Privacy Policy

Plain-English Summary

We know privacy policies are long, so here is the short version:

• Who we are. Just Domain is a service of Just Done LLC, a small domain reseller formed in Delaware, United States. We help you register and manage domain names through accredited registrars.
• What we collect. Account details, the registration data we need to register a domain on your behalf (some of which becomes public in WHOIS), payment details processed by trusted providers, and standard technical data like IP addresses and cookies, and, when you search through an AI assistant, the names you check and a pseudonymous identifier.
• Why we collect it. To provide and secure the service, process payments, comply with ICANN and the law, and (only if you opt in) send marketing emails.
• Who we share it with. Accredited registrars and registries, payment processors, our sign-in provider, hosting and security providers, analytics, error-monitoring and email tools, and authorities when legally required. We do not sell your personal information.
• Your rights. You can access, correct, delete, port, or object to processing of your data, subject to legal limits. Contact us at privacy@just-done.ai to exercise any right.
• Special note about WHOIS. We collect and hold your registration data as ICANN requires. On the TLDs that support privacy (which we currently enable free and by default), your personal contact details are replaced by a privacy proxy in the public WHOIS / RDAP record. On a minority of TLDs (for example .ai, .us, .eu, and .dev), registry policy requires certain fields to stay public and we cannot mask them.

The full policy below is the authoritative version.

1. 1.Who We Are (the Controller)
2. 2.Scope
3. 3.Information We Collect
4. 4.How We Use Your Information
5. 5.Legal Bases (GDPR / UK GDPR)
6. 6.How We Share Information
7. 7.International Data Transfers
8. 8.Data Retention
9. 9.Your Rights: General
10. 10.Additional Rights for EEA, UK, and Swiss Residents
11. 11.Additional Rights for California Residents
12. 12.Additional Rights for Israeli Residents
13. 13.Cookies and Similar Technologies
14. 14.Security
15. 15.Data Breach Notification
16. 16.Automated Processing and AI
17. 17.Children
18. 18.Third-Party Links
19. 19.Changes to This Policy
20. 20.Contact Us

1.Who We Are (the Controller)

For the purposes of applicable data protection laws, including the EU/UK General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and the Israeli Protection of Privacy Law, 5741-1981, the data controller is:

Just Done LLC ("Just") is a domain name reseller. We are not an ICANN-accredited registrar; we provide our services in cooperation with accredited registrars who handle the underlying registration of domain names with the relevant registries.

2.Scope

This Privacy Policy applies to personal information we collect:

• through https://justdomain.ai and any subdomains we operate;
• when you create an account, register or transfer a domain name, or use any of our services;
• through our MCP server at mcp.justdomain.ai, whether you reach it through a connector in an AI assistant or coding tool, or through the Just plugin for Claude Code;
• through email, support tickets, chat, and other communications with us;
• from third-party services that integrate with our services with your authorization.

This Policy does not cover the practices of third-party websites, accredited registrars, registries, or services that operate independently of us. We encourage you to review their own privacy notices.

3.Information We Collect

3.1 Account Information

Full name, email address, phone number, mailing address, country of residence, account credentials (passwords are stored only in hashed form), and account preferences.

3.2 Domain Registration Data (WHOIS)

To register, transfer, renew, or manage a domain name on your behalf, we collect and transmit the contact information required by the relevant registry, accredited registrar, and ICANN. This typically includes registrant, administrative, technical, and billing contact details: name, organization, email, phone, fax (if applicable), street address, city, state/province, postal code, and country.

3.3 Billing and Payment Information

When you purchase services, our payment processors collect payment card details, billing address, and transaction information directly. We do not store full payment card numbers on our own servers. We retain transaction records, invoices, and limited payment-method metadata held by our payment processor as needed to provide the services and comply with tax and accounting laws.

Where automatic renewal is on for a domain, our payment processor retains your payment method and we retain a reference to it, so that we can make that renewal charge. We also keep a record of the automatic-renewal choice you made and the exact terms you were shown when you made it, for three years, because the law that governs automatic renewals requires us to be able to show what you agreed to.

3.4 Technical and Usage Data

IP address, device and browser type, operating system, language preferences, referring URLs, pages viewed, time stamps, session identifiers, and similar telemetry. This is collected through cookies, log files, pixels, and similar technologies as described in Section 13. When you search on our site, it also includes the search text you type, with anything that looks like an email address removed. When you search through an AI assistant, this also includes the names or search text the assistant sends, the name and version the assistant reports, the session identifier of the connection and the pseudonymous identifier described in Section 16.1.

