Privacy policy

The controller is the entity identified in our legal details at the bottom of this page. Any request about your data can be sent to the contact shown there.

We collect only what we need to serve you and to keep our books. In practice:

Your account

• your email address, first name and last name;
• your password, never kept as such but as a cryptographic hash;
• your language and display currency;
• if you turn on two-factor sign-in: the matching secret, encrypted, and hashes of your recovery codes.

Your billing details

• name or company name, and where applicable your tax identification number;
• postal address, city, region, postal code and country;
• email address and telephone number.

Your orders and services

• what you ordered, at what price, in which currency, with the tax applied;
• what setting up the service requires: the domain name concerned, and the answers you give when configuring an offer;
• your invoices and the status of your payments.

Technical data

• your IP address and browser, recorded when a session opens and in your account's security history (sign-in, password change, session revoked);
• the country inferred from your IP address, used to suggest a display currency.

• To perform the contract: create and maintain your account, handle your orders, set up and renew what you bought.
• To keep our accounts and meet our invoicing obligations.
• To write to you about your services: order confirmation, service ready, renewal notice, incident.
• To keep the platform secure: spot unusual access, limit abuse, let you see and revoke your sessions.
• To answer your support requests.

We do not use your data for targeted advertising, and we sell it to nobody.

Your data goes only where serving you requires:

• Domain name registries and registrars. Registering a domain means passing on the holder's details; depending on the extension's rules, some of them may be published in a public directory anyone can consult.
• Certificate authorities, to issue an SSL certificate.
• Infrastructure operators hosting the services you order.
• Our payment provider, which handles the transaction.
• Our email delivery service, to send you messages about your account and orders.
• Authorities, where the law requires it.

Each of these third parties sees only the data its own part of the job requires.

Some of our suppliers — domain registries, certificate authorities, infrastructure operators — are established abroad. Ordering a service they provide necessarily means the corresponding data leaves Cameroon.

• Your account data, for as long as the account exists.
• Invoices and the accounting data attached to them, for the period the applicable tax and accounting rules require.
• Your account's security history and session log, for a limited period meant to let you spot unusual access.
• Data passed to a domain registry follows that registry's rules, which are not ours to set.

Closing your account does not erase invoices already issued: the law requires us to keep them.

• Traffic to the site and the API is encrypted in transit.
• Passwords are never stored in clear: we keep a hash computed with an algorithm designed for the purpose.
• Two-factor secrets are encrypted in the database, under a key that is not in the database.
• Your sessions can be revoked at any time from your client area, one by one or all the others at once.
• Our own staff accounts that reach the back-office require two-factor sign-in, and every action they take is logged.

No system is infallible. Should a security incident affect your data, we would tell you.

At any time you may:

• view and correct your account and billing details from your client area;
• ask for a copy of the data we hold about you;
• ask for your account to be deleted, subject to what we must keep for accounting or contractual reasons;
• object to a processing activity, or ask that it be restricted;
• revoke your open sessions and change your password.

To exercise a right that your client area does not cover, write to the contact shown at the bottom of this page. We answer within a reasonable time and may ask you to prove who you are.

We use no advertising cookie, no third-party tracker and no external analytics tool. The only cookies set are the ones the site needs to work:

• ch_session: keeps you signed in. Set when you sign in, removed when you sign out.
• ch_locale: remembers the language you chose.
• ch_currency and ch_currency_detected: remember your display currency, chosen or inferred from your country.
• ch_cart: keeps your cart between visits.
• ch_color_mode: remembers the light or dark theme.
• ch_sidebar_collapsed: remembers whether your client area's side menu is collapsed.

None of these follow you from one site to another. You can delete them from your browser; the site keeps working, but you will have to sign in again and make some choices again.

Our services are meant for people able to enter into a contract. We do not knowingly collect data about minors. If you believe we have, write to us and we will delete it.

This policy changes as the platform does. The date it last changed is shown at the top, and we tell you about any significant change in the way your data is handled.