Privacy Policy

1. Who is responsible

Nikolay Kolev operates this website and is the controller of the personal data described here. Questions, requests, and complaints go to privacy@namegarage.com, and are answered by a person.

2. What you give us, and why

Every field in the six subsections that follow is one you typed yourself, with exceptions named where they occur: what comes back from the phone lookup, and the payment references and status records Stripe returns. The four subsections after them describe what else this site records that you did not type, and what we send you: where a request came from, whether an email we sent you was opened, the offers we may email you and the stop that ends them, and what a text message to you led to.

Making an offer

The offer form collects your first name, your email address, the domain and amount you are offering, and — if you choose to fill them in — your last name, phone number, a message, and a proposed payment plan. We need this to read your offer, reply to it, and negotiate. If you give a phone number, we send it to Telnyx once to check that it is a working number and whether it can receive text messages, and we keep what comes back — the country, for US numbers the city and state, the line type, and the carrier — with your offer. If you also tick the "Text me about this offer at this number" box, we may text that number about your offer: the seller can send you a short message, and a day after we send a reply that bounced or shows no sign of having been opened, we send one automatic text asking you to check your email. Leave the box unticked and the number is never texted; it is only shown to the seller. Texts we send, replies you send, and whether each text was delivered are kept with the offer. Reply STOP to any text and no further texts are sent to that number. Choosing to send the offer through Telegram instead hands the same details to Telegram's own service.

Buying directly by wire or Gram

The direct-purchase form collects your first name, email address, and — because the domain has to be pushed somewhere — your GoDaddy account email and GoDaddy customer number. Your last name is optional. These go onto the purchase agreement you sign, and the GoDaddy details are used to transfer the name to you. We do not ask for, receive, or store card numbers, bank credentials, or government identification.

Buying through Escrow.com

These routes collect your email address here and then hand you to Escrow.com, which runs its own identity and payment process under its own privacy policy. Payment details are entered on Escrow.com, not on this site, and we never see them.

Monthly card payments through Stripe

We collect your email address, the domain(s), the price and installment schedule, and your payment authorization, including its version and time. We send your email and the information needed to identify and price the plan to Stripe, which hosts the card checkout and collects the payment details under its privacy policy. Card numbers and security codes are entered on Stripe's page and are not received or stored by this website. The monthly card-plan ledger does not store the IP address or derived location described below; Cloudflare still processes the request for hosting and security.

We keep Stripe customer, checkout, payment, subscription and invoice identifiers, installment amounts and payment times, and payment, refund and dispute status. We use these records to collect the agreed installments, recover interrupted checkouts, prevent duplicate charges, answer payment questions and decide when the seller can fulfill the sale. Payment-status notifications reach the seller's email inbox and private Telegram chat; these notifications identify the domain and plan, not your card details. The seller reviews fulfillment and final ownership transfer. Stripe may separately provide transaction and payment-method information in its dashboard to the seller.

Referring a buyer

The referral form collects your name and email address, the domain(s) you are referring, and — about the person you are recommending — their email address and whatever else you choose to add: their name, company, and a short message about how you know them. We use this to attribute a referral commission if that person completes a purchase of one of the domains you named, within the program's window, and so we can reach out to them about those domains — that follow-up is the point of a referral introduction. Registering a lead does not add them to any marketing list, and submitting the form does not itself send them anything; the message it sends is to us, so we can decide whether and how to follow up. We never use a lead's details for anything unrelated to the domain(s) you named. By submitting the form you confirm that they are happy for us to contact them about those domains. See Refer a buyer for the full program terms.

Contact inquiries

The contact form collects your name, email address, message, and any catalog domains you choose. We send these to the seller's email inbox and private Telegram chat so we can answer you. A general inquiry needs no domain selection. We do not attach the offer form's IP/location record to contact inquiries. It creates no offer, referral registration, marketing subscription, or automated email to you. Optional analytics and advertising scripts do not run on this form.

