Privacy Policy

01Who we are

domcheck.app (“domcheck,” “we,” “us”) is operated by Importify Limited, a private company incorporated in Hong Kong with its registered office at Unit 1603, 16th Floor, The L. Plaza, 367–375 Queen’s Road Central, Sheung Wan, Hong Kong SAR.

This Privacy Policy explains what personal information we collect when you use the domcheck website, the /app/ dashboard, and our APIs (together, the Service), and how we use, share, and protect that information. It applies whether you visit as a guest or sign in with a Google account.

For the purposes of the EU/UK GDPR and the California CCPA, Importify Limited is the data controller (or business) for personal information processed through the Service.

02What we collect

Account information (when you sign in)

You sign in to the Service exclusively through Google OAuth. When you do, Google passes us a limited set of profile fields: your email address, display name, and Google account ID. We do not receive your Google password, your Gmail contents, or any other Google data. Refer to Google’s consent screen for the exact scopes requested.

Service data you generate

While using the Service, the following data is stored under your account in our Supabase database, protected by row-level security so only you can read it:

• The briefs (free-text product descriptions) you submit for domain generation;
• Your search history — the AI-generated candidate lists, scores, and availability results;
• Pinned domains, saved profiles (filter presets), and your Settings preferences;
• Plan state — current plan, expiry, remaining free-tier searches, daily counters.

Payment information

Paid plans are processed by PayPro Global as merchant of record. PayPro collects your payment details (card or alternative method, billing name, country) on its own checkout pages — we never see your card number. After a successful payment, PayPro sends us a webhook containing your order ID, plan, amount, currency, and your user_id; we store these to grant your plan and for tax records.

Technical information (automatic)

Our servers automatically record certain technical data when you interact with the Service:

• IP address, browser user-agent, request timestamps, and request URLs (server access logs);
• API error reports written by the dashboard when a search fails (URL, status, timestamp, your user ID — never the brief text);
• Rate-limit counters keyed by IP and account, used to enforce abuse thresholds.

What we do not collect

We do not collect biometric data, precise location data, government identifiers, or special-category personal data. We do not run third-party analytics, advertising pixels, or session-replay scripts on the Service.

03How we use information

We use personal information only for the following purposes:

• To deliver the Service — generate domain candidates via OpenAI, verify availability via DNS/RDAP/Namecheap, and store your results so you can return to them across devices;
• To enforce plan limits — daily and lifetime search caps, plan expiry, and the free-tier 10-search lifetime allowance;
• To process payments — reconcile PayPro webhooks against your account and apply the plan you purchased;
• To prevent abuse — rate limiting, fraud detection on payments, and investigation of suspected violations of our Terms of Service;
• To communicate with you — transactional messages such as payment confirmations and material changes to this policy or the Terms. We do not send marketing email by default;
• To meet legal obligations — tax records, accounting, and responding to lawful requests.

We do not use your briefs or search history to train AI models, sell your data to third parties, or build advertising profiles about you.

04Legal bases (GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR:

• Performance of a contract — to provide the Service you signed up for (account, search history, plan delivery);
• Legitimate interests — to keep the Service secure, prevent abuse, and improve reliability (technical logs, rate limits);
• Legal obligation — to keep payment and tax records as required by Hong Kong and applicable foreign law;
• Consent — where consent is the appropriate basis (you may withdraw at any time without affecting prior processing).

05Third parties we share with

We share the minimum data necessary with the following processors, each of which is contractually bound to handle it on our behalf:

We may also disclose personal information when required by law, to enforce our Terms, to protect the rights, property, or safety of us or others, or in connection with a merger, acquisition, or sale of assets (subject to equivalent privacy protections).

06Cookies & local storage

The Service uses the following client-side storage. All of it is strictly necessary — we do not use cookies for advertising or cross-site tracking.

You can clear this data at any time by signing out, by using your browser’s Clear Site Data control, or by clicking the “Clear all” control in the dashboard’s Danger Zone.

07International data transfers

Importify Limited is based in Hong Kong. Our processors operate primarily in the United States and the European Union. If you are in the EEA, the UK, or Switzerland, this means your personal data is transferred outside your jurisdiction. We rely on the European Commission’s Standard Contractual Clauses (or the UK equivalent) with our processors, and we keep transfers to the minimum necessary to operate the Service.

08Data retention

We retain personal data only as long as we need it:

• Account and service data — for as long as your account is active. You can delete it at any time from the dashboard’s Danger Zone, after which it is removed within 30 days.
• Search history — until you delete it from the dashboard (per-row or in bulk).
• Server access and error logs — 90 days, then deleted.
• Payment and tax records — 7 years from the end of the relevant accounting period, as required by Hong Kong law.
• Backups — encrypted database backups are rotated on a 30-day cycle; deleted data persists in backups for up to 30 days after deletion.

09Your rights

Subject to your local law, you have the right to:

• Access the personal data we hold about you;
• Correct data that is inaccurate or incomplete;
• Delete your account and the associated data;
• Port your data — receive a structured export of your briefs, history, and pins;
• Restrict or object to certain processing (for example, processing based on legitimate interests);
• Withdraw consent where we rely on it — this does not affect prior lawful processing.

If you are in California, you additionally have the right under the CCPA to know what we collect and disclose, to delete, and to opt out of any sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CCPA.

To exercise any of these rights, contact us at domcheck.app@gmail.com. We respond within 30 days. If you believe we have not handled your request properly, you may complain to your local data-protection authority — in Hong Kong, the Office of the Privacy Commissioner for Personal Data (PCPD).

10Security

We protect personal data with technical and organisational measures appropriate to the risk:

• All traffic between your browser and our servers is encrypted with HTTPS (TLS 1.2+);
• Authentication uses short-lived JWTs issued by Supabase and verified server-side on every protected endpoint;
• Database access is governed by Supabase row-level security — a user can only read or write their own rows;
• API keys and webhook secrets are stored outside the web root in a mode-600 environment file;
• Backups are encrypted at rest;
• Production access is limited to the smallest set of people necessary to operate the Service.

No system is perfectly secure. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

11Children

The Service is not directed to children. You must be at least 18 years old (or the age of majority in your jurisdiction, whichever is higher) to use the Service. We do not knowingly collect personal data from children. If we learn that we have, we will delete it.

12Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where required by law, notify you in-app or by email before the change takes effect. Your continued use of the Service after an update means you accept the revised policy.

13How to contact us

For privacy questions, data-access or deletion requests, or any other matter described in this policy, write to: