Privacy Policy
Effective Date: October 29, 2026
Company: ISTIRIO LLC
Company Address: 75 E 3rd St, Sheridan, WY 82801, United States
Website: https://istanco.net/
Email: sladana@istanco.com
1. Introduction
This Privacy Policy explains how ISTIRIO LLC, operating under the ISTanCo brand (“ISTanCo”, “we”, “us” or “our”), collects, uses, shares and protects personal data when you visit https://istanco.net/ (the “Website”) or use our domain registration, domain-related, web hosting, email hosting and SSL certificate services (the “Services”).
ISTIRIO LLC is the controller of the personal data described in this Privacy Policy, except where we process data on behalf of our customers as described in Section 3.6. You can contact us about privacy matters at sladana@istanco.com or by post at ISTIRIO LLC, 75 E 3rd St, Sheridan, WY 82801, United States.
This Privacy Policy is designed to meet the requirements of applicable U.S. privacy laws and, where they apply to our processing, the EU General Data Protection Regulation (“GDPR”) and the UK General Data Protection Regulation (“UK GDPR”).
2. Scope
This Privacy Policy applies to personal data of website visitors, customers, domain registrants and their contacts, and persons who contact us, including persons who submit abuse reports or domain inquiries. It does not apply to third-party websites or services linked from the Website.
3. Personal Data We Collect
3.1 Account and Contact Data
When you create an account or place an order, we collect the information you provide, such as your name, company name, email address, postal address, telephone number and country, as well as your login credentials.
3.2 Domain Registration Data
When you register, transfer or manage a domain name, we collect the registrant, administrative, technical and billing contact details required by the relevant registry, as well as nameserver and other technical information. Some registries require additional information to confirm eligibility.
3.3 Billing and Payment Data
We collect billing information, invoices, payment records and transaction details.
- Card and other Stripe payments: payment card details are entered directly into the systems of our payment processor, Stripe. We do not store full card numbers. We receive limited information from Stripe, such as the payment status, the card type, the last four digits and the expiration date.
- ACH and wire transfers: we receive the information included in the transfer, such as the name of the account holder, the sending bank and the payment reference.
3.4 Support and Communications
When you contact us, open a support ticket or communicate with us by email, we collect the content of your communications and the contact details you provide.
3.5 Contact Form, Abuse Reports and Domain Inquiries
When you use our contact form, we collect your name, email address, the selected inquiry category, the domain name concerned, if any, and your message. For abuse reports, we also collect the information you provide about the reported content or activity.
If you submit a domain inquiry and confirm that we may contact the owner of a domain name on your behalf, we forward your name, email address and message to that domain owner.
3.6 Customer Content
Our hosting and email hosting Services store websites, databases, email messages and other content that our customers upload or send (“Customer Content”). Customer Content may contain personal data of third parties. We process Customer Content only on behalf of our customers and in accordance with their instructions, which are set out in our Terms of Service. For this processing, the customer is the controller and we act as a processor or service provider. Customers who require a data processing agreement may contact us at sladana@istanco.com.
3.7 Technical and Usage Data
When you use the Website or the Services, our systems record technical data such as your IP address, browser type, date and time of access, and log entries relating to login attempts and use of the Services. We use this data to operate the Services, ensure security and prevent abuse.
We use Plausible Analytics to measure general website traffic. Plausible does not use cookies, and it provides us only with aggregated statistics that do not identify individual visitors.
3.8 Cookies
We use only cookies that are necessary for the operation of the Website and the Client Area, such as session, login and security cookies. We do not use advertising or tracking cookies. More information is available in our Cookie Policy.
3.9 Data from Third Parties
We may receive personal data from registries and registrars (for example, domain status and transfer information), from our payment processor (for example, payment status and fraud prevention signals), from certificate authorities (for example, validation status) and from persons who submit abuse reports or legal requests concerning a domain name or hosted content.