What we record about the request

When you submit an offer, an Escrow.com purchase, or a referral form, or open an Escrow.com checkout, we store — alongside what you typed — the IP address the request came from and the country, region, city, and network operator that Cloudflare, which serves this site, derives from it. We use this for online fraud prevention: to assess whether a submission is genuine before acting on it. It is shown to the seller next to the submission, it is never used to decide automatically — a person reads it, and every offer is answered by a person. It is never used for advertising. It reaches only the seller — by email and, for offers, through the seller's private Telegram chat (see Telegram in Section 3) — and no one else in Section 3 besides Cloudflare, which produced it. Offers sent through Telegram carry no such record; Telegram does not pass an address to us.

Email engagement

Email we send you about your offer or purchase — a counter, a message from the seller, a payment prompt, a thank-you code — contains a tracking image and tracked links. When your mail client loads the image, or you follow a link, we record the time, the IP address, and the same derived location as above. We use this for online fraud prevention and to know whether a counter or a payment prompt actually reached you, so a stalled negotiation can be followed up rather than assumed dead. Every such email says so in its footer. The offers we start, described below, are sent the same way and carry the same image, the same tracked links, and the same footer line. Reading the plain-text version, or blocking remote images, prevents the open from being recorded while the email still works; the links still work either way, and following one is recorded. Many mail providers load images through their own servers, in which case the location recorded is theirs, not yours, and we mark it as such.

Offers we start

If you have made an offer on a domain, started a purchase, bought one, or asked us about one, we may email you a discount code good for that domain or any other on this site — a domain being a similar product to the one you asked about. We do this rarely, and each such email carries our postal address and a link that stops these emails: it opens a page with one button, and pressing that button records your address in a suppression list we never delete from, so you are never sent one of these offers again. Your mail client's own Unsubscribe button does the same thing without the page, because we send the List-Unsubscribe headers it reads. It does not stop replies to an offer you make later: those continue the negotiation you start. A message you send through the contact form never leads to one of these offers: it is answered, and nothing more.

The legal basis is Article 6(1)(f), our interest in offering similar products to people who came to us for one, which the opt-out at collection and in every message keeps proportionate; where you are in the United States, CAN-SPAM's requirements are met by the address and the opt-out.

Text messages

We text only a number whose owner ticked the "Text me about this offer" box on the offer form; the box is unticked unless you tick it, and giving a phone number is not, by itself, agreeing to texts. Message frequency may vary: at most one automatic text per offer, plus any the seller writes to you while you negotiate, each about that offer and nothing else. A text from us never contains a link — it tells you a reply is waiting in your email, or carries the seller's own words, and nothing else. The automatic text is sent at most once per offer, a day after we send the newest reply we emailed you — a counter, or a message from the seller — and only if that reply bounced or shows no sign of having been opened (an email client that fetches images on your behalf counts as a sign), and not at all if the seller has already texted you or you have already texted us. A number the check reports as a landline, a toll-free number, or a line of unknown type is never texted; it is simply shown to the seller as such. Each text you send us, including STOP or START, and each delivery receipt Telnyx returns, is kept with the offer. STOP is honored twice over: Telnyx blocks the number at once, and we record it and send nothing further. Reply HELP for help, or write to the address in Section 1. Message and data rates may apply. The full terms of the text-message program, including how to opt in and what we send, are at SMS Terms.

No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Your phone number, and the consent you gave to be texted at it, are never sold, rented, or passed to anyone for their own use. The seller reads the number along with the rest of your offer, which reaches them through Telegram as Section 3 describes — that happens whether or not you ask to be texted, because it is how an offer is read at all. For the messages themselves the only parties that handle it are Telnyx, the subcontractor that verifies the number and carries what we send, and the mobile carrier that delivers it; neither may use it for anything but delivering our messages to you.

