Privacy Policy
The legally binding version is the German privacy policy.
1. Controller
OnlineBuilders LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA.
Email: [email protected] (see Imprint).
2. Hosting
This website is hosted on servers in Germany (Hetzner Online GmbH). A data processing agreement pursuant to Art. 28 GDPR is in place.
3. Server log files
When you access the site, data (IP address, date/time, page requested, browser type) is collected automatically for secure and stable operation. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
4. Cookies
Technically necessary cookies are required for operation (§ 25(2) TDDDG). Analytics cookies are set only with your consent (§ 25(1) TDDDG together with Art. 6(1)(a) GDPR).
5. Consent (cookie banner)
On your first visit we ask for consent via a banner. Without consent, no analytics services are loaded. You can change or withdraw your choice at any time (clear cookies/storage in your browser).
6. Google Analytics 4
We use Google Analytics 4 (provider: Google Ireland Limited) — only after your consent. Purpose is reach and usage analysis to improve our service. The IP address is truncated (anonymised). Data transfer to Google LLC in the USA is possible, based on the EU Standard Contractual Clauses / EU-US Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR. You may withdraw consent at any time with future effect.
7. Payment processing (Stripe)
For payments we use Stripe (Stripe Payments Europe Ltd., Ireland; where applicable Stripe, Inc., USA). Payment data entered during checkout is processed directly by Stripe; we do not store full payment details. Legal basis: performance of contract, Art. 6(1)(b) GDPR. Transfer to the USA is possible (SCCs / Data Privacy Framework).
8. Customer account & domain registration
To register and manage domains we collect the data required for the contract, transferred to the relevant registry or upstream registrar as required (e.g. WHOIS/RDAP), based on Art. 6(1)(b) GDPR.
9. Sign-in & authentication (Firebase)
For signing in to the customer portal betadomain.de we use Firebase Authentication (Google Ireland Limited, possibly Google LLC, USA). We process your e-mail address and – when signing in with Google – the profile data provided by Google, plus technical session data. Legal basis: contract performance (Art. 6(1)(b) GDPR) and our legitimate interest in secure access (Art. 6(1)(f) GDPR). Transfer to the USA is possible (EU SCCs / Data Privacy Framework).
10. Address & identity verification (fraud prevention)
To prevent abuse and meet legal obligations, we verify the order data before the first paid order, in a tiered manner:
- Address check: validation of the address via the Google Address Validation API (Google Ireland Limited / Google LLC, USA). If the address can be verified unambiguously, no further check takes place.
- Identity check: if the address cannot be confirmed, we carry out an identity verification via Didit (Didit, Inc.). As part of the verification, ID and possibly biometric data (e.g. photo match) you provide are processed by the provider. We only store the result (verified/declined) and a transaction ID.
Legal basis: contract performance and fraud prevention (Art. 6(1)(b) and (f) GDPR); where special categories of data (biometric data) are processed, this is based on your explicit consent in the verification process (Art. 9(2)(a) GDPR). Transfer to the USA is possible (SCCs / Data Privacy Framework).
11. E-mail delivery (Mailgun)
For transactional and service e-mails (e.g. order/transfer confirmations, renewal and payment notices) we use Mailgun (Sinch Email; processed via the EU data centre). We process your e-mail address and the content required for delivery. Legal basis: contract performance (Art. 6(1)(b) GDPR).
12. Tax calculation (Stripe Tax)
To correctly calculate and show VAT and to issue invoices, we process your billing address and – for businesses – your VAT identification number (validated via the EU VIES system) through Stripe. Legal basis: contract performance and compliance with tax obligations (Art. 6(1)(b) and (c) GDPR).
13. AI assistants & MCP connector (OAuth)
betadomain provides a connector (Model Context Protocol server at /api/mcp) that lets AI assistants (e.g. ChatGPT or Claude) access selected functions. Use is voluntary and enabled by you within your chosen AI service.
- Public lookups (no sign-in): domain availability, TLDs/prices and WHOIS/RDAP data can be retrieved without login. We process the requested domain names and technical connection data (IP, timestamp) to answer requests and prevent abuse (rate limiting). WHOIS/RDAP data comes from public registry sources. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- Account & ordering functions (with sign-in): to access your own data (e.g. listing your domains, starting an order) you sign in via OAuth 2.1 with your betadomain account and grant the AI service explicit authorization. Access is limited to your own account data and can be revoked at any time in the customer portal under "Profile → Connected apps". No payments are triggered automatically – you complete payment and any identity check yourself via the checkout link provided. Legal basis: contract performance and pre-contractual measures (Art. 6(1)(b) GDPR).
- Transfer to the AI provider: the content of your conversation and the results retrieved via the connector are processed by the AI service you choose (e.g. OpenAI, Anthropic). That provider is independently responsible for this processing and its own privacy terms apply. Transfer to the USA may occur.
14. Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with a supervisory authority. You may withdraw any consent given at any time with effect for the future.