Privacy Policy: what changed

Every field in the form subsections that follow is one you typed yourself, with exceptions named where they occur: what comes back from the phone lookup, and the payment references and status records Stripe returns, the partner records described below, and the history and consent records of a contact inquiry. The other subsections describe what else this site records that you did not type, and what we send you: where a request came from, whether an email we sent you was opened, the offers we may email you and the stop that ends them, and what a text message to you led to.

The contact form [/contact/] collects your name, your email address, the reason you choose for writing, your message, and any catalog domains you choose, and, if you give one, your phone number. A general inquiry needs no domain selection. We senduse these details to answer you, and the phone number only to call you about your message: we do not look it up, and we never text it unless you tick the text box described below. The form also stores the request record described under "What we record about the request". We keep each request as a history: what you sent, and what we did with it and when, including the text of any reply we send. Each request reaches the seller's email inbox and private Telegram chat so we can answer you. A generalreply inquirycomes needsfrom noour domainown selectionaddress and is tracked like the other email described under "Email engagement"; a short reply telling you that you have reached a different company than the one you meant is not tracked. We domay notblock attachan address that sends us spam: we then keep the offeraddress, form'sthe IP/locationdate recordand a reference to contactthe inquiriesrequest, and send nothing more to it. ItSending the form creates no offer, or referral registration, marketingand subscription,it ornever automated emailleads to youthe offers we start described below. Optional analytics and advertising scripts do not run on this form. Two boxes on the form are optional and unticked until you tick them: one asks for deals and news by email, the other for deals and news by text at the number you gave. Leaving them unticked does not change our answer. Ticking the email box sends you one email asking you to confirm; nobody is emailed deals before pressing its button, and an address that has stopped our promotional email stays stopped: a new tick never lifts it. Ticking the text box records your consent to deal texts; we send none yet, and before the first one we send one text asking you to confirm (see SMS Terms [/sms/]). For each tick we keep a consent record: the address or number, the exact wording you saw and its version, when you asked and when you confirmed, the request it came from, a keyed hash of the request's IP address rather than the IP address itself, your browser's user-agent string and your country. You withdraw a consent with the unsubscribe link in any of our promotional emails, which also stops the discount-code offers described below, by replying STOP to a text, or by writing to the address in Section 1.

We use these choices to select published deals for your digest and price changes for followed names, on the basis of your consent (Article 6(1)(a)). We keep the version of the consent wording, the requested and verified times, the signup source and each verified change so we can demonstrate your choices. You can disable the digest, change its filters or remove followed names through email preferences. Every promotional message also has a link that opens a page where you confirm a stop to all promotional email. Your mail client's one-click unsubscribe control applies that stop directly. That permanent stop applies to subscriptions, to the deals and news the contact form can ask for, and to the discount-code offers described below; a new signup request or a new tick on the contact form does not remove it. Replies about an offer or purchase you initiated continue under their separate purpose.

When you submit an offer, an Escrow.com purchase, a referral or a referralcontact form, or open an Escrow.com checkout, we store — alongside what you typed — the IP address the request came from and the country, region, city, and network operator that Cloudflare, which serves this site, derives from it. We use this for online fraud prevention: to assess whether a submission is genuine before acting on it. It is shown to the seller next to the submission, it is never used to decide automatically — a person reads it, and every offer is answered by a person. It is never used for advertising. It reaches only the seller — by email and, for offers and contact inquiries, through the seller's private Telegram chat (see Telegram in Section 3) — and no one else in Section 3 besides Cloudflare, which produced it. Offers sent through Telegram carry no such record; Telegram does not pass an address to us.

Email we send you about your offer or purchase — a counter, a message from the seller, a payment prompt, a thank-you code — containsand our reply to a contact inquiry contain a tracking image and tracked links. When your mail client loads the image, or you follow a link, we record the time, the IP address, and the same derived location as above. We use this for online fraud prevention and to know whether a counter or, a payment prompt or our answer actually reached you, so a stalled negotiationconversation can be followed up rather than assumed dead. Every such email says so in its footer. The offers we start, described below, are sent the same way and carry the same image, the same tracked links, and the same footer line. Reading the plain-text version, or blocking remote images, prevents the open from being recorded while the email still works; the links still work either way, and following one is recorded. Many mail providers load images through their own servers, in which case the location recorded is theirs, not yours, and we mark it as such. This tracking does not apply to the confirmation and, deal-subscription and partner emails described above, to the email asking you to confirm deals by email, or to the short reply about a different company.

