Privacy notice

Who is responsible

CLOOP UNIVERSE TECH LTD (RC 9771867), trading as MyDomainsHub, is the data controller. For anything about your data, email hello@mydomainshub.com.

What we collect

Your account: email address, name and, if you add them, phone number and business details. Your password is handled by our sign-in provider and never stored in readable form. If you turn on two-factor authentication, its secret is stored the same way.
If you sign in with Google: Google tells us your name, email address and profile picture. We keep the name and email address, as for any account.
Domain contact details: name, company, email, phone and postal address for each domain’s owner (the registrant), and for its administrative, technical and billing contacts where you name someone else. We keep the registrant you use, and any contacts you save, so you do not have to type them again.
Your domains and orders: the domains you buy, their settings (such as nameservers), and your orders and payments — amount, method and Flutterwave’s reference. We never receive your card details; Flutterwave handles them.
SSL certificates: the names each certificate is for, the certificate request (CSR) you send, the address you chose to approve it, the contact you give for it, and the issued certificate. If you ask us to make the private key and CSR for you, our supplier makes the key and we pass it to your browser once — we do not store or log it.
Your cart: the domains and certificates in it, found through a random code in a cookie if you are not signed in.
Where you are signed in: for each device signed in to your account, the browser it reports, its IP address, and when it signed in and last renewed its sign-in. Our sign-in provider keeps these until that session ends; you can see them, and sign a device out, in Settings.
The devices you sign in from: the browser and system each one reports, such as “Chrome on macOS” — no address — so we can email you when a new one signs in.
The emails we send you: what each was about, when it was sent and whether it was delivered.
Technical data: our hosting providers keep standard request logs, which include IP addresses and the addresses of pages you visit, for a short time. To stop one connection from overloading search, we count the searches it runs, the names it checks in bulk search and the names it adds to a cart in one go, against a one-way hash of the IP address — never the address itself.

We do not keep a record of the domains you search for, and we do not use analytics or advertising trackers. A CSV file you upload to bulk search is read on your device: only the names in it are sent to us, to be checked, and the file itself never is.

Why we use it, and on what legal basis

To run your account and register your domains — necessary to perform our contract with you.
To send a domain’s contact details to the registrar and registry — the registrant and the administrative, technical and billing contacts — which the registration itself requires — necessary to perform the contract, and required by the registry’s and ICANN’s rules.
To order and manage your SSL certificates — sending the certificate request, names, approval address and contact to our supplier and the certificate authority — necessary to perform the contract, and required by the certificate authority’s rules.
To take payments and keep tax and accounting records — contract and legal obligation.
To keep the service secure and handle abuse and fraud — our legitimate interest in protecting you, us and others. That includes the security emails we send when a new device signs in or a sensitive setting changes.
To email you receipts, news of your domains and renewal reminders — necessary to perform our contract; the renewal reminders are also required by ICANN’s Expired Registration Recovery Policy.

We do not sell your data or use it for advertising.

Our registration supplier DomainNameAPI and its ICANN-accredited registrar, Atak Domain Bilgi Teknolojileri A.Ş. (Türkiye) — registrant details, to register and manage your domain.
The registry for your extension — for example Verisign (United States) for .com. Registries receive registrant details and may publish some of them.
For SSL certificates: DomainNameAPI and Sectigo, the certificate authority — the certificate request, the names, the approval address and the certificate contact. Sectigo emails the approval address, and publishes every certificate it issues, with the names in it, in public Certificate Transparency logs, as browsers require. A private key made for you passes through DomainNameAPI’s system and ours on its way to your browser.
Flutterwave — to process your payment. Its payment notifications reach us through a webhook service we operate for our businesses.
Supabase — our database and sign-in provider; your data is stored in London, United Kingdom.
Fly.io — runs our registration service, in London, United Kingdom.
Google — only if you choose to sign in with Google: it confirms who you are to us (United States).
Vercel — hosts this website (United States, with servers worldwide).
Amazon Web Services (Amazon SES) — sends our emails: your email address and each message (United Kingdom, London region).
Cloudflare Turnstile — tells people from bots when you sign up, ask for a sign-in link or a password reset, run a bulk search, or search many times in a few minutes. It sees your IP address and signals from your browser (United States).
Authorities and dispute providers, where the law, a court order or a domain dispute requires it.

Transfers outside Nigeria

Registering a domain is international by nature, so your data goes to Türkiye, the United Kingdom, the United States and the country of your extension’s registry. We transfer it because it is necessary to provide the registration you asked for, and rely on our providers’ data protection terms where they offer them.

The public registration record

Registries publish registration data in a public record (RDAP, formerly WHOIS), under ICANN’s Registration Data Policy (opens in a new tab). Where the extension allows it, contact privacy keeps your personal details out of that record, at no charge.

How long we keep it

Account details: while your account is open.
A domain’s contact details: for as long as the domain is registered, and afterwards for as long as registry and ICANN rules require. Saved contacts: until you delete them or close your account.
Orders and payments: for as long as tax and accounting law requires.
SSL certificates, with their request, approval address and contact: while your account is open. A private key made for you: not at all.
The cart cookie: 60 days.
Records of the emails we send: 90 days. Renewal reminders: three years, because we must be able to show they were sent. The devices you sign in from: while your account is open.

Cookies

We only use cookies the site needs to work — none for analytics or advertising.

Sign-in cookies (starting sb-): keep you signed in until you sign out.
dr_cart: finds your cart when you are not signed in. Lasts 60 days.
dr_cart_count: the number shown on the cart icon. Lasts 60 days.
dr_search_pass: set when you pass Cloudflare’s check while searching, so you can keep searching and run bulk searches without being asked again. It works only from the connection that passed. Lasts 2 hours.

Your light or dark theme choice is kept in your browser’s own storage, not a cookie.

How we protect it

Everything travels over encrypted connections. Access to our systems is restricted, and you can protect your account with two-factor authentication — changing nameservers and other sensitive settings requires it.

Your rights

Under the Nigeria Data Protection Act 2023 you can ask us to:

give you a copy of your personal data;
correct it if it is wrong;
delete it — except what we must keep, such as the details of a domain that is still registered, or tax records;
restrict or object to how we use it;
give it to you in a form you can take elsewhere.

Email hello@mydomainshub.com to make a request; we may ask you to confirm who you are. If you are unhappy with how we handle your data, you can complain to the Nigeria Data Protection Commission (opens in a new tab).

Age

MyDomainsHub is for people aged 18 and over.

Changes to this notice

We will update this notice when what we do with your data changes; the date at the top shows the current version. See also the registration agreement.