Privacy policy

Version 2 · Last updated: 21 October 2026

1. Controller and contact

The controller for generate.domains is Marcos Emiliano Moktoski. Full provider identification and the postal contact address are available in the legal notice. For questions or to exercise your rights, write to [email protected] or use the contact page, choosing “Privacy”.

This policy covers the website, accounts, naming tools, projects, API and payments. It is a privacy notice: browsing, creating an account or accepting the terms of use does not mean consenting to every processing activity or to advertising.

2. Data we process and its sources

• Account and access: name, email, language, preferences, hashed password, verification, sessions and security information. If you choose Google or LinkedIn, we receive the account identifier, name and verified email; we do not receive that provider’s password.
• Searches and work: ideas, reference domains, refinement answers, chosen style, length and TLDs, results, saved candidates, notes, projects, reports and collaboration activity. API requests include submitted data and records needed to authenticate, measure and limit usage.
• Purchases: customer and tax details where needed, orders, amounts, currency, taxes, payment references and status, subscriptions and credit transactions. Stripe collects full card details; the platform does not store the full card number or security code.
• Contact and problem reports: name, email, message, category, replies and technical page information. When reporting a problem, the search content and identifier are attached only if you select that option.
• Technical and third-party data: IP address, browser information, session identifiers or their hashes, timestamps, pages and usage events. A project owner may provide your email to invite you. Sign-in and payment providers supply information needed to complete those operations. Country detection currently uses the local GeoLite2 database; each IP lookup does not need to be sent to MaxMind.

Do not put passwords, API keys, sensitive data or unnecessary personal information about others in prompts or messages. Required fields support the requested function; without them we may be unable to fulfil it.

3. Purposes and legal bases

• Providing the service and handling pre-contract requests: managing accounts, generating and comparing names, preserving your work, collaboration, API execution, payment and service communications. Basis: contract performance or pre-contract steps.
• Legal duties: accounting and tax documents, rights requests and valid authority demands. Basis: legal obligation.
• Security and administration: preventing fraud and abuse, enforcing limits, diagnosing faults, responding to general enquiries or claims and managing invitations. Basis: legitimate interests in protecting and administering the service, balanced against your rights. You may object where applicable.
• Optional analytics: measuring navigation and performance with the services described below. Basis: consent, which you may withdraw. Creating an account does not itself authorise advertising messages.

Acceptance records identify the document version, date, language, IP and a hash of browser information. Recording delivery of a privacy notice is not consent to optional purposes.

4. Artificial intelligence and domain queries

To generate suggestions or reports, we send the AI provider the necessary content: your idea, conversation or project context, candidates, criteria and language. The current configuration uses OpenRouter, which forwards the request to the selected model’s provider. See its policy and provider practices. Provider retention and use depend on the model and service terms; we do not promise zero retention or universally exclude training. The platform does not use your prompts to train its own model.

Availability checks and premium offers require sending domain names to registration, DNS and marketplace services such as Sedo. Names and their checks may be retained separately as a cache and catalogue without thereby publishing your prompt or identity. AI assessments concern names and are not used to make legal decisions about you. You may request human review of an access restriction or charge.

5. Projects and shared links

Searches are not automatically published. Project members can access shared content according to their permissions; owners manage invitations and spending. When you enable a public or shared link, recipients can view the included content and forward it. Review what you share. Revoking a link prevents further access through it but does not delete copies made by others. Authorised administrators may access data when necessary for support, security and administration.

6. Recipients and providers

We use hosting, storage, backup and email providers, plus the following services depending on the feature used:

• OpenRouter and the model provider: AI generation and reports.
• Stripe: payments, fraud prevention and transaction documents.
• Google and LinkedIn: external sign-in when chosen; Google also supplies optional analytics.
• Cloudflare: website delivery and protection, Turnstile against abusive automation, and optional analytics. Security checks may process IP addresses and browser signals.
• Registration and DNS services, Sedo and the registrar you visit: domain queries and transactions.

