Who Owns Your Website, Domain and Client List?

- Ask what you could take today without help, not who would win an argument about ownership.
- A registrar must release your AuthInfo code within five calendar days of your request.
- A billing dispute is explicitly not a valid reason to withhold your domain transfer.
- Transfer the domain FIRST, then change the registrant; the reverse triggers a 60-day lock.
- Export the booking data and client list tonight. Access beats an ownership argument.
"Who owns it" is the wrong question, because it invites a legal answer to what is really an operational problem. The question that predicts whether you get hurt is narrower and much easier to answer: what could you take with you today, without anyone's cooperation? Go asset by asset and answer that honestly, and the legal argument mostly evaporates, because in practice possession is the thing that decides how a bad ending goes. There are eight assets worth checking and the whole audit takes about an hour. The domain has a published recovery mechanism with actual deadlines that most guides do not know exists, including a rule that your registrar cannot hold your transfer code hostage over a billing dispute. If the question you actually have is what the contract should have said, that is a separate piece about the agreement.
| Asset | Check | Bad answer |
|---|---|---|
| Domain | Public registration record | Anyone's name but yours |
| Website admin | Log in right now | You do not have a login |
| Copy and photos | Is there a signed assignment? | No written transfer exists |
| Ad accounts | Whose business account holds them | The agency's |
| Business Profile | Are you listed as an owner | Manager only, or not listed |
| Booking system | Export your bookings now | No export, or no login |
| Client list | Download it today | It lives only in their tool |
| Business name | Search the trademark register | Somebody else registered it |
Why is "who owns it" the wrong question?
Because ownership and control come apart, and control is what matters in the week you want to leave. You can own something legally and still be unable to reach it, and the practical difference between those two states is a lawyer and several months.
Think about how these situations actually unfold. Almost nobody ends up in court over a guide website. What happens is that somebody wants to leave, discovers they cannot log in to something, asks for access, and then either gets it in a week or spends two months negotiating for it during their booking season. The legal answer and the outcome are only loosely connected.
So the audit below asks a different question of each asset: not who would win an argument about it, but whether you could walk away with it this afternoon. That is answerable in about a minute per asset, and it converts an anxious hypothetical into a short list of things to fix.

Asset one: the domain name
The single most important one, and the one with the clearest recovery path. Look up the public registration record and see whose name and email are on it. If they are not yours, that is the first thing to fix, and there is a published process with deadlines that works in your favour.
Domains sit at the top because everything else attaches to them: your website, your email, your listings. Losing a domain does not just cost you a website, it costs you every link anybody ever made to you and the address printed on your truck.
The good news is that the recovery mechanism is standardised and the rules are public. Under ICANN's Transfer Policy, the registered name holder and the administrative contact are the only parties with authority to approve or deny a transfer. Your registrar must give you the unique AuthInfo code and remove the transfer-prohibited status within five calendar days of your request, if they do not offer a way for you to generate and manage that code yourself.
The clause worth memorising is the one about billing disputes. The policy states that a registrar must not refuse to release your AuthInfo code or lift the transfer lock solely because there is a payment dispute, and that transfer processes must not be used as a mechanism to secure payment. That closes off the most common threat.
How do you actually move a domain back?
Request the transfer code, move the domain to your own registrar account, and only then change the registrant details. That order matters, because doing it the other way round triggers a sixty-day lock that stops you moving anything.
ICANN's policy spells this out explicitly, and it is the single most useful operational detail on this page. A registrar must impose a sixty-day inter-registrar transfer lock following a change of registrant, unless you were given and took an opt-out. The policy therefore directs registrars to advise a prior registrant that if the goal is to move to a different registrar, they should request the transfer first and change the registrant afterwards.
Two other sixty-day windows exist and are worth knowing so you are not surprised: a transfer can be denied within sixty days of the domain's creation date, and within sixty days of a previous transfer. None of these are anyone being obstructive. They are anti-hijacking measures, and they are the reason to start this process in your quiet season rather than the week you need it done.
One more provision helps you. If the losing registrar fails to respond within five calendar days to the registry's notification about a transfer request, the default outcome is that the transfer is approved. Silence works for you rather than against you.
Asset two: the website files and the admin login
Try to log in right now, without asking anyone. If you cannot, you do not control your website, whatever the contract says and whoever paid for it. That is an access fact, not a legal one.
The check takes thirty seconds and guides put it off for years. Open the admin address for whatever your site is built on and see whether your credentials work and whether your account has full permissions rather than editor-level access to a few pages.
If it is built on a hosted platform, the account itself is the asset, and the question is whose email is the account owner. A site built inside an agency's platform account is a site you are a guest on, which is a different situation from one built in your account with them added as a collaborator. Which platform it happens to be matters far less than that distinction, as covered in the platform comparison.
