Privacy notice

Controller

The controller is Tim Johnson, trading as StableDomains. Contact: support@stabledomains.net.

What we collect and why

• Account and contact: email address (for receipts, sign-in links, expiry reminders and order recovery), passkey public keys, and wallet addresses you sign in with. Legal basis: performing our contract with you.
• Orders and payments: domains, prices, the paying wallet address, transaction hashes and networks. Blockchains are public, so payment transactions are visible to anyone. Legal basis: contract, and legal obligations such as keeping accounting records.
• Registrant data: the name, address, phone and email you give for a registration. We send it to our upstream registrar NiceNIC International Group Co., Limited, and to the relevant registry, as ICANN rules require. Legal basis: contract and legal obligation.
• API and integrations: API keys (stored as hashes), OAuth clients you approve, and webhook URLs you register. We send event payloads to the webhook URLs you register.
• Logs and traffic: we record page path, method, referrer, country, UTM tags and a user-agent category (for example browser, search bot or AI agent) for each visit. We do not store IP addresses in these traffic logs. Our host keeps standard server logs, and rate limiting briefly uses IP addresses. We use Vercel Web Analytics and Speed Insights, which measure aggregated, cookie-free usage. Legal basis: legitimate interests in running, securing and improving the Service.

WHOIS privacy

Where the registry allows it, every registration gets free WHOIS privacy. Public WHOIS/RDAP then shows a privacy service rather than your details. The registrar and registry still hold your real details, and may disclose them where the law or ICANN policy requires, for example to law enforcement or in a UDRP case.

Who we share data with

We share data only with the providers needed to run the Service: NiceNIC and domain registries (registration), Supabase (database), Vercel (hosting and analytics), Resend (email), and blockchain RPC providers (payment detection). If you pay by card through Coinbase Onramp, Coinbase processes that payment under its own privacy policy. Some of these providers process data outside the UK under appropriate safeguards, such as the UK International Data Transfer Addendum or adequacy regulations. We do not sell personal data.

How long we keep it

• Account data: while your account is active, and deleted on request unless we need it for an active domain or a legal obligation.
• Order and payment records: 6 years, for accounting and tax.
• Registrant data: for the life of the registration, plus the period the registrar must keep it under ICANN rules.
• Traffic events: up to 13 months. Sign-in links and passkey challenges expire within minutes.

Cookies and local storage

We use only strictly necessary cookies: an HttpOnly session cookie for signed-in users, a short-lived passkey challenge cookie, and an admin session cookie for site operators. If you arrive with a referral link, the referral code is kept in your browser's local storage for up to 30 days. We use no advertising or cross-site tracking cookies, so there is no consent banner.

Your rights

Under UK GDPR you have the right to access, correct or delete your data, to restrict or object to processing, and to data portability. Email support@stabledomains.net, and we will reply within one month. Some data cannot be deleted while a domain is registered, because the registrar and registry need it. You also have the right to complain to the Information Commissioner's Office at ico.org.uk. Please contact us first so we can try to help.

Children

The Service is not for anyone under 18.

Changes

We will post any changes here and update the date at the top. See also our Terms.