Privacy Policy

The controller responsible for personal data processed through axath pursuant to Article 4(7) GDPR is:

Further details are available in our Imprint. Please direct all data protection inquiries or requests regarding your personal rights to the contact address above.

We process information to provide domain research, name generation, saved workspaces, domain monitoring, user accounts, and subscription management. Search prompts and queried domain names may contain personal information; please avoid entering unnecessary personal data or confidential information into search tools.

• Article 6(1)(b) GDPR: Performance of a contract or taking pre-contractual steps (e.g., providing search tools, account authentication, workspace synchronization, and processing payments).
• Article 6(1)(f) GDPR: Legitimate interests in securing platform infrastructure, preventing abuse and automated scraping, troubleshooting technical errors, and conducting proportionate aggregate service analysis.
• Article 6(1)(c) GDPR: Compliance with statutory obligations, including commercial tax and record-keeping duties.
• Article 6(1)(a) GDPR: Explicit consent, where requested (e.g., for optional browser analytics, client-side lookup caching, or domain-interest features). You may withdraw consent at any time for the future.

Storing or accessing information on your device is separately subject to § 25 TDDDG. The exception in § 25(2)(2) TDDDG applies only where strictly necessary to provide a digital service expressly requested by you; otherwise prior explicit consent under § 25(1) TDDDG is required.

Providing data is voluntary. However, features requiring user identification (such as saved project workspaces or Pro subscription access) cannot be provided without the necessary credentials. Basic availability searches do not require account registration.

Our primary application infrastructure, databases, and authentication services are hosted in data centers located within the European Union (EU / EEA).

When you access our platform, our server infrastructure processes technical connection details, including your IP address, timestamp, requested URL path, HTTP status code, browser type, and referrer header. This log data is processed to deliver website content (Art. 6(1)(b) GDPR) and to maintain platform security and defend against cyber attacks (Art. 6(1)(f) GDPR). Server access logs are retained for a maximum of 14 days and automatically purged.

Application error logging is configured to categorize technical stack traces without recording raw search prompts or project workspace contents.

• Authentication & Session (Essential): Secure cookies and session state tokens maintain your signed-in state and protect against cross-site request forgery (CSRF).
• Preferences & Local Workspaces (Essential): Local browser storage retains user interface settings (e.g., theme, preferred TLD filters, currency) and temporary guest shortlists.
• Rate-Limiting & Quotas (Essential): Short-lived pseudonymous tokens manage usage limits and protect API endpoints against automated abuse.
• Consent Management (Essential): A cookie remembers your choices, time, notice version and a random receipt identifier for 30 days. Acceptance and rejection have the same lifetime. Separate server-side consent records contain the choices, receipt identifier, receipt time and exact notice shown, without account identifiers, raw IP addresses or research content. Receipts have a 180-day retention policy; associated notices remain while needed to interpret those receipts. This evidence supports our consent-accountability obligations under Articles 6(1)(c) and 7 GDPR.
• Optional Lookup Caching (Functional): With your explicit consent, persistent browser storage (IndexedDB) caches recent availability results between visits to accelerate repeat searches and reduce network overhead.
• Optional Community Storage (Functional): Local preference storage retains interface states for community interaction features with your consent.

Essential device storage relies on § 25(2)(2) TDDDG. Non-essential storage relies on § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can manage or clear site data through your browser settings at any time. Use "Cookie settings" in the footer to review or change your choices.

If a withdrawal cannot reach our server, we save a local rejection where browser settings permit, so optional processing remains disabled after reloading. The optional visitor cookie is removed when a rejection successfully reaches the server, or through your browser’s site-data controls. If local storage of the rejection is blocked, the dialog explains how to clear site cookies. Necessary login and saved research are not removed by cookie withdrawal.

We process your account ID, email address, registration timestamps, subscription tier, and usage counters. Single Sign-On via third-party identity providers (Google or GitHub) receives technical connection information and shares your basic profile details (email address, display name, and avatar URL) with us.