Legal basis

For the offer, purchase and referral form subsections, the legal basis under the GDPR is the performance of, or steps taken at your request before entering into, a contract — for the sale of a domain name, or, for a referral, the referral commission arrangement described at Refer a buyer (Article 6(1)(b)); a text about your offer is a step in that same negotiation and rests on the same basis. Answering a purchase inquiry also falls under Article 6(1)(b); for other contact messages we rely on our legitimate interest in answering correspondence (Article 6(1)(f)). For the request record, the email engagement record, and the phone lookup result, the basis is our legitimate interest in preventing online fraud and in conducting the negotiation you started (Article 6(1)(f)); you may object to any of them at any time by writing to the address in Section 1, and where your local law requires consent for email tracking, the footer of each email is where we tell you and how to avoid it. The offers we start rest on Article 6(1)(f) too, for the different interest named in that subsection above, and the stop link in every such email is the simplest way to object to them. Where your local law requires consent for text messages, the offer form says next to the phone field that the number may be texted, and STOP withdraws that consent at any time. For Google Analytics and advertising, described in Section 4, the basis is your consent (Article 6(1)(a)), which you may withdraw at any time. Cloudflare's cookieless page measurement, also described in Section 4, rests on our legitimate interest in knowing how many people visit which pages and how quickly they load (Article 6(1)(f)); a Global Privacy Control signal is how to object to it, and it stops the measurement on every page.

3. Who else sees it

The processors below receive only what their job requires:

• Escrow.com — the escrow facilitator for transactions using the Escrow.com route. Receives your email address and, once you are on their site, whatever their own process asks of you.
• Stripe — processes monthly card payments, stores the payment method used for future installments, and supplies the payment records described in Section 2. Receives your email, plan references and amounts, and the details you enter on its hosted checkout.
• DocuSeal — prepares and countersigns the purchase agreement for direct wire and Gram sales. Receives the name, email, and GoDaddy details that appear on that agreement.
• Cloudflare — serves every page, delivers our email, and runs the security checks in front of them. Processes your IP address and request metadata as part of delivering the site, and derives from the address the country, region, city, and network operator we store, as described in Section 2. It also receives the page measurements described in Section 4.
• Telnyx — verifies phone numbers and sends and receives our text messages. Receives the phone number you typed, the text of what we send and what you reply, and nothing else.
• GoDaddy — the account details needed to transfer a directly purchased domain to your registrar account.
• Public blockchain services — if you choose Gram, deposit addresses and payment transactions are visible on the public network; deleting our private records does not erase that public history.
• Google — analytics and advertising, described in the next section.
• Telegram — in two ways. The seller reads and answers offers, contact inquiries and installment-status notifications from a private Telegram chat, so the details you type into the offer or contact form, and the offer request record described in Section 2 are delivered to the seller through Telegram's service, under Telegram's own privacy policy. And if you choose the "Send in Telegram" button — a deliberate act on your part — your conversation with the seller runs there too.

We do not sell personal data, and we do not share it for cross-context behavioral advertising beyond the advertising cookies described below. No personal data is transferred to anyone not on this list.

4. Cookies and similar technologies

Optional Google Analytics loads on our homepage, catalog and domain pages and on our static informational pages (the policies and the blog). Optional Google AdSense loads only on the static informational pages. Each runs only after you choose its purpose, and the two are chosen separately. Neither loads on our referral, contact form, contact receipt, checkout, or recovery pages, and on every page a query string or fragment in the address, including a search, prevents loading. Once it loads, Google Analytics also records events on that page automatically: scrolling, clicks on links to other sites, starting and submitting a form, file downloads, and page changes made without a reload, so a catalog search or filter can be reported as a page address and a site search. A form event names the form and where it is sent, never what you typed into it. A domain page can show a purchase form, a signing button and a recovery link after it loads. The signing address opens from a button, not a link, and the recovery link is text for you to copy, so neither is reported. Analytics measures visits; advertising selects and measures ads. Both may use Google cookies. Declining either purpose leaves the rest of the site working.

