Privacy Policy: what changed

In short. This site has no accounts and nothing to log in to. It collects personal data when you fill in a form — to make an offer, buy a domain, refer a buyer, or contact us. For offers, purchases and referrals, it records where the request came from. Email we send you about an offer or a purchase records whether it was opened and which links were clicked. Both are for online fraud prevention, both are described below, and both are read by a person. A phone number you choose to leave with an offer is checked once, and is texted about that offer only if you tick the box asking for texts — reply STOP and it is not texted again, and no mobile information is ever shared for marketing. If you asked about a domain anywhere but the contact form, or bought one, we may email you a discount code for similar domains; every such email has a link that stops them, and a stop is permanent. The pages also load analytics and advertising scripts from Google on eligible static pages, with independent choices for analytics and advertising. Buyer and recovery pages do not load those scripts. You can also choose Cloudflare performance measurement on eligible browsing pages. It helps us understand loading speed, responsiveness, and layout shifts. Everything else on the page works without knowing who you are.

Every field in the five subsections that follow is one you typed yourself, with one exception named where it occurs: what comes back from the phone lookup. The threefour subsections after them describe thewhat other thingselse this site records that you did not type, and what we send you: where a request came from, whether an email we sent you was opened, the offers we may email you and the stop that ends them, and what a text message to you led to.

Email we send you about your offer or purchase — a counter, a message from the seller, a payment prompt, a thank-you code — contains a tracking image and tracked links. When your mail client loads the image, or you follow a link, we record the time, the IP address, and the same derived location as above. We use this for online fraud prevention and to know whether a counter or a payment prompt actually reached you, so a stalled negotiation can be followed up rather than assumed dead. Every such email says so in its footer. The offers we start, described below, are sent the same way and carry the same image, the same tracked links, and the same footer line. Reading the plain-text version, or blocking remote images, prevents the open from being recorded while the email still works; the links still work either way, and following one is recorded. Many mail providers load images through their own servers, in which case the location recorded is theirs, not yours, and we mark it as such. Offers we start If you have made an offer on a domain, started a purchase, bought one, or asked us about one, we may email you a discount code good for that domain or any other on this site — a domain being a similar product to the one you asked about. We do this rarely, and each such email carries our postal address and a link that stops these emails: it opens a page with one button, and pressing that button records your address in a suppression list we never delete from, so you are never sent one of these offers again. Your mail client's own Unsubscribe button does the same thing without the page, because we send the List-Unsubscribe headers it reads. It does not stop replies to an offer you make later: those continue the negotiation you start. A message you send through the contact form never leads to one of these offers: it is answered, and nothing more. The legal basis is Article 6(1)(f), our interest in offering similar products to people who came to us for one, which the opt-out at collection and in every message keeps proportionate; where you are in the United States, CAN-SPAM's requirements are met by the address and the opt-out.

For the offer, purchase and referral form subsections, the legal basis under the GDPR is the performance of, or steps taken at your request before entering into, a contract — for the sale of a domain name, or, for a referral, the referral commission arrangement described at Refer a buyer [/refer/] (Article 6(1)(b)); a text about your offer is a step in that same negotiation and rests on the same basis. Answering a purchase inquiry also falls under Article 6(1)(b); for other contact messages we rely on our legitimate interest in answering correspondence (Article 6(1)(f)). For the request record, the email engagement record, and the phone lookup result, the basis is our legitimate interest in preventing online fraud and in conducting the negotiation you started (Article 6(1)(f)); you may object to any of them at any time by writing to the address in Section 1, and where your local law requires consent for email tracking, the footer of each email is where we tell you and how to avoid it. The offers we start rest on Article 6(1)(f) too, for the different interest named in that subsection above, and the stop link in every such email is the simplest way to object to them. Where your local law requires consent for text messages, the offer form says next to the phone field that the number may be texted, and STOP withdraws that consent at any time. For the analytics and advertising described in Section 4, the basis is your consent (Article 6(1)(a)), which you may withdraw at any time.

Cloudflare — serves every page, delivers our email, and runs the security checks in front of them. Processes your IP address and request metadata as part of delivering the site, and derives from the address the country, region, city, and network operator we store, as described in Section 2. With your analytics choice, it also receives the performance measurements described in Section 4.

Offers and the correspondence around them are kept while the domain is still for sale and for 24 months after the last message between us, so that a returning buyer's history is intact and so a disputed negotiation can be reconstructed. Records of a completed sale — the agreement, the parties, the amount — are kept for seven years, under our records-retention policy. The applicable legal obligations and any specific hold are assessed separately. A referral lead is kept as part of our commercial records — the row is the ledger for whether, and how much, commission is owed on it, so it is not deleted once its window lapses; a sale that syncs late can still be matched against it. We use a lead's contact details to attribute the referral and to reach out to them about the domain(s) named, never for anything unrelated. The request record, the email engagement record, and, for an offer, the phone lookup result and the text messages described in Section 2 are kept with the offer, purchase, or lead they belong to, under that record's window above, and are included in its disposal review. The one record that outlives everything else is the opt-out itself: the suppression list holds only the address, the reason (link, one-click, reply, or manual), the campaign it came from and the date, and is retained indefinitely because it exists to honor the opt-out — deleting the row would put the address back in reach of the next campaign. The access, correction, and erasure rights in Section 6 apply to all of it, whether you are a buyer, a referrer, or the person referred; the one exception is erasure of that suppression row, which we keep for the reason just given. You can still ask to see it, and to have a mistyped address in it corrected. Disposal is an operator-reviewed process, not an automatic timer. Before removing an eligible nonfinancial negotiation we verify that its domains are no longer for sale, the last correspondence date, the absence of financial or commission evidence and any applicable hold. Missing or conflicting evidence keeps the record on hold for review. Linked conversations, financial records and referral ledgers require separate review; we do not delete transaction or duplicate-prevention evidence merely because a request expires. Deletion from active records is distinct from deletion of mailbox, processor, export and backup copies. Those copies have separate disposal and backup expiry processes; restored records must be checked against prior erasure requests. Provider retention and any required longer hold are reviewed when we handle a request. Google retains analytics under its product configuration. Private service-operation accounting uses keyed identifiers, which may still be linkable, to prevent abuse and duplicate operations. Time-window accounting has bounded cleanup; stable duplicate-prevention records need a separate review before disposal. Optional observation collection is off until a finite, capacity-limited campaign is configured.

Wherever you live, you may ask us to show you the personal data we hold about you, correct it, delete it (with one exception: the row that records your telling us to stop emailing you offers, which Section 5 explains), or send it to you in a portable form. You may object to processing based on legitimate interests — including the request record, the email engagement record, and the phone lookup result, and the offers we start — and you may withdraw consent to analytics and advertising without giving a reason and without affecting anything you have already done on the site.