Fairverra Privacy Policy

Fairverra is operated by Nuevo Comienzo BV, the Netherlands. For your account data (identity, billing, login, API keys, wallet and orders) we are the controller. Contact: info@fairverra.com.

When you submit registrant data about yourself, we use it to register and manage the domain. When you submit registrant data about someone else, you must have a legal basis to give us that data. This policy does not make us your processor and does not include a processing agreement. We may provide one separately if we agree to.

Account data: name, email, company, VAT number, billing address, and the hashed form of API keys. We do not store the key itself after it is shown.

Registrant and handle data you submit: the contact fields the registry requires (name, organization, address, email, phone, and where required a company number). Domain names, nameservers, DNS records you store with us, and order history.

Wallet and payment data: amounts, Mollie customer and mandate identifiers, and payment status. We do not store full card numbers.

Acceptance records: which legal document version the account accepted, when, and whether that was done with a portal session or an API key (key prefix and key id, not the secret).

Technical data needed to run the API: authentication result, rate-limit counters, and error logs.

We process this data to provide the Service, take payment, issue invoices, secure accounts, and meet registrar and registry rules. The legal bases we rely on are contract (the account and the registration) and legal obligation (tax and registrar duties). Fairverra may email the account about renewal and expiry of domains on the account. Expiry notices may also come from the registrar, the registry, or another party.

These are the parties the application actually sends data to:

• Airtable — stores account, domain, order, payment and key records.
• The registrar that sponsors the domain. Receives registrant handles and domain instructions, and submits them to the registry for that TLD. We identify that registrar on request.
• The registry for the TLD — receives the registrant data required to sponsor the domain. The registry may publish some of it through WHOIS or RDAP under its own policy. We do not run a separate privacy-proxy product.
• Mollie — processes deposits and saved payment mandates.
• SendGrid — sends transactional email. Dutch portal mail and login codes use no-reply@domainportal.nl. English account mail about renewal, expiry and transfers uses noreply@fairverra.com.
• Vercel — hosts the application and processes the HTTP requests that reach it.

We do not sell personal data. Fairverra or the registrar may contact a registrant directly when ICANN or registry policy, a court order, or an urgent abuse case requires it.

We keep account, order and registrant records while the account is active and afterwards for as long as we need them to provide the Service and to meet legal duties. We keep the registration record for a domain (domain name, holder, order date, and the agreement text) until at least two years after the contract with that registrant ends.

Under the GDPR you can ask for access, correction, erasure, restriction, or a copy of the personal data we hold about you, and you can object to processing based on legitimate interest. Some data cannot be erased while a domain is still sponsored or while we must keep it for a legal or registrar duty. The registrant contact on a live domain is corrected by updating the handle, not by deleting the domain record.

Send requests to info@fairverra.com. You can also complain to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

A material change to this policy gets a new version. A production deposit, and a paid order placed with an API key or an OAuth token, requires acceptance of the current version, together with the Terms of Service and the Domain Registration Agreement.