Privacy policy
The TLD Project is developed, owned, maintained and managed by Unlimited Application Ltd. This Privacy Policy explains how Unlimited Application Ltd collects and uses personal data when you visit The TLD Project website or use its services.
1. Who we are
The TLD Project (“the Service”, “we”, “us”, “our”) is operated by Unlimited Application Ltd, a company registered in England and Wales under company number 15913087, whose registered office is at 86–90 Paul Street, London, EC2A 4NE.
We are registered with the Information Commissioner’s Office under registration number ZB905560.
Unlimited Application Ltd is the controller responsible for the personal data described in this privacy policy. We handle personal data in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended.
If you have questions about how we handle your personal data, or believe it may have been compromised, please contact us using the details in section 14.
2. What personal data we collect
We collect and process the following categories of personal data:
Account and identity data
- Your name and email address, provided at registration.
- Your account credentials, managed via AWS Cognito. We do not store passwords in plaintext.
- Any information you provide when contacting us.
Service usage data
- The domain names you register for monitoring (Core Domains and Owned Domains).
- Alerts, findings, cases and Complaint Reports generated through your use of the Service.
- Actions taken within the Service, such as promoting a finding to a case or sending a Complaint Report.
- Account activity timestamps used to manage your service relationship.
Payment data
- Payments are processed by Stripe. We receive confirmation of payment and a Subscription identifier. We do not store your full card details.
Technical data
- Your IP address and browser type, collected automatically when you access the Service.
- Session data necessary to maintain your logged-in state.
Communications data
- Records of correspondence between you and us, including support requests and emails.
3. How and why we use your data
We process your personal data only where we have a lawful basis to do so under the UK GDPR.
To provide the Service — contract performance
We use your account data, domain data and usage data to operate the monitoring service, generate Alerts and Complaint Reports, and deliver the Service you have subscribed to.
To process payments — contract performance
We share necessary data with Stripe to process your Subscription payment and manage renewals.
To contact you about your account — contract performance and legitimate interests
We will contact you about your Subscription, renewal notices, Alerts and service matters. Where we do so beyond the strict performance of the contract, our lawful basis is our legitimate interests in maintaining the service relationship.
To send re-engagement communications — legitimate interests
Where your account has been inactive and you have unreviewed threat findings, we may contact you to draw these to your attention. Our lawful basis is our legitimate interests in ensuring you are aware of potential threats to your brand. You may not opt out of these communications while your Subscription is active, as they are directly related to the service you have paid for. This is documented in our Terms of Service section 10.
To improve the Service — legitimate interests
We may use aggregated and anonymised data about detections, patterns and service performance to improve the Service. This data does not identify you.
To comply with legal obligations — legal obligation
We retain financial and transaction records for the period required by HMRC and applicable tax law.
Marketing — consent
We will only send you marketing communications where you have given explicit consent. You may withdraw consent at any time by contacting us at theteam@thetldproject.com.
4. Data about third-party domain registrants
In operating the Service, we process publicly available information about third-party domain registrants, including data obtained from WHOIS and RDAP registries, DNS records, certificate transparency logs and other public sources. This data may include the names, email addresses and contact details of individuals or organisations who have registered domain names.
Our lawful basis for processing this data is our legitimate interests and your legitimate interests in identifying and acting against domains that may be impersonating your brand.
Where you use this data — for example by reviewing an Alert or submitting a Complaint Report — you act as an independent data controller in respect of that use. You are responsible for ensuring your use complies with the UK GDPR and any other applicable data protection law.
We do not use third-party registrant data for any purpose other than operating the Service for you. We do not sell, share or commercialise it.
5. Cookies and technical identifiers
Public website
Our public website uses Complianz to manage cookie preferences. Our website Cookie Policy explains which cookies and similar technologies are used, their purposes and how long they remain on your device.
Where consent is required, you can accept or reject these technologies through the cookie banner and change or withdraw your consent through the website’s cookie preference controls.
Customer application
Our customer application is separate from the public website. It uses authentication and session technologies to verify your identity and maintain secure access to your account.
The public website’s cookie preferences do not control technologies used within the customer application.
Disabling technologies necessary for authentication may prevent you from signing in or using account features.
