Webba← Back to the gallery

Privacy Policy

Version 1.0-draftEffective August 30, 2026

Draft — pending confirmation. This document is an operational draft grounded in how Webba actually works. Company legal details (entity, address, governing law, contact addresses) are placeholders until confirmed, and the wording marked for review below should be reviewed by qualified counsel before launch. Questions: hello@webba.com.

This Privacy Policy explains what information Webba collects when you use the marketplace at webba.com, why, and who processes it. It describes Webba’s actual data practices — it does not claim collection or certifications that Webba does not have.

1. Information we collect

Information you provide

  • Contact and inquiry information. When you ask a question, make an offer, or start a purchase, we collect the email address you supply, and any name and free-text message, note, or offer amount you enter. Buyers do not create a password or an account; your email address is your identity for a conversation or a purchase.
  • Transaction information. If you proceed toward a sale, we record the domain, the agreed price and currency, and the buyer email associated with the transaction.
  • Operator account credentials. For accounts that manage listings, we store an email address and a password stored only as an Argon2id hash — we never store your password in a readable form.

Information collected automatically

  • Session and access data. To keep you signed in or to grant access to a conversation or purchase, we set functional cookies holding an opaque or signed token (see our Cookie Notice). Server-side sessions store only a hashed token and an expiry, not your IP or device.
  • IP address, for security, abuse prevention and inquiries. We record IP addresses as part of rate-limiting and abuse controls (for example, to limit how often a new conversation can be started from one address). When you send an inquiry, a price request or an offer, we keep the IP address it came from with that conversation, for abuse investigation, and use it to estimate an approximate location (such as city and country) that may be shown to the seller of the name. When you accept our terms while making an offer or starting a purchase, we may record the IP address and browser user agent with that acceptance. We do not use IP addresses to build advertising profiles.
  • First-party usage measurement. We count page views on our servers using a keyed, one-way code derived from the IP address and browser type that changes daily, without storing the IP address with the view; we record the host name of the referring site, a few on-page actions (such as following a WhatsApp, phone or email link, or opening Buy Now) and searches, the latter against a random per-visit identifier held in your browser. A first-party cookie (webba_src) remembers the campaign tags or referring site of your first visit and is read if you later make an inquiry, offer or purchase request. See our Cookie Notice. We use no third-party analytics, advertising, or tracking services.
  • Email delivery and abuse records. If transactional email is enabled, we keep a record of which notification kinds were sent to which address and when, to prevent duplicate and abusive sending.

2. How we use information

  • to operate the marketplace and show and manage listings;
  • to let buyers and sellers communicate, negotiate offers, and begin and coordinate a purchase;
  • to set up and reconcile a transaction with the escrow provider when a sale proceeds;
  • to send transactional messages (such as offer and purchase updates) where email delivery is enabled;
  • to secure the service, prevent fraud and abuse, and enforce our Terms; and
  • to understand aggregate, non-identifying usage of the product.

We do not sell your personal information, and we do not use it for third-party advertising.

3. Service providers and sub-processors

We share the minimum information necessary with providers that help us run the service. They process it on our behalf or, in the case of escrow, as an independent provider of their own service:

  • Escrow.com — when a sale proceeds to escrow, the buyer and seller information needed to run the transaction (such as email and the agreed amount) is processed by Escrow.com under its own terms and privacy policy. Webba does not handle payment card or bank details.
  • Resend — our transactional email provider. When email delivery is enabled, the recipient address and message content are processed to deliver notifications. (Email delivery may be disabled, in which case notifications are queued but not sent.)
  • OpenAI — used to generate brand concepts and search features from domain-name and listing metadata. This processing concerns listing/inventory data, not buyer contact information.
  • Hosting and DNS infrastructure. The service and its authoritative DNS run on infrastructure we operate; personal data is stored in our own database on that infrastructure.

We may also disclose information where required by law or to protect the rights, safety, or property of Webba, our users, or the public.

4. International processing

Some of our providers (including Escrow.com, Resend, and OpenAI) are based in the United States, so using Webba may involve processing your information in the United States or other countries. ⚖ Legal review recommended: cross-border transfer mechanisms (e.g. SCCs) and any GDPR/UK-GDPR obligations if you serve EEA/UK users.

5. Retention

We keep information for as long as needed to provide the service and for legitimate business, legal, and security purposes — for example, conversation and transaction records are retained to support an ongoing or completed sale and to resolve disputes, and abuse and audit records are retained to protect the platform. ⚖ Legal review recommended: concrete retention periods per data category; the current implementation does not auto-expire most records.

6. Security

We take reasonable measures to protect information: passwords are stored only as Argon2id hashes, session and access tokens are stored only as hashes, access cookies are HTTP-only, and administrative access is restricted. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. We do not claim any specific security certification.

7. Your choices and rights

You may contact us to access, correct, or delete personal information we hold about you, subject to records we must keep for legal, security, or transaction-integrity reasons. Because buyers are identified by email, you can ask us to remove a conversation or inquiry tied to your address. Depending on where you live, you may have additional rights under applicable data-protection law. ⚖ Legal review recommended: whether GDPR/CCPA-specific rights sections and a formal request/verification process are required for your user base.

8. Children

Webba is not directed to children and is intended for users aged 18 and over. We do not knowingly collect information from children.

9. Changes and contact

We may update this policy; the current version and effective date are shown at the top. For privacy questions or requests, contact hello@webba.com (operator: Webba, [TODO: registered business address]).