Your data, in plain words

01 Who we are

“DohoHub”, “we”, “us” and “our” refer to the team that operates the DohoHub website at dohohub.com — an independent monitor that tracks hosting and domain-registrar prices, uptime and deals. This policy covers the public website, the developer API, and the accounts and provider-cabinet areas that sit behind it.

If you only browse the site — reading provider pages, comparisons, deals or news — you can do so without an account and without giving us any personal information. Everything below is about the moments when data is actually created.

02 What we collect

Information you give us

• Newsletter signup. If you subscribe to price-drop alerts, we store your email address, the page you signed up from, and a unique unsubscribe token. That’s it — no name required.
• Contact form. When you write to us, we store the name, email, subject and message you enter (and email a copy to our team) so we can reply and keep a record of the conversation.
• Provider / registrar submissions. If you list a company, we store the business details you enter (company info, services, pricing pages, links) and any screenshots you upload. This is business data intended for publication, plus a contact so we can reach you about the listing.
• Accounts. If you register, we store your email and a securely hashed password (we never keep the password itself), plus anything you add to your profile or provider cabinet.
• Payments. If you buy a paid plan (for example API access or a promoted listing), your card / payment details are entered directly with our payment processor — we receive a confirmation and a record of the amount and status, not your card number.
• Reviews, ratings and price alerts. If you leave a review, cast a ▲/▼ vote, or set a price alert, we store that input (and, for alerts, the email you want the alert sent to).
• Questions to the AI advisor. If you use the “Ask” assistant, the text of your question is sent to an external model provider so it can be answered (see “Who else receives data”). We don’t store your questions or answers on our side, and we don’t attach them to your account — please don’t type personal or confidential details into it.

Information collected automatically

• IP address. Your IP is used to rate-limit requests and prevent abuse. It is stored alongside a few actions that are prone to spam — a newsletter signup, a contact message, and a community vote — so we can moderate and de-duplicate them.
• Server & error logs. Like any web server, ours records requests and errors (including IP and browser user-agent) for security, debugging and keeping the service up.
• Anonymous vote de-duplication. When a signed-out visitor votes on a provider, we derive a one-way hash of your IP and browser so the same visitor can’t vote twice. The hash isn’t used to identify you or build a profile.
• Outbound click counts. Links to a provider’s or registrar’s site go through dohohub.com/go/… so we can count how many people used them and from which page. We store the same one-way hash of your IP and browser (to count one visit per day rather than every click), the page you clicked from, and the date — no cookie is set and the destination is never told who you are. The hash can’t be reversed into your IP, and we don’t link these counts to your account.
• Listing view counts. We count how many people see a company’s listing: when a provider card has been at least half on screen for a second, or when you open a provider page, your browser sends us the id of that listing and which page it was on — nothing else. Visits are de-duplicated with the same kind of one-way hash of your IP and browser as above, using a secret that changes every day, so the value can’t be traced back to you or followed across days. No cookie is set, nothing is stored in your browser, the counts are never linked to your account, and if your browser sends a “Do Not Track” signal we don’t count you at all. What we keep is a daily total per listing per page — the de-duplication record itself is deleted after 90 days.
• Cookies & local storage. Only the essential ones — detailed in the next section.

03 Cookies & local storage

The cookies we set are only what the site needs to function — no analytics or social-media tracking cookies of our own. Google’s advertising code (see “Who else receives data”) sets its own cookies under Google’s policy.

Two things that commonly do use cookies elsewhere don’t here: our listing view counter and our outbound click counter both work without one (see the previous section) — there is nothing for you to accept or reject, because nothing is stored on your device.

Google’s advertising, bot-protection and web fonts (see “Who else receives data”) may set their own cookies when their scripts load; those are governed by Google’s policies, not ours.

04 How we use it

• Run the things you asked for — send the price-drop digest you subscribed to and the price alerts you set, operate your account and provider cabinet.
• Publish listings — review, moderate and publish the provider/registrar submissions and reviews people send us.
• Reply to you — answer contact messages and support requests.
• Take payment — process paid plans through our payment processor and keep a billing record.
• Keep the site safe and working — rate-limiting, bot protection, CSRF protection, and error logs for debugging.
• Show prices in your currency — remember your currency and theme so the site behaves the way you left it.
• Report audience to listed companies — we tell a provider, in aggregate, how many people saw their card, opened their page and clicked through to them. They see counts and which page produced them; they never see who you are, because we don’t know either.
• Answer your questions — if you use the AI advisor, your question is sent to a model provider together with data from our own catalogue so it can reply.

We do not use your data to build advertising profiles ourselves — Google’s advertising code works under Google’s policy — and we make no automated decisions that have legal or similarly significant effects on you.

05 Legal bases

For visitors in the EU, UK and EEA, we rely on the following legal bases under the GDPR:

• Consent — for the newsletter (which you can withdraw at any time via the unsubscribe link).
• Performance of a contract — to run your account and to provide and bill any paid plan you buy.
• Legitimate interests — to operate, secure and improve the service, to prevent spam and abuse, and to remember your display preferences. We balance these against your rights.
• Legal obligation — where we must keep certain records (for example, of payments).

