Privacy Policy

• Account data — your name and email address, provided through Google sign-in or email signup.
• Product data — the domains and DNS records you configure, connect sessions and their verification results, webhook endpoint URLs, and webhook delivery logs.
• Usage data — API request and connection counts metered against your plan, plus standard technical logs (IP address, user agent, timestamps) kept for security and rate limiting.
• Billing data — handled by our payment partners; we never see or store full card numbers.
• Cookies — the dashboard sets the session cookies required for sign-in. The marketing site sets analytics cookies (PostHog and Google Analytics) to understand aggregate usage; no advertising cookies.

When someone connects a domain through an integrator’s product, we process that connection — the domain name, the records to set, provider detection, and verification status — on the integrator’s behalf. Integrators are responsible for their own privacy disclosures to their users. We use this data only to run the connection, never to build profiles.

• Operating the service — provider detection, DNS verification, webhook delivery, and session handling.
• Metering usage against plan limits and billing paid plans.
• Securing the service — abuse prevention, rate limiting, and debugging.
• Service communication, such as billing or security notices.

No advertising, and no automated profiling.

• Our hosting provider — runs the servers and database that store the data above.
• Google — sign-in authentication.
• RevenueCat and Stripe — subscription billing and payment processing.
• Sentry — error monitoring; receives error reports and technical context (no DNS record contents).
• PostHog — product analytics on the marketing site; self-hosted at posthog.devino.ca on our own infrastructure, so analytics data stays with us.
• Google Analytics 4 — aggregate traffic measurement on the marketing site; data is processed by Google.

Each processor receives only what it needs for its role. We do not sell personal data, and there are no ad networks. We may disclose data where required by law.

Account data is kept while your account is active. Connection, session, and webhook delivery records are kept for as long as they are needed to operate the service and meter usage. Technical logs rotate on a shorter cycle. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where law requires longer retention.

Data moves over TLS, access to production systems is restricted, and webhooks are signed so your server can verify they came from us. No system is perfectly secure — if we learn of a breach affecting your data, we will notify you without undue delay.

You can request access to, correction of, export of, or deletion of your personal data. Depending on where you live, you may have additional statutory rights; we honor requests regardless of geography where we reasonably can.

Updates to this policy are posted here with the date above adjusted. Material changes will be announced in the dashboard or by email before they take effect.

DoDomain is operated by Devino Solutions Inc, Ottawa, Ontario, Canada K1G 5K1. For privacy questions or requests about your data, reach us through the support form — privacy requests are routed to the team directly.