If you have made an offer on a domain, started a purchase, bought one, or asked us about one, we may email you a discount code good for that domain or any other on this site — a domain being a similar product to the one you asked about. We do this rarely, and each such email carries our postal address and a link that stops these emails: it opens a page with one button, and pressing that button records your address in a suppression list we never delete from, so you are never sent one of these offers again. Your mail client's own Unsubscribe button does the same thing without the page, because we send the List-Unsubscribe headers it reads. It does not stop replies to an offer you make later: those continue the negotiation you start. A message you send through the contact form never leads to one of these offers:; itthe isdeals answeredand news you can ask for on that form are separate, and nothingare moresent only with your consent.

The contact form has its own, separate box for deals and news by text, described under "Contact inquiries" above. It needs a phone number, and ticking it records your consent; we send no deal texts yet, and before the first one we send one text asking you to confirm. STOP withdraws that consent as well, and START does not restore it: to get deal texts again, tick the box again. Message frequency varies, and message and data rates may apply. The terms of that program are at SMS Terms [/sms/] too. No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Your phone number, and the consent you gave to be texted at it, are never sold, rented, or passed to anyone for their own use. The seller reads the number along with the rest of your offer, which reaches them through Telegram as Section 3 describes — that happens whether or not you ask to be texted, because it is how an offer is read at all; a number you give on the contact form reaches the seller the same way, with your message. For the messages themselves the only parties that handle it are Telnyx, the subcontractor that verifies the number and carries what we send, and the mobile carrier that delivers it; neither may use it for anything but delivering our messages to you.

For the offer, purchase and referral form subsections, the legal basis under the GDPR is the performance of, or steps taken at your request before entering into, a contract — for the sale of a domain name, or, for a referral, the referral commission arrangement described at Refer a buyer [/refer/] (Article 6(1)(b)); a text about your offer is a step in that same negotiation and rests on the same basis. Answering a purchasecontact inquirymessage alsoabout fallsbuying undera domain is a step at your request before a contract (Article 6(1)(b)); for other contact messages, and for keeping each inquiry's history and blocking an address that sends us spam, we rely on our legitimate interest in answering and keeping track of correspondence (Article 6(1)(f)). Deals and news by email or text from the contact form rest on your consent (Article 6(1)(a)), which you may withdraw at any time; we keep its record on our legitimate interest in being able to show what you agreed to (Article 6(1)(f)). For the request record, the email engagement record, and the phone lookup result, the basis is our legitimate interest in preventing online fraud and in conducting the negotiation you started (Article 6(1)(f)); you may object to any of them at any time by writing to the address in Section 1, and where your local law requires consent for email tracking, the footer of each email is where we tell you and how to avoid it. The offers we start rest on Article 6(1)(f) too, for the different interest named in that subsection above, and the stop link in every such email is the simplest way to object to them. Where your local law requires consent for text messages, the offer form says next to the phone field that the number may be texted, and STOP withdraws that consent at any time. For advertising, and for Google Analytics when you visit from the European Economic Area, the United Kingdom or Switzerland, both described in Section 4, the basis is your consent (Article 6(1)(a)), which you may withdraw at any time. When you visit from anywhere else, Google Analytics rests on our legitimate interest in knowing how visitors find and use the site (Article 6(1)(f)); Cookie settings or a Global Privacy Control signal is how to object to it. Cloudflare's cookieless page measurement, also described in Section 4, rests on our legitimate interest in knowing how many people visit which pages and how quickly they load (Article 6(1)(f)); a Global Privacy Control signal is how to object to it, and it stops the measurement on every page.

Telegram — in two ways. The seller reads and answers offers, contact inquiries and installment-status notifications from a private Telegram chat, so the details you type into the offer or contact form, and the offer request record described in Section 2 for an offer or a contact inquiry, are delivered to the seller through Telegram's service, under Telegram's own privacy policy. And if you choose the "Send in Telegram" button — a deliberate act on your part — your conversation with the seller runs there too. Approved partners see only their own authorized opportunities, mandate versions, sale milestones and commission statements. They do not see competing claims, other partners' records or our internal rejection reasons. Public shortlist links show catalog facts and optional approved partner branding; they contain no client identity, briefs, private prices or commission details. Anyone with a share link can forward it. A partner can revoke the link, but revocation cannot erase a copy someone already made. We do not sell personal data, and we do not share it for cross-context behavioral advertising beyond the advertising cookies described below. No personal data is transferred to anyoneothers notexcept onthe processors and authorized partner views described in this listsection.