6. Who we share your data with
We share your personal data only where necessary and only with the following:
Infrastructure and payment providers — contract and legitimate interests
- Amazon Web Services (AWS): our hosting, database, email delivery and content delivery infrastructure. AWS processes data on our behalf as a data processor under a Data Processing Agreement. Data is processed in the eu-west-2 (London) region.
- Stripe: payment processing. Stripe receives data necessary to process your Subscription. Stripe’s own privacy policy governs their handling of payment data.
Legal and regulatory
- We may disclose personal data to law enforcement, regulators or courts where required by law, or where we have a good-faith belief that disclosure is necessary to protect our legal rights or the safety of others.
We do not sell your personal data. We do not share it with advertisers or data brokers. We do not share it with any other third parties without your explicit consent except as described above.
7. How long we keep your data
We retain your personal data only for as long as necessary for the purpose for which it was collected, or as required by law.
Operational service data
Alerts, findings, cases, Complaint Reports and domain records are retained while your Subscription is active. On Subscription expiry or domain deletion, this data remains accessible for 30 days and is then deleted, in accordance with Terms of Service section 10.4.
Account data
Your account (name, email, credentials) is retained while your account is open. On account closure, account data is deleted within 30 days, subject to the financial records period below.
Financial and legal records
Transaction records, invoices and related financial data are retained for seven years from the date of the transaction to meet applicable accounting and tax record-keeping requirements. Where a legal requirement requires longer retention, we retain the relevant records for that longer period. These records are retained independently of whether your account remains open.
Correspondence
Support emails and other correspondence are retained for up to 3 years for quality assurance and dispute resolution purposes, then deleted.
8. Your rights under UK GDPR
You have the following rights in relation to your personal data:
- Right of access: you may request a copy of the personal data we hold about you (Subject Access Request).
- Right to rectification: you may ask us to correct inaccurate or incomplete data.
- Right to erasure: you may ask us to delete your personal data. We will do so unless we are required by law to retain it (for example, financial records under HMRC rules).
- Right to restrict processing: you may ask us to restrict how we use your data in certain circumstances.
- Right to data portability: you may ask us to provide your data in a portable format.
- Right to object: you may object to processing based on legitimate interests.
- Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please email theteam@thetldproject.com. We will respond within one calendar month as required by UK GDPR. There is no charge for reasonable requests.
Identity verification for Subject Access Requests
To protect your data, we will verify your identity by confirming ownership of the email address registered to your account. We will not routinely require physical identification documents for online requests.
Right to complain
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.
9. Data security
We take appropriate technical and organisational measures to protect your personal data, including:
- All data transmitted between your browser and our servers is encrypted using TLS.
- Account access is protected by AWS Cognito authentication.
- Infrastructure is hosted on AWS in the eu-west-2 (London) region.
- Access to production systems is restricted to authorised personnel only.
No system is completely secure. If you suspect your account or personal data has been compromised, please contact us immediately at theteam@thetldproject.com.
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you without undue delay.
10. International data transfers
Your personal data is primarily stored and processed within the United Kingdom, on AWS infrastructure in the eu-west-2 (London) region.
Where data is processed outside the UK (for example, by Stripe for payment processing), we ensure appropriate safeguards are in place, including Standard Contractual Clauses or reliance on UK adequacy regulations, as applicable.
11. Children
The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at theteam@thetldproject.com and we will delete it promptly.
12. Do not track
The Service does not currently respond to browser Do Not Track (DNT) signals, as there is no industry-standard interpretation of what DNT requires. We do not use third-party advertising or tracking networks.
13. Changes to this privacy policy
We may update this Privacy Policy from time to time. The current version is always published at thetldproject.com and identified by the version number and date at the top of this document.
For material changes, we will notify you by email or through the customer portal at least 30 days before the change takes effect.
If you do not accept a material change, you may close your account by contacting us at theteam@thetldproject.com.
14. Contact us
For any questions, requests or complaints relating to this Privacy Policy:
Email: theteam@thetldproject.com
Post: Unlimited Application Ltd, 86–90 Paul Street, London, EC2A 4NE
ICO registration: ZB905560
Company registration: 15913087 (England and Wales)
