Privacy policy

This policy explains what personal data NamesShift Inc. ("NamesShift", "we") collects when you browse namesshift.com, buy a domain, create an account or contact us — and what you can do about it.

1. Who we are

NamesShift Inc. is the data controller for the information described here. For privacy questions, including access and deletion requests, write to legal@namesshift.com.

2. What we collect

• Order details — the domain you requested, the offer amount, the email address you gave us and the message you sent with it.
• Account data — your name, email address, sign-in method and authentication events. Passwords are hashed by our authentication provider; we never see them.
• Payment data — the payment identifier, amount, currency and status. Card and wallet details are entered on our payment provider's hosted page and never reach our servers.
• Support messages — contact, abuse and affiliate messages you send through the forms or the live chat, including any attachments or links you include.
• Technical data — IP address, browser user agent, requested URL and timestamps in server logs, kept to keep the service available and to detect abuse.
• Usage data — aggregate counts such as page views and searches. We do not build advertising profiles.

3. Why we use it

• To perform our contract with you — processing your order, handling the transfer, issuing receipts and answering order questions.
• Legitimate interests — keeping accounts and payments secure, preventing fraud and abuse, and improving the catalogue and site.
• Legal obligations — retaining transaction records for tax and accounting, and responding to lawful requests.
• Consent — where we ask for it, for example for optional product updates. You can withdraw consent at any time.

4. Who processes it

We share only what each provider needs, under contracts that restrict their use of your data:

• Clerk — buyer accounts, sign-in and email verification codes.
• Paylio — hosted checkout, card and wallet payments, crypto settlement and payment status.
• Tawk.to — the live chat widget on our public pages and in the buyer account area.
• Our hosting and email providers — serving the site and delivering transactional email.

We do not sell personal data, and we do not share it with advertising networks.

5. Cookies & similar storage

• Strictly necessary — the buyer session cookie that keeps you signed in and protects account forms against cross-site requests.
• Authentication — cookies set by Clerk during sign-in, verification and device-trust checks.
• Live chat — local storage and cookies set by Tawk.to so a conversation survives a page reload.

We do not run third-party advertising or cross-site tracking cookies. Blocking non-essential storage keeps the site working; blocking the necessary cookies prevents sign-in.

6. How long we keep it

• Order and payment records — up to seven years, as required by tax and accounting rules.
• Account data — while the account is open, then deleted or anonymised within 30 days of a verified deletion request.
• Support messages — up to 24 months after the conversation ends, then deleted.
• Server logs — 30 days, unless a security investigation requires longer.
• Chat transcripts — retained by Tawk.to under our instruction, and deleted with the rest of the support history.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your data, and to receive a portable copy. To exercise any of these, email legal@namesshift.com from the address on your account and tell us what you want. We answer within 30 days and may ask for proof of identity so we do not hand data to someone else.

If you are in the EEA or the UK you can also complain to your local data protection authority. In California you may request disclosure of the categories of data we collected in the past twelve months; we do not sell or share data for cross-context behavioural advertising, so there is nothing to opt out of on that front.

8. Security

Sessions are signed and served over HTTPS, account forms are protected by CSRF tokens, checkout runs on a hosted payment page and access to production records is limited to the team that handles orders. No system is perfect: if a breach affects your data, we notify affected users and the relevant authority as required by law.

9. Children

The service is meant for businesses and adults. We do not knowingly collect data from anyone under 16. If you believe a child created an account, contact us and we remove it.

10. Changes to this policy

When we change this policy we update the date at the top of the page. Material changes are announced by email to account holders or in the live chat before they take effect.

11. Contact

Privacy requests: legal@namesshift.com
General support: support@namesshift.com
Abuse reports: abuse@namesshift.com

You can also write to us through the contact form; include "privacy request" in the subject line so it routes correctly.