Privacy Policy

1. Introduction

Dotto ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our domain marketplace service.

By using Dotto, you consent to the data practices described in this policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

2.1 Personal Information

We collect information that you provide directly to us, including:

• Account Information: Name, email address, password
• Profile Information: Profile picture, bio, company name
• Transaction Information: Billing address, payment method details
• Communication Data: Messages sent through our platform, support inquiries

2.2 Automatically Collected Information

When you use our Service, we automatically collect certain information:

• Usage Data: Pages viewed, time spent on pages, click data
• Device Information: IP address, browser type, operating system
• Cookies and Tracking: We use cookies and similar tracking technologies (see Section 6)

2.3 Information from Third Parties

We may receive information about you from:

• Payment processors (Stripe)
• Authentication providers (if using social login)
• Domain registrars (for transfer verification)

2.4 Record of the Emails We Send You

When we email you, we keep a record of it. Each record holds the address we sent to, the subject line, what kind of message it was (an order confirmation, a reminder, a receipt), the order or offer it relates to, the time we sent it, and what our email provider (Resend, listed in section 4.2) later told us about whether it arrived.

We keep this so that when you ask us what happened with an order we can answer from our own records, and so we can see when a message does not reach you. We do not store the contents of the email or the links inside it. Our order emails carry a link that opens your order without a password, and a stored copy of that link would outlive the message it was written for.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Service
• Process transactions and send transaction confirmations
• Send you technical notices, updates, and support messages
• Respond to your comments, questions, and provide customer service
• Monitor and analyze trends, usage, and activities
• Detect, prevent, and address technical issues and fraudulent activity
• Generate AI-assisted content, brand assets and insights you ask for (see 4.3)
• Personalize and improve your experience
• Send you promotional communications (with your consent)
• Comply with legal obligations

4. How We Share Your Information

We may share your information in the following circumstances:

4.1 With Your Consent

We may share your information with your explicit consent.

4.2 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Payment processing (Stripe)
• Cloud hosting (Vercel, Supabase)
• Email delivery (Resend)
• Phone verification (Twilio)
• Analytics (Google Analytics, Ahrefs)
• Error monitoring (Sentry)
• AI features (OpenAI, Google) — see 4.3 below
• Bot protection on our public forms (Cloudflare Turnstile) — your IP address is sent to Cloudflare so it can tell a person from an automated script
• Internal team notifications (Slack) — when you make an offer or place an order we send our own team a message containing your name, email address and the amount, so a person can act on it
• Domain data and valuations (GoDaddy) — the domain name is sent so we can show registration details and an estimated value
• Search and keyword data (DataForSEO) — the domain name and related search terms; no personal information is sent

4.3 AI Features

Some features are built on AI services run by OpenAI and Google, both based in the United States. When you use one, the information that feature needs is sent to the provider so it can generate a response. In practice that means:

• Domain content, logos, audio and business plans — the domain name and the descriptive details you enter about it.
• The seller assistant and seller reports — information about your own listings and how they are performing: domain names, prices, offer amounts and statuses, view counts. We deliberately do not send the names, email addresses or written messages of people who make offers on your domains.

We do not send payment card details, passwords or phone numbers to these providers, and we do not use them to make automated decisions about you.

4.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4.5 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities.

4.6 To Protect Rights and Safety

We may disclose information when we believe it is necessary to protect the rights, property, or safety of Dotto, our users, or others.

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information. These include:

• Encryption of data in transit and at rest
• Regular security audits
• Access controls and authentication
• Secure payment processing through PCI-compliant providers

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and store information about your interactions with our Service.

Types of Cookies We Use:

• Essential Cookies: Required for the Service to function properly
• Analytics Cookies: Help us understand how users interact with our Service
• Preference Cookies: Remember your settings and preferences

You can control cookies through your browser settings. Note that disabling cookies may affect the functionality of our Service.

7. Your Rights and Choices

You have the following rights regarding your personal information:

7.1 Access and Portability

You can request a copy of your personal information in a structured, commonly used format.

7.2 Correction

You can update or correct your account information at any time through your account settings.

7.3 Deletion

You can request deletion of your account and personal information. Note that we may retain certain information as required by law or for legitimate business purposes.

7.4 Opt-Out of Marketing

You can opt out of our marketing emails at any time by clicking the unsubscribe link in the footer of any of them, by using your email app's own unsubscribe button, or by contacting us. It takes effect immediately and you do not need an account or a password to use it.

We will still send you messages about things you are actually doing on Dotto: an offer you have made or received, a domain you have bought, the steps needed to transfer it, reminders about a step we are waiting on from you, receipts, and answers to requests like this one. These are part of the transaction rather than marketing, so they are not covered by the unsubscribe link and we do not offer one on them — if we did, a sale could stall without anyone telling you. Under the Spam Act 2003 (Cth) these are not commercial electronic messages.

7.5 Do Not Track

Our Service does not currently respond to Do Not Track signals.

8. Data Retention

We retain your personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. When we no longer need your information, we will securely delete or anonymize it.

The record of the emails we send you, described in section 2.4, has no automatic expiry. We keep it for as long as your account is open, because it is how we answer questions about an order after the fact, and we delete it when we carry out a deletion request under section 7.3.

9. International Data Transfers

Dotto is based in Australia, but several of the providers listed in section 4.2 store or process information outside Australia — most of them in the United States. That includes Stripe, Vercel, Supabase, Resend, Twilio, Sentry, Google, OpenAI, Cloudflare, Slack, GoDaddy and DataForSEO. Those countries have different data protection laws from Australia. Where Australian Privacy Principle 8 applies, we remain accountable for how these providers handle information we disclose to them. By using the Service you consent to these transfers.

10. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

Email: privacy@dotto.com.au
Phone: 1300 0 DOTTO

13. Australian Privacy Principles

As an Australian business, we comply with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). You have the right to make a complaint to the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the APPs.