Cloudflare Web Analytics measures the homepage, catalog, domain, blog, and policy pages for every visitor. It is a cookieless measurement script, separate from Google Analytics, and it is not one of the cookie choices: it sets no cookie and stores nothing in your browser. A Global Privacy Control signal stops it on every page. It records page loading and interaction timing, layout stability, page and referrer addresses, browser/device information and country, and diagnostic information about page elements and resources involved in those timings. Cloudflare processes the network request needed to receive those measurements; this is not a claim that no IP address is processed in transit. We do not send form fields, account details, messages, or purchase credentials to this measurement service.

We exclude contact and referral forms, receipts, checkout and recovery routes, previews, and staff test sessions. A browser that blocks this site's storage is excluded too, because the check for a staff test session cannot run there. A query string or fragment in the page address prevents loading, as does a referrer containing parameters or an unapproved path. Search terms are not added to measurements. The script does not measure single-page navigation, and it reads timings, not what you type or which links a page shows. Measurements cover eligible pages only, so they do not represent every purchase flow.

Cloudflare documents seven days of unsampled beacon data, followed by sampled aggregation, with reports accessible for the previous six months. These are provider retention and report-availability descriptions, not a promise that every provider copy is deleted on those dates. We keep no separate raw visitor-measurement database. See Cloudflare's measurement documentation.

Use Cookie settings in the footer to reopen the controls. Turning off a loaded purpose requires a reload to remove its scripts; the page warns before reloading if it contains entered form data. Finish or copy unsent entries first. Global Privacy Control overrides both purposes to off. An old combined acceptance requires a new choice; an old refusal remains a refusal.

The following data is kept in your browser:

• Your color-theme choice and a versioned analytics/advertising preference in host-local local storage, with no application expiry. Clear this site's data to remove them. We keep no server-side consent record.
• Buyer request and recovery state in tab-specific session storage, including request identifiers, whether a request was attempted, serialized form values used to recognize a retry (which can include names, email, phone and transfer account details), and purchase recovery credentials. This protects interrupted purchases and avoids creating a second transaction. The serialized values are not a cryptographic hash. Requests send the necessary values to our endpoint; this state is not sent to optional analytics or advertising vendors.
• An operator test token in local storage, copied into a tab's session storage when that tab loads one of our pages, only in a browser our staff use for rehearsals, kept until they end the session. It is sent with rehearsal requests to distinguish tests from real purchases, and while it is present, analytics from that browser is marked as test traffic and excluded from our reports.

Session storage can survive reloads and browser session restoration. We do not promise deletion immediately when a tab closes. Clear site data to remove it; doing so also removes local recovery information. When storage is blocked, request recovery and choices may be limited to the current page.

Google controls its cookies and product retention. Cookie expiry and server-side analytics retention are different; some cookie lifetimes may renew with use. The page address we send to analytics when a page loads excludes query strings and fragments, and its referrer is reduced to the origin. Page views recorded automatically after an in-page change, such as a catalog filter, can include the query string. What you type into a form, the signing address and the recovery link are not reported. Advertising consent-management configuration is a separate control; this custom banner is not a claim of Google CMP certification.

Cloudflare Turnstile checks that protected actions come from a person and runs independently of optional purposes. Its normal verification response is a one-use token, not a cookie. Cloudflare can separately use security cookies; Turnstile's optional pre-clearance cookie is a different feature.

5. How long we keep it

General contact inquiries are retained in our seller inbox and private Telegram chat for up to 24 months after the last correspondence, subject to the operator-reviewed disposal and hold process below. An inquiry that becomes an offer or sale follows that record's retention rule. Removing an inquiry requires reviewing both notification channels, not only our website database.