4. How We Use Personal Data and Legal Bases
We use personal data for the purposes listed below. Where the GDPR or UK GDPR applies, we rely on the legal bases indicated.
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Creating and managing your account; providing, renewing and supporting the Services | Performance of a contract |
| Registering, transferring and managing domain names, including sharing data with registrars and registries | Performance of a contract; compliance with legal obligations and registry requirements |
| Issuing SSL certificates, including validation by certificate authorities | Performance of a contract |
| Billing, payment processing, invoicing and refunds | Performance of a contract; compliance with legal obligations |
| Sending service messages, such as order confirmations, invoices, renewal reminders and notices | Performance of a contract; legitimate interests |
| Responding to inquiries, support requests and domain inquiries | Performance of a contract; legitimate interests; consent for forwarding domain inquiries to domain owners |
| Handling abuse reports and enforcing our Terms of Service and Acceptable Use & Abuse Policy | Legitimate interests; compliance with legal obligations |
| Security, fraud prevention and protection of our systems and customers | Legitimate interests; compliance with legal obligations |
| Measuring website traffic in aggregated form | Legitimate interests |
| Keeping accounting and tax records and complying with legal requests | Compliance with legal obligations |
| Establishing, exercising or defending legal claims | Legitimate interests |
Where we rely on legitimate interests, our interests are operating and improving our business, keeping our Services secure and preventing misuse. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.
We do not use personal data for advertising profiling, and we do not send marketing messages without your consent where consent is required by law.
5. How We Share Personal Data
We do not sell personal data, and we do not share personal data for cross-context behavioral advertising. We share personal data only as described below:
- Registrars, registries and related bodies: domain registration data is shared with our accredited registrar partners and with the relevant registry and, where required by registry or ICANN policies, with ICANN and data escrow providers.
- Certificate authorities: information required to validate and issue SSL certificates is shared with the issuing certificate authority.
- Payment processors and banks: payment data is processed by Stripe and by the banks involved in ACH and wire transfers.
- Infrastructure providers: our hosting infrastructure is provided by Hetzner Online GmbH in Germany, which stores and processes data on our behalf.
- Email delivery providers: service providers that deliver email on our behalf, such as order confirmations and service notices.
- Analytics: Plausible Analytics, which processes website traffic data in aggregated form.
- Domain owners: if you request it through our contact form, your name, email address and message are forwarded to the owner of the domain name concerned.
- Professional advisors: lawyers, accountants and auditors, where necessary for legal, tax or accounting purposes.
- Authorities and other parties: courts, law enforcement authorities, regulators, dispute resolution providers and other parties, where required by law, by registry or ICANN policies, or where necessary to protect our rights, our customers or the public.
- Business transfers: a buyer or successor, in connection with a merger, acquisition or sale of all or part of our business.
Our service providers may use personal data only to provide services to us, except where they act as independent controllers, such as registries, certificate authorities and payment processors, which process data in accordance with their own privacy policies.
6. WHOIS and RDAP Directories
Registries operate public WHOIS and RDAP directories that display information about registered domain names. Depending on the policies of the relevant registry and applicable data protection law, some registrant data may be published in these directories. In many cases, personal data of individual registrants is redacted from public view, but it may be disclosed to parties with a legitimate interest, such as law enforcement authorities or rights holders, in accordance with registry and ICANN policies. More information is available in our Domain Registration Agreement.
7. International Data Transfers
ISTIRIO LLC is located in the United States, and personal data is processed in the United States. Our hosting infrastructure is located in Germany. Registries, registrars and certificate authorities are located in various countries, both within and outside the European Economic Area and the United Kingdom.
Where the GDPR or UK GDPR applies and personal data is transferred to a country that does not provide an adequate level of data protection, we rely on appropriate safeguards, such as the standard contractual clauses approved by the European Commission or the UK equivalents, or, where applicable, on the necessity of the transfer for the performance of a contract with you, for example when a domain name must be registered with a registry located outside the EEA or the UK. You can request more information about these safeguards by contacting us.