Each provider receives data needed for its function. Some act as processors and others also as controllers of their own operations, depending on the service. We may disclose data to authorities or advisers where a legal basis exists. We do not sell your personal data. Links to external policies do not remove our own responsibilities.

7. International processing

Some providers may process data outside the European Economic Area, including the United States and countries where the model provider operates. OpenRouter describes transfers to the United States in its policy. Transfers subject to the GDPR must have an adequacy decision or appropriate safeguards, such as standard contractual clauses and necessary additional measures. You may request details of the recipients, countries and safeguards applicable to your processing. We do not treat website use as blanket authorisation for international transfers.

8. Cookies, storage and analytics

You can accept, reject or change optional analytics through “Cookie settings” in the footer. Currently, both Google Analytics and Cloudflare Web Analytics wait for this affirmative choice. Cloudflare Web Analytics does not need cookies to measure visits, but this platform still makes it subject to consent. Our own navigation statistics also respect the analytics choice; their records can be linked to an account and are pseudonymised, not necessarily anonymous.

• generatedomains-session and XSRF-TOKEN: Session and form protection. 2 hours, renewed with activity.
• remember_*, if you choose remembered sign-in: Maintain the sign-in you requested. Up to 400 days or until sign-out.
• locale, discovery_tld_preferences, discovery_naming_preferences: Remember your chosen language and search preferences. Up to 1 year.
• generate_domains_cookie_consent: Store your cookie choice. 180 days.
• Google Analytics _ga, _ga_*: Optional usage statistics. Up to 2 years, depending on the service.
• Local or session storage: Theme, registrar, guest favourites, guide and drafts. Until cleared or the session ends, depending on type.

Registered users’ preferences may also be stored in their account. Analytics can include pages, referral source, device, approximate country and events. Rejecting analytics does not disable sessions, requested functions or security protection. You can clear cookies and storage in your browser; this may sign you out or remove preferences. Data already processed before consent is withdrawn remains subject to applicable retention periods and rights.

9. Retention and deletion

Current periodic cleanup periods are:

• Guest history: 90 days from creation. Member history, candidates and projects are retained while you keep that work or account; the guest period does not automatically delete them.
• First-party statistics: 90 days; visits are cleared based on their last activity. API usage records and batches: 90 days. AI consumption records: 365 days.
• Notifications: 180 days. Messages marked resolved or spam are deleted once they are more than 365 days old; pending messages remain while being handled.
• Inactive sessions: cleanup after 30 days, independently of the shorter sign-in expiry. Personal data in administrative audit logs: redacted after 90 days; audit records: 365 days.

Financial documents, acceptance evidence and data needed for obligations or claims are retained for the legally applicable periods with restricted access. Deleting an account deletes or unlinks operational data but does not automatically remove financial documents that must be kept. Backups and infrastructure logs may retain residual data during their retention cycle; we do not promise instant deletion of every copy. You may request details for your data.

10. Security and children

We use permissions, encrypted connections, hashed passwords and encryption of selected content, such as conversations and contact messages. These measures do not guarantee zero risk. Protect your access and report incidents.

The service is not directed at children. Where processing a child’s data relies on consent, authorisation from their legal representative is required below the applicable legal age; in Spain, below 14. This does not replace the capacity or permission needed to contract. Contact us if you identify improperly processed data about a child.

11. Your rights

You may request access, correction, erasure, restriction, objection and portability where applicable, and withdraw consent without affecting the lawfulness of earlier processing. You can edit account details and preferences, delete your account in settings or request help through section 1’s contact channel. Portability may be requested through that channel; an export button is not required to make a request.

We normally respond within one month. If complexity or the number of requests requires an extension of up to two further months, we will inform you within the first month. We only request proportionate information to verify identity. You may complain to the Spanish Data Protection Agency or the competent authority where you live without first having to complain to us.

12. Changes and related documents

The date and version appear above. We will communicate significant changes through appropriate means and request separate consent where needed for new purposes. Continuing to browse does not replace your choice with presumed acceptance. The terms of use govern contracting; this policy explains data processing.