We support passwordless email login using One-Time Password (OTP) codes. Operational emails (login codes, account notifications, and invoices) are delivered using specialized transactional email processors. If you explicitly enable Domain Hub email notifications, a combined digest may include the monitored domain names and relevant public registry facts needed to provide that alert. You can disable these messages at any time in Settings.

Newsletter: If you subscribe to the monthly domain market email (in the footer, on the newsletter page or with the box when signing in), we store your email address, where you subscribed, the version of the consent text and the times of your request, confirmation and any unsubscription (Art. 6(1)(a) GDPR). Nothing is sent until you confirm through the link in our confirmation email (double opt-in). Every email contains an unsubscribe link, which withdraws your consent for the future. The emails are sent through Resend.

Provider privacy details: Supabase, Resend, Google, and GitHub.

To verify domain availability, searches query public Domain Name System (DNS) protocols, Registration Data Access Protocol (RDAP) endpoints, or WHOIS interfaces.

When lookups are executed server-side, external registries see our application server's IP address rather than your personal IP address. Client-side browser lookups transmit the queried domain and your technical request details directly to DNS or registry providers.

Lookup results are cached temporarily for up to 24 hours to optimize performance and prevent rate-limiting from global domain registries. Legal basis: Art. 6(1)(b) for delivering requested searches and Art. 6(1)(f) for platform performance and reliability.

Confirmed public marketplace listings may be retained for up to 90 days to reuse asking-price information and track changes. These records contain public domain and listing facts, not account identities or a history of individual searches. Older asking prices are marked as previously observed and may change before purchase.

See Cloudflare DNS Privacy and Google Public DNS Privacy.

When signed in, your domain-check history, Idea history, saved domain shortlists, project titles, notes, and custom domain collections are linked securely to your account (Art. 6(1)(b) GDPR). Saved content is protected by account access controls and encryption at rest, but is not end-to-end encrypted.

Project content is excluded from product analytics and domain-interest tracking. If you generate a public share link, anyone with that URL can view the included project names, descriptions, and domain lists. You can revoke share links at any time in your workspace settings.

Algorithmic and dictionary generation features process inputs locally on our server infrastructure. AI-assisted name generation routes search prompts and parameter settings through specialized domain suggestion services operated by VeriSign, Inc. (USA).

Prompts sent to Verisign are transmitted securely without attaching account credentials or email identities. Data transfers to the United States rely on Verisign's active certification under the EU–U.S. Data Privacy Framework (DPF), supported by robust technical and organizational data security practices conforming to SOC standards.

Brand research tools may query official public trademark databases (such as USPTO and TMview), historical web archives, public Certificate Transparency logs, and social media platforms to verify brand availability and prior use across channels (Art. 6(1)(b) GDPR). Where a provider supports secure browser access, selected requests may be sent directly from your browser, for example to GitHub, USPTO or crt.sh. That provider then receives the queried name or domain together with ordinary connection data such as your IP address. If a direct request fails, our server may retry it.

Adding a domain to Domain Hub stores your monitoring preferences and any private acquisition or ownership notes you add. Scheduled background checks periodically retrieve public registry facts to alert you to ownership or status changes. Optional email alerts are disabled by default. You choose the included domains, local delivery time, and a daily, weekly or monthly summary cadence; urgent alerts are evaluated separately. Signed links record only the first authenticated return to Domain Hub from an alert, without a tracking pixel or detailed click history.

If you connect a registrar account, we use the credential you provide to read its domain inventory and available expiry and auto-renew information. Credentials are encrypted and used for periodic synchronization until you disconnect. Disconnecting deletes the saved credential and imported inventory but retains domains already saved in your Hub. Manual imports do not require credentials. Registrar account information remains private to your account; transfer authorization codes and contact details are not retained for this feature.

We compile aggregate operational metrics regarding feature adoption, search preferences, broad domain characteristics, and subscription activity without logging raw user queries or named research profiles. Aggregate and pseudonymous records are separated from account content but are not irreversibly anonymous in every context under data-protection law.