Asset three: the copy, the design and the photographs
This is the one with a genuine legal answer rather than an access answer, and it runs against most people's instinct: paying for creative work does not transfer its copyright. It moves only by a signed written assignment.
Rather than repeat that argument here, the mechanics of why, and the exact sentence to ask for, are worked through in the piece on agreements. What belongs in this audit is the check: is there a signed document that assigns the work to you, and can you put your hand on it?
Meanwhile, take the practical step regardless of the paperwork. Download the photographs at full resolution and keep your own copies of the written pages. That costs nothing, takes an hour, and means a dispute about rights is not simultaneously a dispute about whether you still have the files at all.
Your own trip photographs are a special case worth protecting deliberately, because they are irreplaceable in a way copy is not. Keep the originals somewhere you control, which is also the argument in the piece on photos that book clients.
Asset four: the ad accounts and their history
Check whose business account the ad accounts sit in. The account matters more than the campaigns, because the history inside it carries your conversion data, and starting fresh means paying again for a learning period you already funded.
The right structure is that the accounts belong to your business account and the agency is granted access as a user. The wrong one is an agency account running campaigns on your behalf, where leaving means leaving everything behind, including the data that made the campaigns work.
This is worth raising even in a healthy relationship, because fixing it is administrative while everyone is friendly and adversarial afterwards. Why that accumulated history has real value is a mechanical point covered in the timeline article.
Asset five: the Google Business Profile
Open the profile and check whether you are listed as an owner rather than a manager. Managers can be removed by owners; owners cannot be removed by managers. If an agency holds the only ownership, they hold the listing that produces much of your local enquiry volume.
Google publishes a process for transferring primary ownership, and it is worth walking through rather than assuming. The common bad state is not malice, it is that somebody claimed the listing years ago with whatever email was handy and nobody revisited it.
Fix it by having the current owner add you as an owner, then transfer primary ownership. Do it before you need it. A listing you cannot edit is a listing where your hours, your phone number and your season cannot be corrected, and those go wrong at exactly the worst time of year.
Asset six: the booking system and its data
Log in and export your bookings today. If there is no export, or you have no login, your operating history lives somewhere you cannot retrieve it from, and that is a bigger exposure than the website.
Booking data is the most underrated asset on this list. It is your record of who fished with you, when, on what, and what they paid. It is the raw material for every piece of marketing that actually works for a guide business, and it is the thing most likely to be locked inside a vendor tool.
Run the export once and keep the file. Then run it again at the end of every season. Two minutes, twice a year, and it converts a dependency into a copy you hold.
Asset seven: the client list and the email list
The test is whether you can download it in the next five minutes. Not whether you would win an argument about who owns it, which is a genuinely unsettled question that varies by state and by contract, but whether the file is in your hands tonight.
Be careful with confident claims here, including from people selling you services. Who owns customer data as a legal matter depends on facts, agreements and jurisdiction, and no verified general answer applies to every guide business. That uncertainty is precisely why the access test is the useful one: a list you have already downloaded is not subject to anybody's interpretation.
So download it, from every system that holds one: the booking tool, the email platform, your phone contacts. Keep it somewhere you control. Then keep doing it, because the value of the list is exactly its recency.
Where the list lives long term is worth deciding deliberately too, and an email platform tied to your own domain is far easier to move than one tied to an address you do not control, which is part of the argument in the piece on business email.

Asset eight: the business name itself
Search the federal trademark register for your name and anything close to it. Most guide businesses operate on an unregistered name, which is normal and carries real but limited rights. The exposure is somebody else registering a mark you have been using.
The USPTO's trademark basics is the place to start understanding what a registration does and does not give you. This is the asset guides think about least and it is genuinely the least urgent of the eight, which is why it is last rather than absent.
Do the search anyway, because it is free and occasionally alarming. Trademark law is fact-specific and rules do get revised, so if the search turns up something close to your name, that is a conversation with a lawyer rather than something to resolve from a web page.
The one-hour audit
Do all eight tonight, in order, writing down one word for each: yours, theirs, or unknown. Unknown counts as theirs until proven otherwise. Most guides finish with two or three in the wrong column and are surprised by which ones.
Do it while nothing is wrong. Every one of these is administrative to fix in a good relationship and a negotiation in a bad one, and the moment you mention leaving is the moment the cost of each fix goes up.
Tell whoever you work with what you are doing and why, plainly. A shop that has done this before will help you fix the columns without any drama, because clean custody is easier for them too. A shop that becomes defensive has answered a question you did not have to ask directly, and that reaction belongs on the same list as the other things worth checking.