8. Data Retention
We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law. In particular:
- Account and service data: for as long as your account is active and for a reasonable period afterward to handle remaining questions, renewals, transfers and legal claims;
- Domain registration data: for the duration of the registration and for any period required by registry or ICANN policies;
- Billing and payment records: for the period required by applicable tax and accounting laws, generally up to seven (7) years;
- Customer Content: until the related Service ends, after which it may be permanently deleted 14 days after the Service ends, as described in our Terms of Service;
- Support communications, contact form submissions and abuse reports: for as long as necessary to handle the matter and for a reasonable period afterward, or longer where needed to establish, exercise or defend legal claims; and
- Technical logs: for a limited period required for security and operational purposes.
9. Data Security
We use reasonable technical and organizational measures to protect personal data, including encrypted connections (HTTPS), access controls and restriction of access to personnel who need it. Payment card data is processed by our payment processor and is not stored on our systems. No system is completely secure, and we cannot guarantee the absolute security of personal data. You are responsible for keeping your login credentials confidential.
10. Your Rights under the GDPR and UK GDPR
If the GDPR or UK GDPR applies to the processing of your personal data, you have the following rights, subject to the conditions and exceptions provided by law:
- Access: to obtain confirmation of whether we process your personal data and a copy of it;
- Rectification: to have inaccurate or incomplete personal data corrected;
- Erasure: to have your personal data deleted;
- Restriction: to restrict the processing of your personal data;
- Data portability: to receive personal data you provided to us in a structured, commonly used and machine-readable format;
- Objection: to object to processing based on legitimate interests;
- Withdrawal of consent: to withdraw consent at any time where processing is based on consent; and
- Complaint: to lodge a complaint with a data protection supervisory authority, in particular in the country of your residence or place of work.
Some rights may be limited where personal data is needed to provide the Services, to comply with registry or ICANN policies or legal obligations, or to establish, exercise or defend legal claims. For example, we cannot delete registrant data for an active domain name registration without cancelling the registration.
11. Privacy Rights for U.S. Residents
Depending on your state of residence, you may have rights under applicable U.S. state privacy laws, such as the right to know what personal data we process, to access, correct or delete it, and to obtain a copy of it. Where these laws apply to us, we will respond to your request in accordance with them. We will not discriminate against you for exercising your privacy rights.
We do not sell personal data, we do not share personal data for targeted or cross-context behavioral advertising, and we do not use sensitive personal data to infer characteristics about you.
12. How to Exercise Your Rights
To exercise your rights, contact us at sladana@istanco.com. To protect your data, we may need to verify your identity before responding, for example by asking you to send the request from the email address associated with your account. If you use an authorized agent, we may ask for proof that the agent is authorized to act on your behalf.
We respond to requests within the time limits required by applicable law. Under the GDPR and UK GDPR, we respond within one month of receiving the request, which may be extended where permitted by law.
13. Automated Decision-Making
We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Our payment processor may use automated fraud screening when processing card payments, which may result in a payment being declined. If your payment is declined and you believe this is an error, please contact us.
14. Children
Our Website and Services are intended for persons who are at least 18 years old. We do not knowingly collect personal data from children. If you believe that a child has provided personal data to us, please contact us, and we will delete it.
15. Third-Party Websites
The Website may contain links to third-party websites and services. We are not responsible for the privacy practices of those third parties. We recommend that you review their privacy policies.
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The updated version will be published on the Website with a new effective date. If we make material changes, we will notify our customers by email or through the Client Area.
17. Contact Us
If you have any questions about this Privacy Policy or our processing of personal data, please contact us:
- ISTIRIO LLC
- 75 E 3rd St, Sheridan, WY 82801, United States
- Email: sladana@istanco.com
- Website: https://istanco.net/
