This policy explains what personal data the domainagent.ai service processes, why, on what legal basis, who receives it, how long we keep it and how you can use your rights. It covers our customers, the domain owners and prospects the agent contacts for them, and visitors to the website.
Last updated October 14, 2026.
1. Who we are
The controller of personal data described in this policy is the administrator of the domainagent.ai service (in this policy "we", "us" or "DomainAgent"). You can reach us about anything in this policy at support@domainagent.ai.
DomainAgent is software that helps businesses buy, sell, watch and manage domain names with AI agents. For most data described here we decide why and how it is processed, so we act as controller. Where a customer uses DomainAgent to contact people about domains, the customer decides which deals to pursue, and we process the related data both to run the service for that customer and to apply our own outreach rules, such as the global suppression list.
2. Data we process
2.1 Account data
Your name, email address, password (stored only as a salted hash), the one time code used to confirm your email, your role in the workspace and your settings. If your organization uses single sign-on, we receive the identifiers your identity system sends us.
2.2 Workspace and billing data
The workspace name, the plan, seats, usage counters and billing history. Card payments are handled by a payment processor: we never receive your full card number, only details such as the card brand, the last four digits, the expiry month and the payment status. For invoice billing on Agency we keep the company name, billing address and tax number you give us.
2.3 Connected mailbox data
When you connect a work mailbox, we store its address and the encrypted credentials or access token needed to send and read deal messages. The agent sends the messages in sequences you approved and reads only the threads that belong to a deal. We store the messages in those threads (sender, recipient, subject, body and time). We do not index, copy or analyze the rest of your mailbox.
2.4 Deal data
Target domains, budgets, approved bands (opening offer, step size, ceiling or floor), offers and counter-offers, approvals with user and time, escrow status, standing mandates and their results, your portfolio, renewal dates, for-sale landing pages and Drop Agent criteria.
2.5 Data about domain owners and prospects we contact
To run a deal, the agent collects business contact data about the person who controls a domain (on a purchase) or about likely buyers (on a sale). This includes a name if published, an email address or a privacy proxy forwarding address, the domain or company it relates to, the public source where it was found, and the messages exchanged. The sources are limited to RDAP and WHOIS records, the domain's own website and for-sale page, public marketplace listings and, for sales, public information about companies that match the name. Section 4 explains this processing in detail.
2.6 Offers on for-sale landing pages
When someone makes an offer on a for-sale landing page created by a customer, we process their email address, the offered amount, a confirmation of their address and the message they send. We pass the offer to the customer who owns the domain.
2.7 Demo checks
Anyone can check one domain on the homepage without an account. We store the domain, the budget and intent entered, the result, a session identifier and a one way hash of the IP address, which we use to keep the free check to one per person. If you create an account, the report is linked to it.
2.8 Logs and security data
Server logs with IP address, browser type, the pages and actions requested, timestamps and error reports. We use them to keep the service secure, stop abuse and fix problems.
2.9 Support messages
What you write to support@domainagent.ai or through help inside the app, and our replies.
3. Purposes and legal bases
We process personal data only for these purposes and on these legal bases under the GDPR.
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and running your account and workspace | Account, workspace, mailbox and deal data | Performance of a contract (Art. 6(1)(b)) |
| Running the agents you start, including outreach and negotiation | Deal data, mailbox data, data about owners and prospects | Performance of a contract with the customer, and legitimate interest in a relevant business proposal (Art. 6(1)(f)) |
| Billing, invoices and tax records | Billing data | Legal obligation (Art. 6(1)(c)) and contract |
| Keeping the free demo to one check per person | Demo data, IP hash | Legitimate interest in preventing abuse |
| Security, fraud prevention and abuse control | Logs, account data | Legitimate interest |
| Global suppression list and deletion requests | Hash of the address, domain | Legal obligation to honor opt-outs and legitimate interest |
| Answering support messages | Support messages | Contract or legitimate interest |
| Transactional emails about your account | Account data | Performance of a contract |
We do not sell personal data, we do not use it for advertising and we do not make decisions with legal effects about anyone based solely on automated processing. Binding offers and acceptances always need a person's approval click.
4. People the agent contacts on behalf of customers
This section is for domain owners and prospects who receive an email from DomainAgent. It gives the information required by Article 14 of the GDPR when data is not collected from you directly. The same information is summarized in the first email you receive.
- Who is writing: DomainAgent, acting for a customer who wants to buy your domain or who owns a domain that may fit your business.
- What data we hold: your business contact details, the domain or company concerned, the public source and the messages in the thread.
