Privacy policy

[Company name] ЕООД, UIC (EIK) [EIK], with its registered office at [Registered address], Bulgaria (“we”, “us”), is the controller of the personal data described in this policy.

Write to us at support@dragon.business about anything in this policy, including to use your rights.

Your visits to dragon.business, your account, what you buy from us and what you write to us.

It does not cover the data you host with us: your websites, apps, servers and mailboxes, and what they hold about your own visitors and customers. For that data you are the controller and we act on your instructions, under Data you host in our terms. The companies that help us host it are listed in Companies that help us host your data.

Your account. Your email address, which is how you sign in: we email you a one-time code. We keep when the account was opened and when you last signed in. A code is stored only in a form that cannot be turned back into the code, together with the internet (IP) address it was asked for from, so that guessing can be stopped.

What you order. The plan, the names and addresses we give your services (such as yourname.dragon.business), your server’s IP address, its operating system, the design you chose and any SSH public key you give us. Login details for a new service are kept only until we have emailed them to you.

Domain names. The owner’s contact details: name, company if any, email address, phone number and postal address. The registrar and the registry need them to register a domain in the owner’s name. For a transfer, we also keep the transfer code. The names you search for are sent to the registrar to check whether they are free and what they cost.

Email. Your domain, the mailbox addresses and the display names you choose. The mail itself is data you host (see What this policy covers). When you sign in to webmail at webmail.dragon.business, your password passes through our server on its way to our email provider; we neither store nor log it.

Payments. You pay through Link, Stripe’s merchant-of-record service. Link collects your payment details, billing address and VAT information and is responsible for them under its own privacy policy. We receive a customer reference, what was paid for, and whether a payment succeeded, failed or was refunded. We never see your card number.

What you write to us. Through the contact form: your name, email address, phone number if you give it, your message, and the IP address it came from, which we use to stop the form being flooded. The message reaches our mailbox, as does any email you send us.

A record of activity. What happens to your account and orders (an order paid, a mailbox added, a DNS record changed, a cancellation), with the IP address where there is one. It keeps the services secure and lets us sort out what happened if something is disputed.

Visiting the site. We use no analytics, advertising or tracking of any kind, and our web server keeps no log of visits. Our own systems log what they do with orders, including order names and email addresses, so that we can find and fix faults.

To provide what you order and to run your account: the contract with you, including the steps you ask for before ordering (Article 6(1)(b) of the General Data Protection Regulation, GDPR).

To keep accounting and tax records, follow the rules of registrars and registries and answer lawful requests from authorities: our legal obligations (Article 6(1)(c)).

To keep the services secure, prevent fraud and abuse, answer people who are not customers yet and defend legal claims: our legitimate interests (Article 6(1)(f)), which we weigh against yours. You can object to these (see Your rights).

We send no marketing email, so we never ask for your consent to it.

We do not sell your data. We share it only with the providers who help us run the services, under contracts that require them to protect it:

1. Contabo GmbH (Munich, Germany): servers, including the one that runs this site and holds our database;
2. Hetzner Online GmbH (Gunzenhausen, Germany): servers for the plans built on it;
3. Hosting Concepts B.V., trading as Openprovider (Rotterdam, the Netherlands): domain registration, DNS, and email hosting, including our own mailbox. For email it uses Google Cloud, in the European Union, for the mailboxes, and Amazon SES for sending;
4. Resend, Inc. (San Francisco, USA), sending from the European Union: the emails our services send you;
5. Cloudflare, Inc. (San Francisco, USA): DNS for the addresses we give your services.

Link and Stripe receive your payment details as controllers in their own right. Their policies: Link and Stripe.

A domain owner’s contact details go through the registrar to the registry that runs the extension, which may be outside the European Economic Area (for .com, in the USA). Under their rules, some details may appear in the public WHOIS or RDAP directory; for individuals, most registries hide the personal ones.

Courts and authorities, when the law requires it, and our accountants and lawyers, who are bound by confidentiality.

Our servers and our database are in the European Union. Resend and Cloudflare, and Google and Amazon behind our email provider, are American companies, and Link and Stripe work worldwide. Where data leaves the European Economic Area, we rely on an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework for companies certified under it, or on the Commission’s standard contractual clauses.

Registering a domain with a registry outside the European Economic Area needs its owner’s details to go there; that transfer is necessary for the contract you asked for (Article 49(1)(b) GDPR).

Ask us for a copy of the safeguards that apply.

Your account, until you delete it. A sign-in lasts up to 30 days, and a one-time code, with the IP address it was asked from, is deleted a day after it expires.

Orders stay as the record of what was sold. When you delete your account, your email address, contact details, your services’ addresses and the names made from your email address are removed from them.

Domain contact details, for as long as the domain is with us. We keep a record of which version of our terms you accepted for at least two years after a domain leaves us, as the registrar requires; the registrar and the registry keep their own records under their rules.

IP addresses in the record of activity, for 12 months. The record of a message sent through the contact form is deleted after 12 months; the message itself, for as long as we need it to deal with what you wrote about.

Payment records are kept by Link and Stripe for as long as tax and accounting law requires.

Our system logs and backups are overwritten as newer ones replace them.

We set one cookie, session, when you sign in, to keep you signed in. It lasts up to 30 days, or until you sign out. The site cannot work without it, so it needs no consent.

Your choice of light or dark, and the country whose VAT our prices show, are remembered in your browser’s own storage and never sent to us. Until you choose a country, your browser guesses it from your device’s time zone and language, on the device itself. The installable app keeps nothing about you.

There are no analytics, advertising or other third-party cookies, and our fonts come from our own server. Webmail sets its own cookie to keep you signed in to it.

You have the right to see the data we hold about you, to have it corrected, deleted or restricted, to receive it in a portable form, and to object to what we do on the basis of our legitimate interests.

In your account, Download gives you a copy of your data, and Delete my account deletes it, once nothing you bought is still running (the page lists what has to end first).

For anything else, write to support@dragon.business. We answer within one month; the GDPR lets us take two more for complex requests, and we tell you if we need them.

You may complain to the Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg) or to the authority in the EU country where you live or work.

For the data you host with us (see What this policy covers), these are the sub-processors that Data you host in our terms refers to:

1. Contabo GmbH (Munich, Germany): the machines for WordPress Economy, VPS and the app platform, in Germany;
2. Hetzner Online GmbH (Gunzenhausen, Germany): the machines for the plans built on it, in Germany or Finland;
3. Hosting Concepts B.V., trading as Openprovider (Rotterdam, the Netherlands): mailboxes, and DNS for domains registered with us;
4. Google Cloud, for Openprovider: the servers that hold the mailboxes, in the European Union;
5. Amazon SES (Amazon Web Services), for Openprovider: sending mail out from the mailboxes;
6. Cloudflare, Inc. (San Francisco, USA): DNS for the addresses we give your services;
7. Resend, Inc. (San Francisco, USA), sending from the European Union: the emails our services send about them.

The control panels, Enhance for WordPress Economy and Coolify for the app platform, are software that runs on those machines; their makers do not hold your data.

We publish changes to this list here before they take effect and tell customers by email, so that you can object as the terms describe.