General contactContact inquiries use a scheduled cleanup too. A request and its history are retaineddeleted 24 months after their last event; a request we marked as spam, or one from a blocked address, after 30 days; a staff test request after seven days. The record of a blocked address stays until we lift the block. A consent record is kept while the consent is in ouruse, sellerfor inboxfive years after it is withdrawn, as proof of what you agreed to and privatewhen Telegramyou chatstopped, and for up to 24 months after the lastrequest correspondence,if subjectit towas never confirmed. A documented legal hold on a request suspends this cleanup for the operator-reviewed disposalrequest and holdfor processthe belowconsent records it produced. An inquiry that becomes an offer or sale follows that record's retention rule. RemovingThe copies in our seller inbox and private Telegram chat are outside this cleanup and follow the operator-reviewed disposal and hold process below; removing an inquiry requires reviewing both notification channels, not only our website database. Offers and the correspondence around them are kept while the domain is still for sale and for 24 months after the last message between us, so that a returning buyer's history is intact and so a disputed negotiation can be reconstructed. Records of a completed sale — the agreement, the parties, the amount — are kept for seven years, under our records-retention policy. The applicable legal obligations and any specific hold are assessed separately. A referral lead is kept as part of our commercial records — the row is the ledger for whether, and how much, commission is owed on it, so it is not deleted once its window lapses; a sale that syncs late can still be matched against it. We use a lead's contact details to attribute the referral and to reach out to them about the domain(s) named, never for anything unrelated. The request record, the email engagement record, and, for an offer, the phone lookup result and the text messages described in Section 2 are kept with the offer, purchase, contact inquiry or lead they belong to, under that record's window above, and are included in its disposal review. TheAmong onethe recordrecords thatkept outlives everything elselongest is the opt-out itself: the suppression list holds only the address, the reason (link, one-click, reply, or manual), the campaign it came from and the date, and is retained indefinitely because it exists to honor the opt-out — deleting the row would put the address back in reach of the next campaign. The access, correction, and erasure rights in Section 6 apply to all of it, whether you are a buyer, a referrer, or the person referred, or someone who wrote to us through the contact form; the oneexceptions exception isare erasure of that suppression row, which we keep for the reason just given, of the record of a blocked address, which keeps the block in force, and of a withdrawn consent record, which an erasure reduces to the address or number, the wording and its version, the dates, the request reference, the keyed IP hash and the country, and keeps for the five years described above. You can still ask to see itthem, and to have a mistyped address in itthem corrected. Disposal of the negotiation and financial records described here is an operator-reviewed process; the deal-subscription-only cleanupand contact cleanups above isare scheduled. Before removing an eligible nonfinancial negotiation we verify that its domains are no longer for sale, the last correspondence date, the absence of financial or commission evidence and any applicable hold. Missing or conflicting evidence keeps the record on hold for review. Linked conversations, financial records and referral ledgers require separate review; we do not delete transaction or duplicate-prevention evidence merely because a request expires. Deletion from active records is distinct from deletion of mailbox, processor, export and backup copies. Those copies have separate disposal and backup expiry processes; restored records must be checked against prior erasure requests. Provider retention and any required longer hold are reviewed when we handle a request. Google retains analytics under its product configuration. Private service-operation accounting uses keyed identifiers, which may still be linkable, to prevent abuse and duplicate operations. Time-window accounting has bounded cleanup; stable duplicate-prevention records need a separate review before disposal. Optional observation collection is off until a finite, capacity-limited campaign is configured.

Wherever you live, you may ask us to show you the personal data we hold about you, correct it, delete it (with one exception: the row that records your tellingask us to stopdelete emailing you offers, which Section 5 explains)it, or send it to you in a portable form. We assess erasure requests against ongoing obligations, documented financial and agreement purposes, and holds described in Section 5. We retain the permanent promotional suppression record to honor your opt-out, the record of a blocked address, and a withdrawn consent record, which is kept in reduced form, as Section 5 explains. You may object to processing based on legitimate interests — including the request record, the email engagement record, the phone lookup result, the offers we start, Cloudflare's page measurement, which a Global Privacy Control signal stops, and Google Analytics where it runs without asking, which Cookie settings or a Global Privacy Control signal turns off — and you may withdraw consent to deal subscriptions, to deals and news from the contact form, and to analytics and advertising without giving a reason and without affecting anything you have already done on the site.

Every page and every form is served over HTTPS with HSTS. Offer, purchase, referral, and contact submissions are protected by anti-automation challenges. Access to stored offers, referral leads, contact inquiries and their consent records, request records, email engagement records, phone lookup results, and text messages is limited to the seller. This website does not hold card numbers or security codes. Stripe stores the payment method for monthly card plans; our restricted payment-system credentials and stored transaction references are protected separately.