Privacy Policy: what changed

In short. This site has no accounts and nothing to log in to. It collects personal data when you fill in a form — to make an offer, buy a domain, or refer a buyer — and, with each of those, it records where the request came from. Email we send you about an offer or a purchase records whether it was opened and which links were clicked. Both are for online fraud prevention, both are described below, and both are read by a person. A phone number you choose to leave with an offer is checked once, and is texted about that offer only if you tick the box asking for texts — reply STOP and it is not texted again. The pages also load analytics and advertising scripts from Google that set their own cookies, only after you agree. Everything else on the page works without knowing who you are.

Every field in the four subsections that follow is one you typed yourself, with one exception named where it occurs: what comes back from the phone lookup. The twothree subsections after them describe the onlyother things this site records that you did not type: where a request came from, and whether an email we sent you was opened, and what a text message to you led to.

The offer form collects your first name, your email address, the domain and amount you are offering, and — if you choose to fill them in — your last name, phone number, a message, and a proposed payment plan. We need this to read your offer, reply to it, and negotiate. If you give a phone number, we send it to Telnyx once to check that it is a working number and whether it can receive text messages, and we keep what comes back — the country, for US numbers the city and state, the line type, and the carrier — with your offer. If you also tick the "Text me about this offer at this number" box, we may text that number about your offer: the seller can send you a short message, and a day after we send a reply that bounced or shows no sign of having been opened, we send one automatic text asking you to check your email. Leave the box unticked and the number is never texted; it is only shown to the seller. Texts we send, replies you send, and whether each text was delivered are kept with the offer. Reply STOP to any text and no further texts are sent to that number. Choosing to send the offer through Telegram instead hands the same details to Telegram's own service.

For the four form subsections, the legal basis under the GDPR is the performance of, or steps taken at your request before entering into, a contract — for the sale of a domain name, or, for a referral, the referral commission arrangement described at Refer a buyer [/refer/] (Article 6(1)(b)); a text about your offer is a step in that same negotiation and rests on the same basis. For the request record and, the email engagement record, and the phone lookup result, the basis is our legitimate interest in preventing online fraud and in conducting the negotiation you started (Article 6(1)(f)); you may object to eitherany of them at any time by writing to the address in Section 1, and where your local law requires consent for email tracking, the footer of each email is where we tell you and how to avoid it. Where your local law requires consent for text messages, the offer form says next to the phone field that the number may be texted, and STOP withdraws that consent at any time. For the analytics and advertising described in Section 4, the basis is your consent (Article 6(1)(a)), which you may withdraw at any time.

We do not sell personal data, and we do not share it for cross-context behaviouralbehavioral advertising beyond the advertising cookies described below. No personal data is transferred to anyone not on this list.

Your colourcolor theme choice, in local storage, so the site does not flip between light and dark as you navigate.

Offers and the correspondence around them are kept while the domain is still for sale and for 24 months after the last message between us, so that a returning buyer's history is intact and so a disputed negotiation can be reconstructed. Records of a completed sale — the agreement, the parties, the amount — are kept for seven years, because tax and contract law require it. A referral lead is kept as part of our commercial records — the row is the ledger for whether, and how much, commission is owed on it, so it is not deleted once its window lapses; a sale that syncs late can still be matched against it. We use a lead's contact details to attribute the referral and to reach out to them about the domain(s) named, never for anything unrelated. The request record and, the email engagement record, and, for an offer, the phone lookup result and the text messages described in Section 2 are kept with the offer, purchase, or lead they belong to, under that record's window above, and are deleted with it. The access, correction, and erasure rights in Section 6 apply to all of it, whether you are a buyer, a referrer, or the person referred. Analytics data is retained by Google under the retention window configured in that product. Nothing is kept "just in case".

Wherever you live, you may ask us to show you the personal data we hold about you, correct it, delete it, or send it to you in a portable form. You may object to processing based on legitimate interests — including the request record and, the email engagement record, and the phone lookup result — and you may withdraw consent to analytics and advertising without giving a reason and without affecting anything you have already done on the site.

Every page and every form is served over HTTPS with HSTS. Offer, purchase, and referral submissions are protected by anti-automation challenges. Access to stored offers, referral leads, request records, and email engagement records, phone lookup results, and text messages is limited to the seller. We do not hold payment credentials, so there is no card data here to lose.