Privacy Policy

1. Who We Are

DomainValueEstimator.com ("we," "us," "our") operates an AI-powered domain valuation platform at domainvalueestimator.com. We are the data controller for personal data collected through this service. For GDPR purposes, processing takes place under our legitimate interest in operating the service and, where required, based on your consent.

2. What Personal Data We Collect

2.1 Data You Provide Directly

2.2 Data Collected Automatically

• IP address — used for rate-limiting (3 free appraisals/day per IP) and fraud prevention; stored in appraisal_usage and newsletter_signups tables
• User agent string — browser and operating system, stored in newsletter_signups and contact_submissions
• Page views, session data, and interaction events — collected by Google Analytics 4 (GA4, property G-2VVGN37BB7)
• Referral URLs and search terms — via Google Analytics
• Flask session cookie — stores your login state and bulk analysis credits; essential for service operation

2.3 AI-Generated Data

Domain valuations, SEO scores, brandability scores, and market narratives are generated by our proprietary AI algorithms. These outputs are stored alongside the domain you submitted. Per TRAIGA, you may request a human review of any AI-generated output.

3. Legal Basis for Processing (GDPR)

4. How We Use Your Data

• Deliver and improve our domain valuation services
• Train and recalibrate AI/ML valuation models using anonymized, aggregated data
• Process payments and manage subscriptions via Stripe
• Enforce daily appraisal limits for free-tier users (by IP address)
• Respond to support inquiries and data subject requests
• Send transactional emails (purchase confirmations, account notifications)
• Send newsletters and marketing emails (only where you have explicitly opted in)
• Detect and prevent fraud, abuse, and unauthorized API access
• Comply with applicable legal obligations (tax, financial regulations)

5. Third-Party Processors

We share personal data with the following service providers acting as data processors under written data processing agreements:

We do not sell your personal information to any third party. We do not share data with advertising networks for behavioral targeting.

6. Data Retention Schedule

7. AI & Automated Decision-Making Disclosure

8. Cookies and Tracking

We use the following cookies and tracking technologies:

• Essential cookies: Flask session cookie, CSRF token — required for login and form security. No consent required.
• Analytics cookies: Google Analytics 4 (GA4) — page views, events, approximate location (IP anonymized). Requires consent in jurisdictions covered by GDPR and LGPD.
• Preference cookies: dve_privacy_prefs — stores your cookie consent choices in your browser's localStorage.

You may manage your analytics preference at any time using the "Your Privacy Choices" link in our footer, or by visiting our Cookie Policy. To opt out of GA4 tracking globally, visit tools.google.com/dlpage/gaoptout.

9. Your Rights by Jurisdiction

9.1 GDPR — EU, EEA, UK Residents

• Access (Art. 15): Request a copy of all personal data we hold about you
• Rectification (Art. 16): Request correction of inaccurate data
• Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Portability (Art. 20): Receive your data in a structured, machine-readable format
• Object (Art. 21): Object to processing based on legitimate interest
• Restrict (Art. 18): Request restriction of processing
• Withdraw consent (Art. 7): Withdraw any consent at any time
• Lodge a complaint: File a complaint with your national supervisory authority (e.g., ICO in the UK, DPC in Ireland)

Response time: within 30 days, extendable by 60 days for complex requests (we will notify you).

9.2 CCPA/CPRA — California Residents

• Right to Know: Know what personal information we collect, use, and disclose
• Right to Delete: Request deletion of personal information (§1798.105)
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for targeted advertising. Use "Your Privacy Choices" to manage data sharing
• Right to Non-Discrimination: We will not penalize you for exercising privacy rights
• Right to Limit Sensitive Data Use: We do not process sensitive personal information beyond service-essential purposes

Response time: within 45 days, extendable by 45 days with notice.

9.3 LGPD — Brazilian Residents

• Confirmation and Access (Art. 18 I–II): Confirm whether we process your data and access it
• Correction (Art. 18 III): Request correction of incomplete or inaccurate data
• Anonymization, blocking, or deletion (Art. 18 IV): Request anonymization, blocking, or deletion of unnecessary data
• Portability (Art. 18 V): Request data transfer to another provider
• Deletion of consent-based data (Art. 18 VI): Request deletion of data processed on the basis of consent
• Information on sharing (Art. 18 VII): Know with whom we share your data
• Objection (Art. 18 IX): Object to processing that violates LGPD

Response time: within 15 days as required by ANPD guidelines.

9.4 TRAIGA — Texas Residents

• Be informed when AI is used in decisions affecting you
• Receive an explanation of how AI-generated domain valuations were produced
• Request human review of any AI-generated output
• Opt out of AI-based profiling where applicable
• Access and correct personal data used by AI systems

To exercise any right: Use our Data Subject Request form, or contact us via the Contact Form. We may ask you to verify your identity before processing your request.

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including: TLS encryption in transit, secure PostgreSQL storage on Replit infrastructure, CSRF protection on all forms, access controls on administrative functions, and regular dependency security reviews. In the event of a personal data breach that is likely to result in risk to individuals, we will notify affected users and relevant supervisory authorities within 72 hours as required by GDPR Art. 33.

11. International Data Transfers

Our service operates from the United States. If you access the service from the EU/EEA/UK, Brazil, or Australia, your personal data will be transferred to the US. We rely on Standard Contractual Clauses (SCCs) for transfers from the EU/EEA/UK to the US (via Stripe, Google Analytics, and Perplexity). For LGPD transfers, we ensure adequate data protection guarantees as required by ANPD.

12. Children's Privacy (COPPA)

Our service is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted personal data through our service, please contact us immediately and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a prominent notice on the site and, where we hold your email address, by email at least 14 days before the change takes effect. Continued use of the service after the effective date constitutes acceptance of the revised policy.

14. Contact & Data Controller Information