Privacy Policy

1.1 Account Information

When you create an account, we collect your email address, used for account identification, transactional emails, and magic link sign-in. No other personal information is required.

1.2 Payment Information

Payment processing is handled entirely by Stripe, Inc. We do not store your full credit card number, CVV, or billing address. We only receive a Stripe Customer ID, whether you have an active payment method, and transaction records.

1.3 Domain Registration Data

When you register a domain, we store the domain name, registration and expiration dates, DNS records, and WHOIS contact information as required by ICANN. WHOIS privacy is enabled by default.

1.4 API Usage Data

We collect API token identifiers, last-used timestamps, request metadata (endpoint, timestamp, IP, status code), and rate limiting counters (in-memory only). We also record when your account last made a signed-in request, and how many requests it makes each day through each client (website, mail website, CLI, MCP, SDKs, mobile app or direct API). These daily counts contain no endpoint, IP address or content.

1.5 Automatically Collected Data

When you visit our website or use the API, we may process IP address and user agent for rate limiting, security, and server logs. The website uses Vercel Web Analytics for aggregate page views, routes, referrers, country, browser, operating system, and device type. It does not use advertising pixels or cross-site advertising trackers.

1.6 Referral Data

If you participate in our referral program, we store your unique referral code, records of domains purchased using your code (domain name, date, commission amount), and commission payment status. We do not reveal the identity of referred users to referrers.

1.7 Email Data

When you use email, we store mailbox addresses, message content (sender, recipient, subject, body, headers, and attachments), folders, delivery status, suppression signals, and webhook URLs. Hosted mailboxes are stored and served by Domani's Stalwart mail infrastructure. API and transactional sending may be processed through Resend.

1.8 USDC Payment Data

When you pay with USDC, we store the blockchain transaction hash, chain identifier (Base or Ethereum), USDC amount, and wallet address. Transaction hashes are verified on-chain and can only be used once.

1.9 Webhook Data

When you create webhooks, we store endpoint URLs, subscribed event types, signing secrets (hashed), and delivery history (status, response codes, timestamps).

1.10 Parking Analytics

When domain parking is enabled, we collect anonymized visitor analytics: page views, daily view counts, and referrer data. No personally identifiable visitor information is stored.

1.11 Marketplace Data

When you use the marketplace, we store listing prices and inquiry data (name, email, offer amount, message) submitted by potential buyers.

1.12 Mobile App Data

The mobile app stores your short-lived session result and account email in the device's secure storage, caches mailbox and domain data on the device for performance, and contacts Domani to check for compatible app updates. Domani does not put API tokens in mobile links or browser routes.

4.1 Storage

Your data is stored in a PostgreSQL database on secure, encrypted infrastructure. All data is encrypted at rest and in transit (TLS 1.2+).

4.2 Security Measures

• All connections encrypted via HTTPS/TLS
• API authentication via Bearer tokens
• Per-user, per-endpoint rate limiting
• No storage of raw payment credentials
• Separated application, database, and mail-hosting infrastructure

4.3 Breach Notification

In the event of a data breach, we will notify affected users via email within 72 hours of discovery.

6.1 All Users

• Access - request a copy of all data we hold about you
• Correction - request correction of inaccurate data
• Deletion - request deletion of your account and associated data
• Export - request an export in a machine-readable format

6.2 EU/EEA Users (GDPR)

Additional rights: data portability, restrict processing, object to processing, lodge a complaint with your local data protection authority. Our lawful basis for processing is contract performance, legitimate interests (security, fraud prevention), and legal obligation (ICANN, tax compliance).

6.3 California Users (CCPA)

California residents have the right to know what information is collected, request deletion, and opt out of the sale of personal information. We do not sell personal information.

Connected inboxes

When you connect Gmail or another provider, the platform copies the mail received after the date you chose, never the whole inbox, and keeps the copies, their attachments and a search index. Your provider credentials are stored encrypted and used only to read, and later to send on your behalf when you allow it. Disconnecting removes your copies, the index and the credentials; the receipts of what agents did stay, so you can audit them.

Your bounds

• Choose the import date: the last 24 hours by default; widen it later, on request.
• Opt a mailbox out of search (words only, no embeddings) or out of the brief reading (deterministic briefs, no excerpt sent).
• Pause the assistant, or disable it on a mailbox; nothing is deleted by any of these.
• No level of autonomy can delete mail; every effect leaves a receipt with its evidence.