Privacy Policy

This Policy applies when we determine how personal information is handled for our website, accounts, billing, and direct customer relationship.

When a SaaS customer uses Custom Domain Kit to process information about its own end users, that customer generally determines the purposes of processing and we process the information to provide the Service. The SaaS customer's privacy notice also applies to that relationship.

• Account and organization information: identifiers, name, email address, profile information, organization membership, authentication events, and session data provided through Clerk.
• Service configuration: application names, domains, origin URLs or hostnames, DNS and certificate validation records, status history, tenant or actor identifiers, setup appearance, webhook endpoints, and related operational settings.
• Credentials and security data: hashed application secrets, encrypted Cloudflare API tokens, token permission information, and security or audit events. Secret values may be shown once when created.
• Billing information: plan, subscription, usage, billing status, Stripe customer and subscription identifiers, and transaction references. Payment card details are collected and handled by Stripe and are not stored by us.
• Usage and device information: request metadata such as IP address, browser or device information, timestamps, pages or endpoints requested, diagnostic data, and necessary authentication or security cookies.
• Communications: information you include when contacting support or submitting a privacy request.

• Provide, authenticate, operate, monitor, support, and improve the Service.
• Create and validate domain configurations, certificates, proxy routes, webhooks, and status checks.
• Process subscriptions, measure billable usage, and maintain transaction records.
• Protect accounts and infrastructure, prevent abuse, investigate incidents, and enforce our Terms.
• Communicate about service changes, security, billing, support, and legal requests.
• Comply with law and establish, exercise, or defend legal claims.

Where applicable law requires a legal basis, we process information as necessary to perform our contract with you, comply with legal obligations, protect vital interests, pursue legitimate interests such as operating and securing the Service, or with your consent. You may withdraw consent where processing depends on it, without affecting earlier processing.

We disclose information only as needed to operate the Service, follow your instructions, complete a business transaction, protect rights and safety, or comply with law. Service providers include:

• Clerk for authentication and account management.
• Stripe for checkout, subscriptions, payments, fraud prevention, and billing records.
• Cloudflare for hosting, database and storage services, DNS and certificate operations, network security, and domain traffic processing.

We may also disclose information to professional advisers, authorities, or a successor in a merger, financing, reorganization, acquisition, or sale, subject to applicable safeguards.

We do not sell personal information or share it for cross-context behavioral advertising.

We use cookies and similar storage that are necessary for authentication, security, language selection, and theme preferences. Clerk sets authentication cookies when you sign in or create an account. The Service does not currently use advertising cookies. Blocking necessary cookies may prevent account features from working.

We and our service providers may process information in countries other than where you live. Where required, transfers rely on recognized legal mechanisms and contractual safeguards. Information may therefore be subject to the laws of those locations.

We retain information while your account or service relationship is active and as reasonably necessary to provide the Service, maintain security and audit records, resolve disputes, enforce agreements, and meet legal, tax, and accounting obligations. Domain, application, and webhook records are generally retained until you delete them or request account deletion, subject to legal or operational exceptions. Testing Mode may remove provisioned domain resources after the displayed evaluation period. Backup and provider copies may remain for a limited period before deletion.

We use administrative, technical, and organizational measures intended to protect information, including access controls, encrypted transport, hashing application secrets, and encrypting stored provider tokens. No system is completely secure, so we cannot guarantee absolute security. You are responsible for protecting your account and securely storing secrets shown to you.

Depending on where you live, you may have the right to access, obtain a copy of, correct, delete, or restrict processing of your personal information; object to certain processing; request portability; withdraw consent; and appeal or complain to a data protection authority. You may also have the right not to receive discriminatory treatment for exercising a privacy right.

Submit a request to support@customdomainkit.com. We may need to verify your identity and authority before acting. Some information may be retained where permitted or required by law. If Custom Domain Kit processes your information for one of our SaaS customers, contact that customer first so it can instruct us.

The Service is intended for businesses and developers and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us so we can review and delete it as appropriate.

We may update this Policy as our practices or legal requirements change. We will revise the date above and provide additional notice when a change is material. Your continued use of the Service after an update is subject to the revised Policy.

For privacy questions or requests, email support@customdomainkit.com. Your use of the Service is also governed by our Terms of Service.