Some of this is recorded by our servers rather than by your browser. For example, when you open a checkout link, our server tells our analytics provider that a checkout page was opened, with the domain ending, whether the link named a domain, whether you were already signed in, and the campaign labels in the link (utm_source and utm_medium). If the link came from an AI assistant, it also sends the pseudonymous identifier described in Section 16.1. It does not send your IP address, your email address, your browser's details or the domain name. Because this happens on our server, browser settings and content blockers do not stop it.

When you sign in, whichever way you sign in, our analytics provider (Mixpanel) keeps your name and email address on the analytics profile of your account.

3.5 Activity and Audit Logs

We maintain logs of actions performed within your account, including domain searches, purchases, DNS changes, transfer requests, contact updates, login events, and actions performed through automated tools that you authorize on your behalf. These logs support security, troubleshooting, abuse prevention, dispute resolution, and your own visibility into changes to your account.

Transfers to us. When you ask us to move a domain to us from another registrar, you confirm that you are its registrant, or that the registrant has authorised you to move it. We keep a record of that confirmation: the domain, your account, the wording you confirmed, when you confirmed it, the IP address it came from, the user agent your browser sent with it (which identifies the browser and device type), and whether you gave us an authorization code. We never keep the code itself in it. Our registrar partner requires us to hold evidence of the registrant's permission before we request a transfer, and the record is how we show it if the registrant, the registrar the domain is leaving, the registry, our registrar partner, or a transfer-dispute provider later asks whether the move was authorised. We share it only with those parties and only for that purpose. We rely on our legitimate interest in preventing and resolving unauthorised transfers, and on performing the transfer you asked for.

Transfer reminders. If you ask us to note a domain that cannot be moved yet, we keep the domain name, the email address you give us, and the date the registry record shows, and we use them only to send you the one message you asked for, on or after that date. That message has a link to stop it.

3.6 Communications

The content of emails, support messages, chats, and attachments you send us, plus subscription preferences and engagement data (e.g., opens and clicks) for any newsletters or marketing emails you receive.

3.7 Information from Third Parties

Information about you that we receive from accredited registrars, registries, payment processors, fraud-prevention providers, and identity-verification services in connection with your use of the services.

Sign-in with Google. If you choose to sign in with Google, Google shares your name, email address and profile picture with us through WorkOS, which runs our sign-in (Section 6.2). We use them to create your account and sign you in, to show your name and picture on your account page and the account menu, and to fill in the registration form for you to check before you submit it. We never receive your Google password. Google's sign-in page may show WorkOS's name and link to WorkOS's terms and privacy policy, because WorkOS connects the sign-in for us; how we use your information is set out in this Policy.

Your Just account. Just Domain and Just Publish share one sign-in: your Just account, operated by Just Done LLC (sign-in by WorkOS AuthKit). Each product sees that you are the same signed-in person, and nothing more: your domains stay in Just Domain, your sites stay in Just Publish, and neither product reads the other's records.

4.How We Use Your Information

We may process personal information to:

• create and administer your account and authenticate you when you log in;
• process domain registrations, transfers, renewals, and DNS or contact changes through our upstream accredited registrars;
• process payments, issue invoices, and prevent fraudulent or unauthorized transactions;
• provide customer support and respond to inquiries;
• send service notices, renewal reminders, expiration notices, and security alerts;
• confirm your registrant email address as ICANN, registry, and registrar policies require, including sending new confirmation links, showing the confirmation status of your domains, and offering a separate link to sign in from the confirmation page;
• send marketing communications, where permitted by law and subject to your consent or opt-out rights;
• monitor, secure, and improve the site and services, including debugging, analytics, and capacity planning;
• measure how people find and choose domains, including linking a search made through an AI assistant to a later sign-in on our site;
• detect, prevent, and address fraud, abuse, security incidents, and violations of our terms;
• comply with legal obligations, ICANN requirements, registry policies, court orders, and lawful requests from public authorities;
• establish, exercise, or defend legal claims.

