Privacy Policy: what changed
AI summary
AI-written reading aid: changes between these versions. The linked published versions are the authoritative text.
- Adds the partner program: verified business sign-in, applications, partner-supplied client introductions, untracked partner email, a sign-in cookie, and partner views limited to their own authorized records.
- Adds operator-reviewed partner retention with earliest cutoffs; accepted agreements and financial records are never automatically deleted.
- Replaces the single erasure exception with assessment against obligations, agreement purposes and holds, keeps the suppression record, and adds Better Stack status monitoring that receives your IP when you load its badge.
Wording changes
Removed text is struck through; added text is underlined.
Unchanged paragraphs are omitted. Link destinations appear in brackets.
Every field in the form subsections that follow is one you typed yourself, with exceptions named where they occur: what comes back from the phone lookup, and the payment references and status records Stripe returns, and the partner records described below. The other subsections describe what else this site records that you did not type, and what we send you: where a request came from, whether an email we sent you was opened, the offers we may email you and the stop that ends them, and what a text message to you led to.
Agency partners and external brokers
To sign in to the partner program [/partners/], you give us your business email address and verify it with a one-use code. An application adds your business name, website, name, country, experience and plan, and selected role. We record the exact agreement version, document reference and hash you accept, and its acceptance time. We use these records to review your application and administer the agreement. Email verification does not approve an application.
For an introduction, the partner supplies the client's name, email address, domains, introduction and permission evidence, and preferred contact arrangement. These client details come from the partner, rather than from the client directly. The partner must have the client's permission to share them and disclose their financial interest. We use them to review the introduction, service the named domain opportunity, and attribute commission. We do not use them to solicit agency services or add the client to marketing. Essential transaction messages still go to the buyer.
We keep broker mandate versions, each party's acceptance, approved domain scope and outreach terms, and activity reports. We also keep opportunity review and protection dates, commission and settlement evidence, refund and recovery records, payout references and times, statements, and the audit history needed to explain decisions and prevent duplicate claims or payments. We collect payout or tax details privately when needed, rather than through the application form. Only the seller approves applications, opportunities, mandates and settlement evidence.
Sign-in security records include code and token proofs, session and request identifiers, and keyed hashes used to limit requests by email and IP address. The partner sign-in records do not store the raw IP address or the derived location record described below. Cloudflare still processes requests for hosting and security. Sign-in codes, application and registration updates, and statement notices are transactional email with no open-tracking image or tracked link redirects. Notices direct you to the private workspace; they do not include client evidence or commission amounts. We record attempted mail, accepted or uncertain outcomes, and replay proofs to prevent duplicate sends. Provider acceptance does not prove inbox delivery. Applying or joining adds no newsletter consent.
For partner applications and agreements, we rely on steps toward or performance of the partner contract (Article 6(1)(b)). Servicing a client's domain request follows the sale and negotiation basis described below. Account security, commission attribution, audit and duplicate prevention serve our legitimate interests in operating the program and protecting its participants (Article 6(1)(f)); you may object through the contact in Section 1.
Email we send you about your offer or purchase — a counter, a message from the seller, a payment prompt, a thank-you code — contains a tracking image and tracked links. When your mail client loads the image, or you follow a link, we record the time, the IP address, and the same derived location as above. We use this for online fraud prevention and to know whether a counter or a payment prompt actually reached you, so a stalled negotiation can be followed up rather than assumed dead. Every such email says so in its footer. The offers we start, described below, are sent the same way and carry the same image, the same tracked links, and the same footer line. Reading the plain-text version, or blocking remote images, prevents the open from being recorded while the email still works; the links still work either way, and following one is recorded. Many mail providers load images through their own servers, in which case the location recorded is theirs, not yours, and we mark it as such. This tracking does not apply to the confirmation and, deal-subscription and partner emails described above.