Offers and the correspondence around them are kept while the domain is still for sale and for 24 months after the last message between us, so that a returning buyer's history is intact and so a disputed negotiation can be reconstructed. Records of a completed sale — the agreement, the parties, the amount — are kept for seven years, under our records-retention policy. The applicable legal obligations and any specific hold are assessed separately. A referral lead is kept as part of our commercial records — the row is the ledger for whether, and how much, commission is owed on it, so it is not deleted once its window lapses; a sale that syncs late can still be matched against it. We use a lead's contact details to attribute the referral and to reach out to them about the domain(s) named, never for anything unrelated. The request record, the email engagement record, and, for an offer, the phone lookup result and the text messages described in Section 2 are kept with the offer, purchase, or lead they belong to, under that record's window above, and are included in its disposal review. The one record that outlives everything else is the opt-out itself: the suppression list holds only the address, the reason (link, one-click, reply, or manual), the campaign it came from and the date, and is retained indefinitely because it exists to honor the opt-out — deleting the row would put the address back in reach of the next campaign. The access, correction, and erasure rights in Section 6 apply to all of it, whether you are a buyer, a referrer, or the person referred; the one exception is erasure of that suppression row, which we keep for the reason just given. You can still ask to see it, and to have a mistyped address in it corrected. Disposal is an operator-reviewed process, not an automatic timer. Before removing an eligible nonfinancial negotiation we verify that its domains are no longer for sale, the last correspondence date, the absence of financial or commission evidence and any applicable hold. Missing or conflicting evidence keeps the record on hold for review. Linked conversations, financial records and referral ledgers require separate review; we do not delete transaction or duplicate-prevention evidence merely because a request expires. Deletion from active records is distinct from deletion of mailbox, processor, export and backup copies. Those copies have separate disposal and backup expiry processes; restored records must be checked against prior erasure requests. Provider retention and any required longer hold are reviewed when we handle a request. Google retains analytics under its product configuration. Private service-operation accounting uses keyed identifiers, which may still be linkable, to prevent abuse and duplicate operations. Time-window accounting has bounded cleanup; stable duplicate-prevention records need a separate review before disposal. Optional observation collection is off until a finite, capacity-limited campaign is configured.

Monthly card-plan authorizations and financial records are retained while the plan is being collected or reviewed, and completed-sale records follow the seven-year policy above. An expired checkout does not erase its payment or duplicate-prevention evidence. Refund, dispute, processor and backup copies remain subject to the separate review and hold process described above.

6. Your rights

Wherever you live, you may ask us to show you the personal data we hold about you, correct it, delete it (with one exception: the row that records your telling us to stop emailing you offers, which Section 5 explains), or send it to you in a portable form. You may object to processing based on legitimate interests — including the request record, the email engagement record, the phone lookup result, the offers we start, and Cloudflare's page measurement, which a Global Privacy Control signal stops — and you may withdraw consent to analytics and advertising without giving a reason and without affecting anything you have already done on the site.

Write to privacy@namegarage.com. We answer within 30 days. There is no charge, and no account to close first.

If you are in the EU or the UK you also have the right to complain to your national data protection authority. If you are in California, Colorado, or another US state with a comparable law, the same rights apply to you under that law, including the right not to be discriminated against for exercising them.

7. International transfers

The processors named in Section 3 are established in the United States and process data there. Transfers rely on the European Commission's Standard Contractual Clauses or, where the processor is certified, the EU–US Data Privacy Framework.

8. Children

This is a marketplace for domain names sold to businesses and adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us something, write to the address above and it will be deleted.

9. Security

Every page and every form is served over HTTPS with HSTS. Offer, purchase, referral, and contact submissions are protected by anti-automation challenges. Access to stored offers, referral leads, contact inquiries, request records, email engagement records, phone lookup results, and text messages is limited to the seller. This website does not hold card numbers or security codes. Stripe stores the payment method for monthly card plans; our restricted payment-system credentials and stored transaction references are protected separately.

10. Changes to this policy

Each version of this policy is published at a permanent dated address alongside the SHA-256 hash of its source, and every prior version stays reachable from the list at the foot of this page. A change is made by publishing a new version, never by editing a published one — so what this policy said on the day you used the site remains verifiable.