Account usage counters manage fair-use plan limits. Optional client-side browser analytics collect anonymous UI interaction events (such as button clicks or pricing page views) only after you grant consent in Cookie settings (Art. 6(1)(a) GDPR and § 25(1) TDDDG).

With your explicit consent, we measure whether multiple distinct visitor sessions check the same domain within a rolling time window to display an aggregate popularity signal.

This system uses pseudonymous visitor identifiers stored separately from account identities, email addresses, and saved projects. Domain-interest processing is disabled until you explicitly accept it in Cookie settings (§ 25(1) TDDDG and Art. 6(1)(a) GDPR). Browser withdrawal disables future processing but is not a guarantee of background deletion at that exact moment; existing records remain subject to the stated eight-day retention period.

Paid subscriptions are managed through Stripe-hosted Checkout and PCI-DSS certified payment infrastructure operated by Stripe. Full payment card numbers and security codes are collected directly by Stripe and are never stored on our servers.

We receive payment status confirmations and store customer reference IDs, plan details, and transaction timestamps to administer subscription access (Art. 6(1)(b) GDPR) and satisfy legal tax retention duties (Art. 6(1)(c) GDPR). See Stripe Privacy Policy.

Withdrawals: If you withdraw through the online withdrawal function, we store your name, the contract you name, your email address, your account if you are signed in, and the date and time of receipt, and we email you a confirmation of receipt through Resend. We need this to process the withdrawal and to prove its receipt (Art. 6(1)(c) GDPR with § 356a BGB, and Art. 6(1)(b) GDPR). We keep it as long as claims from the contract can be raised and statutory retention duties apply.

Support requests, feedback submissions, and community votes are processed to resolve user inquiries and maintain platform features (Art. 6(1)(b) and Art. 6(1)(f) GDPR).

Clicking an external registrar, aftermarket marketplace, or web archive link redirects your browser to that provider. The destination site receives standard HTTP request headers (including your IP address and referrer parameters). Third-party privacy terms apply upon leaving our platform.

Personal data is retained only for as long as necessary to deliver requested features or comply with statutory retention laws:

• Account & Saved Workspaces: Retained until deleted by the user or upon complete account deletion.
• Newsletter: An unconfirmed request is deleted after 30 days. After you unsubscribe, the record is kept as proof of your earlier consent and so you are not emailed again (Art. 6(1)(c) and (f) GDPR); ask us and we delete it.
• Abandoned Email Sign-ups: An email-only account that is neither confirmed nor successfully signed in is automatically deleted after a 48-hour grace period.
• Server Access Logs: Retained for a maximum of 14 days and automatically purged.
• Pseudonymous Interest Records: Automatically deleted on an 8-day rolling cycle.
• Financial & Tax Records: Retained for up to 10 years in compliance with statutory German commercial and tax code duties (§ 147 AO, § 257 HGB).

Account deletion purges account records and saved workspaces from active production databases. Encrypted system backups are automatically overwritten on a rolling 30-day schedule.

Data processors and service partners include cloud hosting providers, database infrastructure, transactional email services, payment gateways, and domain registries.

Where personal data is processed outside the European Economic Area (EEA), we enforce Chapter V GDPR transfer safeguards, including standard contractual clauses (SCCs) and active certifications under the EU–U.S. Data Privacy Framework (DPF) (such as for Google, GitHub, Stripe, and Verisign).

Under the GDPR, you possess statutory rights regarding access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20).

Right to Object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data based on Art. 6(1)(f) GDPR (legitimate interests).

We use technical and organizational security controls to safeguard your information, including HTTPS transport encryption (TLS 1.3), database row-level security and server credential isolation.

Our service is intended for adult business and consumer audiences and is not directed at children. We update this Privacy Policy when technology or legal obligations change.

Legal references: GDPR, § 25 TDDDG, and § 147 AO.