Better Stack — independently checks our public homepage, privacy policy and security contact page, and hosts our status page. These checks do not send buyer records, form submissions or signed links. Better Stack may store the checked pages' responses and incident screenshots. Loading the status badge in our Trust Center, or opening the status page, sends Better Stack your IP address and the request metadata needed to serve that content. The badge sends no referring page address and runs no scripts. This functional availability display is separate from analytics and advertising; we use it to help visitors check whether the website is reachable. Better Stack controls its service logs and incident retention; we do not promise a fixed deletion period for those copies. See Better Stack's privacy policy [https://betterstack.com/privacy]. You may object or ask about this processing using the contact details in Section 6.
Approved partners see only their own authorized opportunities, mandate versions, sale milestones and commission statements. They do not see competing claims, other partners' records or our internal rejection reasons. Public shortlist links show catalog facts and optional approved partner branding; they contain no client identity, briefs, private prices or commission details. Anyone with a share link can forward it. A partner can revoke the link, but revocation cannot erase a copy someone already made.
We do not sell personal data, and we do not share it for cross-context behavioral advertising beyond the advertising cookies described below. No personal data is transferred to anyoneothers notexcept onthe processors and authorized partner views described in this listsection.
A necessary partner sign-in cookie, __Host-ng-partner, valid for seven days unless revoked sooner. It is Secure, HttpOnly and SameSite=Lax. Partner local storage keeps a session identifier, CSRF proof and expiry under ng-partner-csrf-v1 so your tabs can make authenticated requests. This local record contains no client details or session bearer token. Signing out clears it; an expired record is not accepted. Clear site data to remove it.
Partner program records
Partner cleanup is an explicit operator-reviewed process, not scheduled deletion. We check current eligibility and holds before retiring a record. The earliest cutoffs are:
Sign-in challenges and their email/code proofs: 24 hours after the ten-minute challenge expires.
Sessions and token/CSRF proofs: seven days after expiry or earlier revocation.
Rate-limit buckets and request-side hashes: 24 hours after their 15-minute window ends; copies in a sign-in request follow its challenge cutoff.
Mail replay proofs and owner payloads: 24 hours after their operational update. Linked command copies also wait until their own timestamp plus 24 hours.
Rejected applications and inactive rejected profile copies: 90 days after their review decision. Each reapplication has its own clock.
Unapproved introductions whose items were all declined: 180 days after the last decision.
Explicitly closed shortlists and share proofs: 24 calendar months after owner closure. Closed nonfinancial profiles, applications and fully declined introductions also have a 24-month closure cutoff.
Retirement removes unnecessary contact fields and bounded operational proof, while keeping identifiers, actor and time records, original command fingerprints, audit references and retirement markers. We do not close inactive accounts automatically. An open account keeps its verified login email, including when an applicant may reapply. Accepted agreements keep the minimum verified email association needed to identify who accepted them after profile details are removed. An account without agreement, financial or hold purposes may retire its email at the closed-profile cutoff. Any later reduction of agreement identity requires manual purpose review.
Approved opportunities, ongoing obligations, accepted agreements and financial evidence are retained for their documented purposes. Accepted agreements and financial records are never automatically deleted. Seven calendar years after verified final settlement and recovery is a manual purpose-review boundary, not a deletion deadline. A last receipt or paid payout alone does not prove finality. Open disputes, ongoing obligations and holds suspend disposal; later financial activity requires a fresh review of finality. A due review does not itself authorize deletion. Mailbox, processor, export and backup copies follow the separate review processes below. Partner cleanup does not change legacy referral or permanent suppression records.
Wherever you live, you may ask us to show you the personal data we hold about you, correct it, delete it (with one exception: the row that records your tellingask us to stopdelete emailing you offers, which Section 5 explains)it, or send it to you in a portable form. We assess erasure requests against ongoing obligations, documented financial and agreement purposes, and holds described in Section 5. We retain the permanent promotional suppression record to honor your opt-out. You may object to processing based on legitimate interests — including the request record, the email engagement record, the phone lookup result, the offers we start, Cloudflare's page measurement, which a Global Privacy Control signal stops, and Google Analytics where it runs without asking, which Cookie settings or a Global Privacy Control signal turns off — and you may withdraw consent to deal subscriptions, analytics and advertising without giving a reason and without affecting anything you have already done on the site.
All effective dates are stated in Coordinated Universal Time (UTC).