Privacy

Privacy notice

Last updated: 17 October 2026

Who we are

AlphaOscar, 6 rue d'Armaillé, 75017 Paris, France, VAT number FR47910288299, processes your data. Registrar Domains is a service of AlphaOscar. Write to privacy@alphaoscar.fr for any question about your data.

What we collect

• Your account email, and the time of each sign-in.
• The registrant's contact data for each domain: name, company, postal address, phone, email.
• The email you type when you pay, and the payment reference from Stripe. We never see your card number. Stripe keeps the card you save for automatic renewal; we store nothing of it, only the time you saved a card.
• The orders, invoices, domains, API keys (only a hash of each key) and connected apps of your account.
• The activity log of each domain: what changed (DNS records, nameservers, transfer lock, transfer code shown, renewals), when, and who did it (you on the web, a key by its label and id, or a connected app by its name and id).
• Which renewal reminders we sent for each domain, so each one goes out once.
• Your IP address, in server logs and in the limits that stop abuse.

Why

• To register and keep your domain, and to send the registrant data the registry requires: the contract with you.
• To send sign-in links and run your account: the contract with you.
• To email the account owner order confirmations, renewal reminders 30 and 7 days before a domain expires, and a notice when the nameservers change or a transfer code is shown: the contract with you, and the security of your domains.
• To keep the activity log, so you can see who changed a domain: the security of your domains, our legitimate interest.
• To keep accounting records of each sale: a legal obligation.
• To stop abuse, spam and fraud: our legitimate interest.

Who receives it

• Openprovider (Hosting Concepts B.V., the Netherlands), our accredited registrar, and the registry of the extension: the registrant data, as every registration requires.
• Stripe: the payment, the invoice for each paid order, and the card you save for automatic renewal.
• Amazon SES, through our mail service: your email address, to send sign-in links, order emails, renewal reminders and security notices.
• Cloudflare: hosting of this site and its data.

Some of these companies process data outside the European Union, under the European Commission's standard contractual clauses.

Public WHOIS and RDAP records show each domain's dates, registrar and nameservers. For a registrant who is a person, the name, address, phone and email are redacted from the public record by the registries and our registrar; a company's name can be published. A court or a rights holder with a legitimate reason can ask the registrar or the registry for the hidden data.

How long

• Orders and invoices: 10 years, for French accounting law.
• Sign-in codes: 1 day.
• When you ask for a sign-in link with items in your basket, we keep a copy of those domain names with the request for up to about 1 day, or until you sign in, when they move to your account basket.
• Sessions: 30 days after the last use, or until you sign out.
• The activity log and the record of reminders sent: as long as your account exists.
• The registrant data at the registry: as long as the domain exists, under the registry's own rules.
• A Cloudflare API token you link, to move a domain's DNS to Cloudflare for you: stored encrypted, never shown again and never logged. We delete it as soon as the move is done, unless you chose to keep Cloudflare linked for other domains; then we keep it until you unlink it. You can unlink it at any time on the Connect page, and it is deleted with your account. Delete the token in Cloudflare too.

Your rights

You can ask to see, correct, delete or export your data, and you can object to a use of it. Write to privacy@alphaoscar.fr. We answer within one month. Data we must keep by law, such as invoices, stays until its period ends. You can also complain to the CNIL, the French data protection authority, at cnil.fr.

Cookies

One cookie keeps you signed in, and a second one tells the pages to show "Dashboard" instead of "Sign in". Both are necessary for the service and need no consent. There is no advertising or tracking cookie.