Privacy notice

Who we are

The responsible party is 3L Group Consulting (Pty) Ltd.

• Operator: 3L Group Consulting (Pty) Ltd, a private company registered in South Africa
• Registration number (CIPC): 2019/038018/07
• VAT number: 4420289102
• Director: Christo Fourie
• Registered office and physical address: 55 Blanc de Noir Street, Bellville, Cape Town, 7530, South Africa
• Email: api@3l-groupconsulting.co.za
• Website: https://domainref.dev

Information Officer: Christo Fourie, 3L Group Consulting (Pty) Ltd (contact api@3l-groupconsulting.co.za).

What we process, why, and on what basis

• The domain you submit. Used only to run the check you asked for (POPIA section 11(1)(b): needed to perform the service you requested). The DomainRef app does not write it to a database or log. It sits in memory caches for up to 60 seconds (DNS answers) and 1 hour (registry answers), then is gone from DomainRef. Only aggregate counts are kept (number of checks, letter grades). The request URL, which contains the domain, is in our firewall log for about 6 months (see below).
• Your IP address and request. Used for rate limiting and abuse prevention, which is our legitimate interest in keeping the service secure (section 11(1)(f)). Rate-limit buckets are held in memory only. Our access log records the time, host, path without the query string, status, user agent and a hashed or truncated IP.
• Payment data. An x402 or MPP payment carries your wallet address and is settled on the public Base blockchain through the Coinbase Developer Platform facilitator. On-chain payments are public and permanent: anyone can see them and nobody, including us, can delete them. An API key identifies the key's account.

Voluntary or required

Giving a domain is voluntary, but we cannot run a check without one. Paying by x402 or MPP necessarily reveals your wallet address. If you do not want that, do not pay by those rails.

Domains you check usually belong to others

We use only public records: public DNS, the registry's public RDAP service and the domain's public certificate and MTA-STS policy (collected from public records, POPIA section 12(2)(a)). Registration results show the registrar's name and IANA ID only. Registrant and contact data from the registry are discarded unread and never returned. We keep no results.

Who receives information

Answering means asking others about the domain. The lookup providers receive the domain name and never learn who asked:

• Cloudflare public DNS (1.1.1.1) and Google Public DNS, which answer the DNS-over-HTTPS lookups.
• Microsoft (login.microsoftonline.com), for Microsoft 365 tenant detection.
• The domain's registry, through its RDAP service listed by IANA.
• The domain's own servers, on port 443 only: the website certificate, and the MTA-STS policy on mta-sts.<domain> when one is published.

Others see more:

• Cloudflare, as our CDN, necessarily sees your IP address and the full request, including the queried domain, and keeps its logs under its own retention.
• Our firewall (Sophos, in Johannesburg) logs web server usage and protection events, including the full request URL, and keeps those logs for about 6 months.
• Coinbase (Developer Platform facilitator) verifies and settles x402 and MPP payments and sees the payment, including your wallet address.
• Telegram carries sale notices to our operators: route, price, buyer type, a shortened wallet address and a link to the public transaction, never the queried domain. Telegram's servers are outside South Africa.

How long we keep it

• Queried domains: The DomainRef app does not store queried domains; our firewall log keeps request URLs (with the domain) for about 6 months. In the app they sit in memory caches only (60 seconds and 1 hour, as above).
• Firewall logs (web server usage and protection events, with request URLs): about 6 months.
• Access log: The access log goes to the server's system logs. The syslog copy is rotated weekly and the last 4 rotations are kept, so about 5 weeks. The system journal has no age limit and is capped by size: older lines are dropped as it fills, and it currently reaches back about 9 weeks.
• Payment and sale records (date, route, amount, wallet address and transaction): kept for 5 years for tax and accounting, as the Tax Administration Act 28 of 2011 requires. The on-chain payment itself is public and permanent.

Cookies, tracking and safeguards

No cookies, and no analytics or tracking scripts, on domainref.dev. The pages run no script at all.

Safeguards (section 19): the service is reachable only over HTTPS behind a web application firewall, the app holds the domain in memory only, IP addresses are hashed or truncated before they are logged, registry contact data is discarded unread, and access to the server is limited to the operator.

Cross-border transfer

Cloudflare, Google, Microsoft, Coinbase and Telegram operate outside South Africa, mainly in the United States and Europe, and registries sit in many countries. These transfers are needed to perform the check and payment you asked for (POPIA section 72(1)(c) and (d)).

Your rights

You may ask what personal information we hold about you, and ask us to correct or delete it, or object to its processing, by writing to api@3l-groupconsulting.co.za.

You may also complain to the Information Regulator (South Africa). It asks for complaints through its eServices portal: eservices.inforegulator.org.za. Or write to POPIAComplaints@inforegulator.org.za. General enquiries: enquiries@inforegulator.org.za, 010 023 5200, toll-free 0800 017 160. Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Website: inforegulator.org.za.