06 Who else receives data

We don’t sell or rent your personal data. A small number of processors and destinations receive data strictly to make a feature work:

• Payment processor — Stripe. When you pay, your payment details go directly to Stripe, which acts as an independent controller of that payment data under its own Privacy Policy. We store only the amount, currency and status.
• Cryptocurrency payments — Boxcoin (self-hosted) and blockchain lookups. If you pay in cryptocurrency, the payment page is served from our own payment system, Boxcoin, at pay.dohohub.com. We generate the wallet address and store the amount, the cryptocurrency and the payment status. To verify that a payment arrived, our server checks the public blockchain through a blockchain data API (currently Tatum, Privacy Policy). The only information involved is the wallet address and the transaction itself — both already public on the blockchain. We never receive or store card data for cryptocurrency payments.
• Google reCAPTCHA. Some forms (sign-up, sign-in, password reset, add-a-provider and contact) are protected by reCAPTCHA v3 when it’s enabled. Google’s script runs in your browser and we send your IP address to Google to score whether the request is automated. This is subject to Google’s Privacy Policy and Terms.
• Advertising — Google AdSense. The site displays advertising served by Google AdSense. Google’s script runs in your browser and may read or set advertising cookies and collect data about your visit (including your IP address) to select, deliver and measure ads. This is subject to Google’s Privacy Policy and advertising rules. Where the law requires it, personalised advertising only runs with your consent, which you can manage in the consent screen shown on your first visit. We pass no data about you to advertisers ourselves.
• Google Fonts. Our pages load web fonts from Google’s font servers, which may log your IP as part of serving those files.
• Domain availability search. When you check a domain name, that name is sent to our domain data provider and/or resolved against public DNS and WHOIS to check whether it’s available. Don’t put personal information into the domain search box.
• Outbound & affiliate links. When you click “Visit site”, you leave DohoHub for a provider or registrar — sometimes via an affiliate link that tells them the visit came from us. The click passes through our own /go/… address first, purely so we can count it (see “Outbound click counts” above); the destination comes from our database, never from the link you clicked. We don’t pass them your personal data; once you’re on their site, their own privacy policy applies.
• AI model provider — DeepSeek. The “Ask” advisor is answered by an external large-language-model service, currently DeepSeek (deepseek.com). Our server sends it the text of your question plus the catalogue data needed to answer it, and returns the reply to you. We do not send your IP address, your browser identity or your account details — the request goes from our server, not from your browser. What the provider does with the text is governed by their own policy; treat anything you type there as leaving DohoHub. We may change provider, and this line changes with it.
• Email delivery. Digests, alerts and account emails are sent from our own mail server (or a configured mail relay).

We may also disclose information if we’re legally required to, or to protect the rights, safety and security of DohoHub, our users and the public.

07 What we never do

08 How long we keep it

• Newsletter email — until you unsubscribe (there’s a one-click link on every email). After that we keep the unsubscribe record so we don’t email you again.
• Contact messages — while we handle your request and for a reasonable period afterwards for our records.
• Account & provider data — for as long as the account exists; delete it or ask us and we remove it (published, factual listing data may remain where it’s part of the public catalogue).
• Payment records — kept as long as needed for accounting and legal obligations.
• Counting records — the de-duplication records behind listing views and outbound clicks (the one-way IP/browser hashes) are deleted after 90 days. What remains is daily totals per listing and per page, which contain no personal data and are kept as long as the listing exists.
• AI advisor — we keep no record of your questions. A daily counter that limits how many questions one visitor may ask holds only a one-way hash and resets every day.
• Logs & caches — web-server access and error logs (which include IP and user-agent) are rotated weekly and kept for up to 12 months for security, debugging and traffic statistics, then deleted. The traffic reports we generate from them are aggregated and have IP addresses anonymised. Technical caches (such as domain-check results) expire automatically.

09 Your rights

Depending on where you live, you can ask us to:

• Access the personal data we hold about you, or get a copy of it.
• Correct anything that’s wrong, or delete your data.
• Withdraw consent — unsubscribe from the newsletter (one click, on every email) or object to a particular use.
• Restrict or port your data where the law provides for it.

To exercise any of these, email contact@dohohub.com or use the contact form. We’ll respond within a reasonable time. EU/UK/EEA visitors also have the right to complain to their local data-protection authority.

10 Security

We protect data with measures appropriate to its sensitivity, including:

• Encrypted connections (HTTPS) across the site.
• Passwords stored only as bcrypt hashes, never in plain text; programmatic access uses revocable API keys instead of your password.
• CSRF tokens on forms and rate limiting against abuse.
• Uploaded images are stored with server-side code execution disabled in the upload directory, and the admin area sits behind authentication.

No system is perfectly secure, but we work to keep the attack surface small and to fix issues quickly. If you believe you’ve found a vulnerability, please tell us at contact@dohohub.com.

11 Children

DohoHub is a tool for buying and selling hosting and domains; it isn’t directed at children. We don’t knowingly collect personal data from anyone under 16. If you believe a child has given us data, contact us and we’ll delete it.

12 International visitors

DohoHub is operated for an international audience. Your data may be processed on our servers and by the processors named above, which can be located in countries other than your own. Where that involves a transfer of personal data, we rely on the processor’s own safeguards and applicable legal mechanisms.

13 Changes to this policy

We may update this policy as the site evolves or the law changes. When we do, we’ll revise the “last updated” date at the top; for material changes we’ll make the update more prominent. Continuing to use DohoHub after a change means you accept the updated policy.

14 Contact

This policy is written to describe how the DohoHub platform actually handles data. It isn’t legal advice; for a formal data-processing agreement or questions about a specific jurisdiction, get in touch.