5.Legal Bases (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar requirements, we process your personal information on the following legal bases:

• Performance of a contract: to provide the services you have requested, including domain registration and management, and having your registrant email address confirmed as the registration agreement requires under ICANN's Whois Accuracy Program Specification and registry policy.
• Compliance with a legal obligation: to retain records for tax, accounting, ICANN, registry, and anti-money-laundering purposes.
• Legitimate interests: to secure and improve our services, measure how our site and services are used, including through the analytics Cookies and similar storage in Section 13 and by linking a search made through an AI assistant to a later sign-in on our site, prevent abuse, and conduct limited direct marketing to existing customers, where these interests are not overridden by your rights.
• Consent: for marketing communications to prospects and other processing where we ask for your consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6.How We Share Information

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.

We disclose personal information only as described below.

6.1 Accredited Registrars and Registries

Because we are a reseller, we transmit the registration data described in Section 3.2 to the accredited registrars and registries that operate the relevant TLD. These parties act as independent controllers for the registration records they maintain, in accordance with their own policies and ICANN requirements. The identity of the accredited registrar handling your domain may change over time, and you authorize us to transfer your registration data to a new accredited registrar where necessary to continue providing the services. Our current accredited registrar partner is Openprovider (Hosting Concepts B.V., Rotterdam, Netherlands). Openprovider sends the message that asks you to confirm your registrant email address, which may carry the Just Domain name and come from a Just Domain address, and it processes that address and your response as an independent controller for that purpose.

6.2 Service Providers

We use trusted third-party service providers that process personal information on our behalf, under written agreements that limit their use of the data. These providers fall into the following categories:

• Payment processing: to authorize and settle payments and prevent fraud (currently Stripe). On pages where you can pay, Stripe's script collects information about your device and how the page is used, to detect fraud. Stripe uses that information for fraud prevention as an independent controller, under its own privacy policy (stripe.com/privacy).
• Sign-in: to let you sign in with a one-time code sent by email or with your Google account, and to send those code emails (currently WorkOS).
• Hosting and infrastructure: to host the site and related applications.
• Content delivery, DNS, and security: to deliver the site reliably and protect it against attacks.
• Analytics: to measure traffic and usage on our site and our MCP server (currently Google Analytics and Mixpanel). Mixpanel receives events from your browser and from our servers.
• Error and performance monitoring: to detect, diagnose and fix failures (currently Sentry, operated by Functional Software, Inc.).
• Email delivery and marketing: to send transactional and marketing emails (our transactional emails, such as order, renewal, and domain notices, are currently sent through Resend).
• Productivity, content generation, and AI tools: used in limited contexts to support content and operational workflows.

We may add or replace service providers from time to time without notifying you individually, but we use commercially reasonable efforts to engage providers that offer appropriate safeguards.

6.3 Escrow and Backup Providers

ICANN and certain registries require escrow of registration data with third-party escrow agents. Your registration data may be deposited with such agents and used solely as required by ICANN and the relevant registry policies.

6.4 Legal, Regulatory, and Safety Disclosures

We may disclose personal information when we believe in good faith that disclosure is necessary to: comply with a legal obligation, court order, subpoena, or lawful request by a public authority; enforce our terms; investigate suspected fraud, abuse, or security incidents; or protect the rights, property, or safety of Just, our users, or others.

6.5 Business Transfers

If Just is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction, subject to standard confidentiality protections.

6.6 With Your Direction

We may share information with other parties when you direct us to do so, for example when you authorize a transfer to another registrar.

7.International Data Transfers

Just Done LLC is based in the United States (Delaware). Some of our service providers and accredited registrars are located outside the United States and the EEA. Where we transfer personal data to the United States from the EEA, the United Kingdom, or Switzerland, we rely on the EU-U.S. Data Privacy Framework (and the UK and Swiss extensions) where applicable, the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or another lawful transfer mechanism. Mixpanel stores our analytics data in its EU data region.

Where we transfer personal data from the EEA, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or another lawful transfer mechanism. You may request a copy of the safeguards applicable to a specific transfer by contacting privacy@just-done.ai.

8.Data Retention

We keep personal information only for as long as necessary for the purposes described in this Policy and as required by law.

When personal information is no longer needed, we delete or irreversibly anonymize it.

9.Your Rights: General

Subject to applicable law and the limits noted below, you may have the right to:

• Access the personal information we hold about you and obtain a copy.
• Rectify inaccurate or incomplete information.
• Erase your information.
• Restrict or object to certain processing.
• Port your information to another provider in a structured, machine-readable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a competent supervisory authority.

To exercise any of these rights, contact privacy@just-done.ai. We will respond within the time frames required by applicable law (generally 30 days under GDPR; 45 days under CCPA/CPRA, with one possible extension). We may need to verify your identity before fulfilling a request, and we may decline or limit a request where permitted by law.

