Privacy policy

The controller and operator of the Domaincatcher.fi service (“Domaincatcher”, “we” or “us”) is omaMac.

Business name

omaMac

Business ID

2025358-2

VAT number

FI20253582

Service

Domaincatcher.fi

Business contact

[email protected]

Website

https://domaincatcher.fi

No data protection officer has been designated. Privacy requests can be sent to the business contact address above.

• Account data: email address, password hash, account status, verification and administrative-review records.
• Identity and contact data: name, country, state or province, address, city, postal code, telephone number and date of birth where applicable.
• Company data: company name, contact person, Business ID and VAT or tax identifier.
• Finnish individual identification data: personal identity code when required for registrar contact creation and identity verification.
• Service data: watchlists, reviewed domains, catch orders, accepted terms, pricing snapshots, registration attempts and registered-domain ownership records.
• Payment data: Stripe customer and invoice identifiers, invoice amount and status, Hosted Invoice Page link and payment timestamps. Domaincatcher does not store full card or bank-account credentials.
• Communications: verification, operational, payment and support messages and their delivery status.
• Technical and security data: IP address, timestamps, authentication and application logs, browser request information, error records and abuse-prevention signals.

Most personal data comes directly from you during registration, account use and support communication. Service and audit data is generated when you use Domaincatcher.

Domain lifecycle information comes from public Traficom sources. Registrar results come from Openprovider, payment and invoice status from Stripe, and domain-level SEO metrics from DataForSEO. Domain analysis providers receive domain names, not your identity profile, unless separately stated at the time of use.

• Contract and requested pre-contractual steps: creating and administering accounts, accepting backorders, attempting registration, delivering caught domains, invoicing successful catches and providing support (GDPR Article 6(1)(b)).
• Legal obligations: accounting, taxation, fraud prevention and responding to lawful authority requests (Article 6(1)(c)).
• Legitimate interests: securing and monitoring the service, preventing duplicate or abusive orders, keeping audit trails, resolving disputes, measuring reliability and improving operations (Article 6(1)(f)).
• Consent: identity-verification processing where consent is the stated basis. Consent can be withdrawn, but withdrawal does not affect earlier lawful processing and may prevent us from providing a service that requires verified registrar details (Article 6(1)(a)).

Finnish personal identity codes are treated as high-risk confidential data. They are encrypted at rest. A keyed, non-reversible fingerprint is used to detect duplicate identity records. Plaintext is made available only to authorized processing needed for administrator-reviewed KYC or creation of the customer contact required by the .fi registrar.

These identifiers are not used for marketing, domain scoring or public profiles. Access should be limited, logged and reviewed.

• Openprovider: registrar contact information and domain-registration instructions required to register and manage the domain.
• Stripe: customer email, name, successful-catch invoice details and payment status for electronic invoicing and payment processing.
• Email provider: recipient address and message content needed to deliver account, catch and payment notifications.
• Hosting, database and infrastructure providers: data required to operate, back up, secure and monitor the service.
• DataForSEO: queried domain names for requested domain-level ranking information; customer identity profiles are not intentionally submitted.
• Authorities and professional advisers: only where required by law or reasonably necessary to establish, exercise or defend legal claims.

Some providers, including Stripe and their subprocessors, may process data outside Finland or the European Economic Area. Where required, transfers rely on an adequacy decision, the EU–US Data Privacy Framework for certified recipients, European Commission Standard Contractual Clauses, or another lawful safeguard.

You may request further information about applicable safeguards from the privacy contact. See also Stripe’s Privacy Center.

• Account and identity-profile data is retained while the account is active and afterwards only as long as needed for registrar administration, disputes, fraud prevention or legal obligations.
• Catch orders, successful registration evidence, invoices and accounting records are retained for the applicable statutory accounting and limitation periods.
• Unsuccessful order and attempt records are retained long enough to investigate performance, complaints and abuse, then deleted or anonymized when no longer necessary.
• Email-verification links expire after 24 hours. Hashed verification and consent records may remain as security and compliance evidence.
• Operational and security logs are retained for a limited period based on security and incident-investigation needs. Records relevant to an active incident or legal claim may be preserved longer.
• Encrypted identity identifiers are deleted or irreversibly anonymized when registrar, KYC, contractual and legal retention needs end.

Measures include password hashing, authenticated encryption for identity identifiers, role-based administrative access, HTTPS, database constraints, signed payment webhooks, secret files outside source control, backups, logging, rate limits and operational kill switches.

No system is completely secure. If a personal-data breach creates a legal notification duty, we will notify the competent supervisory authority and affected individuals as required.

Domaincatcher calculates domain scores and uses automated safety checks for timing, availability, registrar limits and operational risk. These checks concern domains and service operation; they are not intended to make solely automated decisions that produce legal or similarly significant effects about a person.

Account activation and KYC approval require administrator review. A failed automated check can be reviewed by contacting us.

Subject to the GDPR and applicable exceptions, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent where processing relies on consent.

Send requests to [email protected]. We may need to verify your identity. We normally respond within one month, with extensions only where legally permitted.

You may complain to the Finnish Data Protection Ombudsman or the supervisory authority where you live or work. See tietosuoja.fi.

Domaincatcher does not use advertising cookies. The application may store an authentication token and necessary interface state in your browser. The HTTP Basic Authentication layer may also be remembered by your browser. Server logs record requests for security and reliability.

We may update this policy when the service, processors or legal requirements change. Material changes will be communicated through the service or by email where appropriate. The current version and effective date remain available on this page.