- Where it came from: public sources only, namely RDAP and WHOIS records (including privacy proxy forwarding addresses), the domain's own website or for-sale page, public marketplace listings and public company information.
- Why and on what basis: to make a specific business proposal about a domain, based on the legitimate interest of the customer and of DomainAgent in a relevant offer to the person who controls that domain. We keep the data to the minimum needed for that proposal.
- How long: while the deal is active and for up to 12 months after the last message, unless you object or ask for deletion sooner.
- Your choice: you can opt out with one click in any email, reply "stop", or write to support@domainagent.ai. You can also object to the processing and ask for deletion at any time, without giving a reason.
When you opt out, your address goes to a global suppression list shared by all DomainAgent accounts. The list keeps only a one way hash of the address and the domain name, which lets us block future emails without keeping a readable record of you. Read more on how the agent stays inside the rules.
5. Recipients
We share personal data only with service providers who need it to run DomainAgent, under written agreements that limit their use of the data to our instructions. We name them by category.
- A hosting provider in the EU that runs our servers, databases and backups.
- A payment processor that handles card payments, 3D Secure checks and subscription billing.
- A transactional email provider that sends account emails such as sign-in codes and receipts. Outreach is never sent through it, only through your connected mailbox.
- An AI model provider that drafts outreach text, replies and value summaries for paying accounts. It receives only the text needed for the draft.
- A licensed escrow partner, only when you start escrow on a deal. It receives the deal details needed to open the transaction and works under its own terms and privacy policy.
Messages sent by the agent also reach their recipients through your own mail provider, which processes them under your agreement with that provider. We may disclose data when the law requires it, to protect the rights and safety of users or the public, or as part of a sale or reorganization of the service, in which case this policy continues to apply.
6. International transfers
Our main hosting is in the EU. Some service providers, such as the payment processor or the AI model provider, may process data outside the European Economic Area, including in the United States. When that happens we rely on an adequacy decision where one exists, or on the standard contractual clauses approved by the European Commission together with additional safeguards where needed. You can ask for a copy of the relevant safeguards at support@domainagent.ai.
7. Retention
- Account, workspace, deal and mailbox data: while your account is active. After you close it, we delete it within 30 days, and encrypted backups roll over shortly after.
- Mailbox credentials: deleted immediately when you disconnect the mailbox or close the account.
- Data about owners and prospects: while the deal is active and for up to 12 months after the last message, or sooner on request.
- Suppression list: a hash of the address and the domain, kept for as long as the service runs, because its only purpose is to keep an opt-out in force.
- Billing records and invoices: for as long as tax and accounting law requires.
- Demo checks: 30 days, unless linked to an account.
- Logs: up to 90 days, longer only when needed to investigate a specific security incident.
- Support messages: up to 24 months after the conversation ends.
8. Security
We protect personal data with encryption in transit and at rest, application level encryption of mailbox credentials and tokens, least privilege access, approval gates on binding actions and an audit log of agent actions. No method is perfect, and we will tell affected people and authorities about a personal data breach as the law requires. Details are on the security page.
9. Your rights
9.1 Rights under the GDPR
If you are in the EU, the EEA or the UK, you have the right to access your data, to correct it, to have it deleted, to restrict processing, to data portability, and to object to processing based on legitimate interest, including at any time to processing for a business proposal. Where we rely on consent, you can withdraw it at any time. You also have the right to lodge a complaint with your local data protection authority.
9.2 Rights under US state privacy laws
If you live in California or another US state with a consumer privacy law, you have the right to know what personal information we collect, use and disclose, to access it, to correct it, to delete it and to not be discriminated against for using these rights. We do not sell personal information and we do not share it for cross context behavioral advertising, so there is nothing to opt out of in that sense. You may use an authorized agent, and we may verify your identity before acting on a request.
9.3 How to use your rights
Write to support@domainagent.ai from the address the request concerns, or tell us the domain and address if you were contacted by the agent. We answer within one month, or sooner where the law sets a shorter period. Customers can also export and delete much of their data directly in the app.
11. Children
DomainAgent is a business service. It is not meant for anyone under 18, and we do not knowingly collect data from children. If you think a child has given us data, write to us and we will delete it.
12. Changes to this policy
We may update this policy when the service or the law changes. The date at the top shows the latest version. If a change matters for how we use your data, we tell customers by email or in the app before it takes effect.
13. Contact
Questions, requests and complaints about privacy go to support@domainagent.ai. More ways to get help are on the contact page.
Questions about this page? Write to support@domainagent.ai.