact submissions are protected by anti-automation challenges. Access to stored offers, referral leads, contact inquiries, request records, email engagement records, phone lookup results, and text messages is limited to the seller. WeThis dowebsite does not hold card numbers or security codes. Stripe stores the payment credentials,method sofor there is nomonthly card dataplans; hereour torestricted losepayment-system credentials and stored transaction references are protected separately.