10.Additional Rights for EEA, UK, and Swiss Residents

If you are located in the European Economic Area, the United Kingdom, or Switzerland, in addition to the rights in Section 9 you may:

• ask us to identify the legal basis on which we process your personal data;
• object to processing based on our legitimate interests;
• object at any time to direct marketing, including profiling related to direct marketing;
• request information about the safeguards we use for international transfers;
• lodge a complaint with your local supervisory authority. A list of EU/EEA authorities is available at edpb.europa.eu. UK residents may contact the Information Commissioner's Office at ico.org.uk.

11.Additional Rights for California Residents

If you are a California resident, the CCPA/CPRA gives you the following rights, in addition to those in Section 9:

• Right to know the specific pieces and categories of personal information we have collected about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties to whom we disclose it.
• Right to delete personal information we collected from you, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising; if our practices change we will provide an opt-out mechanism via a "Do Not Sell or Share My Personal Information" link on the site.
• Right to limit use of sensitive personal information. We do not use sensitive personal information for purposes that would trigger this right.
• Right to non-discrimination for exercising any of your rights.

You may submit a request by emailing privacy@just-done.ai. You may also designate an authorized agent to act on your behalf, subject to verification.

For purposes of the CCPA/CPRA categories, in the prior 12 months we have collected: identifiers, customer records, commercial information, internet/network activity, geolocation (approximate, IP-based), and inferences drawn from the foregoing. We collect this information from you, your devices, and the third parties described in Section 3.7. Disclosure recipients are described in Section 6.

12.Additional Rights for Israeli Residents

If you are located in Israel, you have rights under the Protection of Privacy Law, 5741-1981 and its regulations, including the right to inspect personal information held about you in our database (Section 13 of the Law) and to request correction or deletion of inaccurate, incomplete, or outdated information (Section 14). Requests should be sent to privacy@just-done.ai. You may also lodge a complaint with the Israeli Privacy Protection Authority (Rashut Hahaganah Al Hapratiyut) at gov.il.

13.Cookies and Similar Technologies

We use cookies and similar technologies (collectively, "Cookies") to operate the site, keep you signed in, remember your preferences, and understand how the site is used so we can improve it. Strictly necessary Cookies are always active because the site cannot function without them. You can control Cookies at any time through your browser settings; disabling certain Cookies may affect how the site works.

The categories of Cookies we use are:

Strictly necessary Cookies do not require consent and are always set. We use analytics Cookies and similar storage (Google Analytics and Mixpanel) to measure how the site is used. We do not currently present a cookie banner; you can block or delete non-essential Cookies at any time through your browser settings. Some analytics events are sent by our servers rather than by your browser (Section 3.4); browser settings do not stop those, and you can object to them by writing to privacy@just-done.ai.

14.Security

We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These currently include encryption in transit (TLS), encryption at rest where appropriate, access controls and least-privilege principles, hashed password storage, regular backups, monitoring and alerting, and periodic review of our practices.

No system is completely secure. You are responsible for keeping your account credentials confidential, using a strong unique password, and enabling any available multi-factor authentication.

15.Data Breach Notification

If we become aware of a personal data breach that affects your personal information, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach, where required under GDPR Article 33 or analogous law, and we will notify affected users without undue delay where required under GDPR Article 34, the Israeli Privacy Protection Regulations (Data Security), 5777-2017, the CCPA/CPRA, or other applicable law. Notifications will describe the nature of the breach, likely consequences, and the measures taken or proposed to address it.

16.Automated Processing and AI

We use automated tools to detect fraud, abuse, and security risks, and to support certain operational and content workflows. We may also use artificial intelligence and machine-learning systems to assist with portions of the services.

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing without human involvement, except as necessary for entering into or performing a contract with you, where authorized by applicable law, or with your explicit consent. Where such processing occurs, you have the right to obtain human intervention, express your point of view, and contest the decision.

16.1 AI assistants, plugins and MCP connectors

Just Domain operates a Model Context Protocol (MCP) server at mcp.justdomain.ai. You can reach it through a connector you add to an AI assistant (for example ChatGPT or Claude) or to a coding tool (for example Cursor, VS Code or Kiro), or through the Just plugin for Claude Code (github.com/just-done/skills). The plugin runs no code of its own. It connects to this server and to the Just Publish server, whose handling of your information is described in the Just Publish privacy policy (justpublish.ai/privacy). When you ask the assistant about a domain, it sends the request to this server on your behalf.

