Privacy notice

1. Controller

Lorentzen Smart Labs (Norwegian organisation number 936 215 149), Skonnertveien 2, 4077 Hundvåg, Norway, is the controller for Puffin Domains' accounts, purchases, support, security and product operations. Contact us about privacy at hello@puffindomains.com or +47 953 01 143. Realtime Register processes registrant data when supplying registrar services.

2. Data we process

We process account and registrant contact data, order and payment references, domains and DNS settings, and operational and security logs. Puffin Mail also requires mailbox addresses, forwarding destinations, subscription status and technical setup data. Mail content is held by the mail provider, not in Puffin's domain database. Stripe processes card data, which Puffin Domains does not store. Norwegian national identity numbers must not be stored in the domain core.

3. Purposes and legal bases

Contract data is used to create accounts, quote, register and manage domains, collect payment and provide support. Accounting data is kept for legal obligations. Necessary security and troubleshooting may rely on documented legitimate interests. The limited AI support pilot processes questions, answers and relevant domain facts to respond to a support request; the conversation is stored as support history. Do not submit passwords or other secrets. Consent-based marketing is optional and revocable.

4. Recipients

Necessary data is shared with the sponsoring registrar and registry, Stripe, Supabase, Vercel, Resend, and OpenSRS when you use Puffin Mail or forwarding. In the limited AI support pilot, messages and a restricted domain summary pass through Vercel AI Gateway to the model provider. Data may also be shared with services you explicitly connect. Authorities and dispute bodies receive data where legally required. Registration data may appear in RDAP/WHOIS or be disclosed under applicable policy.

5. Transfers outside the EEA

Some suppliers or sub-processors may process data outside the EEA. An adequacy decision or EU standard contractual clauses may provide a lawful transfer basis. Contact us for details of processing locations and safeguards applicable to the service you use.

6. Retention

Account and domain data is used while the account or domain is active. After a service ends, we must separate data that can be erased from purchase evidence, registration records and data the registrar or registry requires. Primary accounting documentation is normally retained for five years after the end of the accounting year. Support history and security logs need separate, documented deletion periods.

Open unpaid carts expire after two hours of inactivity. Drafts not linked to a payment or domain operation are deleted no earlier than 30 days after expiry, including for signed-in users. The same applies to expired quotes that have not been used. Cleanup runs in bounded daily batches.

A complete retention schedule and automatic deletion are not yet finished. You may ask us to review and erase data no longer needed, although legally required records and data for an active domain may have to remain. We will update this notice when the periods and deletion mechanisms are set.

7. Your rights

You may request access, correction, erasure, restriction and portability, object to legitimate-interest processing, and withdraw consent. Some data must remain for legal duties or an active domain. Complaints may be made to the Norwegian Data Protection Authority.

• Norwegian Data Protection Authority

8. Security and changes

We use access controls, encrypted transport, event logging, least privilege and supplier oversight. Material incidents are handled and notified under applicable rules. Material notice changes will be communicated and prior versions retained internally.

9. Cookies and local storage

Puffin Domains does not use its own advertising or visitor analytics cookies. We use technical storage needed for sign-in, the cart and secure connection of services you choose. The anonymous cart ID in your browser lasts up to two hours. Connecting Vercel uses a security cookie for up to ten minutes. Sign-in cookies follow the session and identity provider's rules.

During checkout and mail forwarding setup, form drafts may be stored temporarily in browser session storage so an unfinished action is not lost. This is not advertising or visitor measurement. Stripe is loaded for card payments only after you start payment. Stripe may then use cookies such as m, __stripe_mid and __stripe_sid for fraud prevention and secure payment. Stripe controls their lifetime and may use other cookies if you choose its own payment services. See Stripe's Privacy Center for details.

• Stripe Privacy Center