No sign-in is needed, and we do not receive your conversation, your prompts or anything the assistant said. We receive the arguments of each tool call (the domain names, search text or name to check against trademark registers that the assistant sends) and what any web request carries: the network address and user agent of the device or service that made the request, the session identifier of the connection, and the name and version the assistant reports about itself.

• For each domain search, our product analytics provider (Mixpanel) receives the names checked, how many results came back and whether any was available or why the search failed, the session identifier, the assistant's name and version, and a pseudonymous identifier we create by hashing the network address and user agent of the request. The identifier does not show the address in readable form, but it is not anonymous.
• When a search fails, our error-monitoring provider (Sentry) receives the search text, the reason and the same identifier. It also receives technical data about failed requests and a sample of other requests, which can include the network address, the request headers and the content of the request.
• Our hosting provider and our server keep operational logs of requests (timestamps, request IDs, rate-limit counters, error traces).
• An availability lookup is forwarded to our registrar partner (Section 6.1).
• A trademark check is forwarded to Open Trademarks (opentrademarks.org), the trademark search service we run. Our server sends the name and any goods, classes or registers the assistant gave. It does not send your network address, your user agent or the session identifier.

For each available name, the server returns a link to justdomain.ai that carries the same identifier. Our site keeps it for that browser tab. When you open the link, our server also records the visit under the same identifier (Section 3.4). If you then sign in or create an account, our analytics links the searches recorded under that identifier to your account, including your email address and name. If you do not sign in, the identifier is not linked to an account.

We use this to operate and secure the service, fix failures, understand which assistants people use and measure whether a search leads to a registration. For people in the EEA, the UK and Switzerland, the legal basis is our legitimate interests (Section 5). To object, or to ask us to delete searches linked to an identifier, write to privacy@just-done.ai and include the value after "aid=" in a registration link so we can find them. Retention is set out in Section 8.

Payment is completed in your browser. The server offers three tools: one checks whether domain names are available and what they cost, one checks whether a domain you already own elsewhere could be transferred here, and one checks a name against the US, EU and Israeli trademark registers. All three are read-only, and the search tool returns a checkout link on justdomain.ai for each available name. To complete a purchase you open that link in your browser, review the order, sign in, and pay with Stripe, at which point the standard sections of this Policy apply (Sections 3, 4, 6).

The AI assistant you use has its own privacy policy that covers what it does with your chat before it talks to our MCP server. We are not responsible for the assistant’s policy. Please review it on the assistant’s own site.

17.Children

The services are intended for individuals 18 years of age or older. We do not knowingly collect personal information from children under 16 (or the equivalent minimum age in your jurisdiction). If you believe a child has provided us with personal information, please contact privacy@just-done.ai and we will take appropriate steps to delete it.

18.Third-Party Links

The site may contain links to third-party websites, including registrar websites, registry resources, and ICANN. We are not responsible for the privacy practices or content of those sites. This Policy applies only to information we collect.

19.Changes to This Policy

We may update this Policy from time to time, including to reflect changes to our services, our service providers, our business practices, or applicable law. When we update the Policy, we will revise the "Last Updated" date at the top of this document and post the updated Policy on the site. The updated Policy takes effect immediately upon posting unless a later effective date is stated.

Non-material changes. For non-material changes (including, without limitation, clarifications, corrections, formatting and structural updates, the addition, replacement, or removal of service providers within an existing category, expanded explanations of existing practices, changes to our business contact information, and updates required to comply with applicable law), we will not provide individual notice. The change becomes effective when posted, and you are responsible for periodically reviewing this Policy.

Material changes. Where we make material changes that significantly expand the categories of personal information we collect, introduce a materially new purpose for which we use it, materially change the parties with whom we share it, or materially reduce your rights, we will provide additional notice (for example, by email, an in-product notification, or a banner on the site) where and to the extent required by applicable law, with reasonable advance notice before the change takes effect.

Acceptance. Your continued use of the services after the effective date of any update to this Policy constitutes your acceptance of the updated Policy, to the fullest extent permitted by applicable law. If you do not agree with an update, you must stop using the services and may close your account.

20.Contact Us

If you have questions, concerns, or requests regarding this Policy or our privacy practices, please contact us:

You also have the right to lodge a complaint with a competent supervisory authority, as described in Sections 10-12.