What if the answers are bad?
Fix them in order of how hard they are to recover, not how much they bother you. Domain first, because everything hangs off it and it has the clearest process. Then accounts and listings. Then the copyright paperwork, which is the slowest and the least urgent operationally.
Ask for each one specifically and in writing, one at a time, framed as tidying up rather than as a prelude to anything. "Can you add me as an owner on the Business Profile" is a request most people say yes to. "I am reviewing our arrangement" is a request that gets a lawyer involved.
If you meet real resistance on the domain specifically, the transfer policy is your backstop and it is worth reading before you escalate, because knowing the five-day rule and the payment-dispute clause changes how the conversation goes. Policies do get updated, so read the current version rather than relying on the summary here.
What do experienced guides do differently?
They register the domain themselves before hiring anybody, they create the ad accounts and the listing under their own name from the start, and they export the booking data every season as a habit rather than a response.
Doing it at the start costs nothing. Every one of these is trivial to set up correctly and moderately annoying to correct later, and the correction always seems to become urgent in July. Fifteen dollars a year and half an hour at setup removes the entire category.
The second habit is treating access as separate from trust. Granting an agency full access to accounts you own is normal and sensible; letting them own the accounts is a different thing that feels the same in a good relationship. Guides who have been through one bad ending never conflate the two again, and it is one of the questions on the pre-hire list.
What are the common mistakes?
Letting somebody else register the domain as a convenience. Assuming that paying for something transferred it. Changing the registrant before transferring the domain, which locks it for sixty days. And doing this audit only after deciding to leave.
The convenience mistake is how almost every bad case starts, and nobody involved intends anything. Somebody offers to handle the domain, it is one less thing, and the record quietly says their name for the next six years.
The sequencing mistake is the one that costs real time. Updating the registrant details first feels like the natural first step and it triggers a sixty-day transfer lock, which is a bad thing to discover in April. Move the domain first, then update the details.
What surprises people?
That a registrar must release your transfer code within five calendar days. That a billing dispute is explicitly not a valid reason to withhold it. That changing your own registrant details can lock the domain for sixty days. And how many of the eight assets they could not actually reach tonight.
The billing-dispute clause surprises people most and it is the one to keep in your back pocket. The policy is direct that transfer processes must not be used as a mechanism to secure payment, so the threat that most guides fear turns out to be the one thing that is clearly not allowed.
The audit result itself is the bigger surprise. Guides who are confident going in typically find two or three unknowns, usually the Business Profile and the ad accounts, and usually because a listing was claimed years ago by somebody who has since left. It is rarely sinister and it is always worth an hour. Other pieces on hiring and living with an outside shop are collected under marketing help.
What this audit does not settle
Who legally owns your client list. That depends on facts, contracts and state law, and no verified general answer exists. Which is exactly why the test here is whether you can download it tonight.
Your copyright position. Assignment is a real legal question handled in the agreements article, not an access question. Keep copies of the files either way.
A dispute already underway. This is a before-anything-goes-wrong audit. Once there is a live disagreement, the transfer policy still protects your domain, but the rest is a conversation with a lawyer.
If your booking calendar has more open weeks than you’d like, I’ll build you a free preview of your booking site before you pay a cent.
Get a free website previewCustody, asset by asset
Can my agency refuse to give me my domain?
Not over money. ICANN's Transfer Policy states that a registrar must not refuse to release your AuthInfo code or lift the transfer lock solely because there is a payment dispute, and that transfer processes must not be used as a mechanism to secure payment. It also requires the code to be released within five calendar days of your request where the registrar does not let you generate it yourself.
What is an AuthInfo or EPP code?
The unique per-domain code that authorises moving a domain from one registrar to another. Your registrar must provide it, and remove the transfer-prohibited status, within five calendar days of your request if they do not give you a way to generate and manage it yourself. It identifies you as the holder; a separate authorisation form confirms the transfer itself.
Why is my domain locked for 60 days?
Most likely because the registrant details were changed. A registrar must impose a sixty-day inter-registrar transfer lock after a change of registrant unless you were offered and took an opt-out. There are two other sixty-day windows: within sixty days of the domain being created, and within sixty days of a previous transfer. All three are anti-hijacking measures.
Who owns my client list?
That depends on facts, agreements and state law, and no verified general answer covers every guide business. Which is why the useful test is not legal but practical: can you download it in the next five minutes? A list already in your hands is not subject to anyone's interpretation. Export it from every system that holds one, and do it again each season.
What if the agency built the site on their own account?
Then you are a guest on your own website, whatever the invoice says. Check whether you can log in right now with full permissions rather than editor access to a few pages. Fix it by having the site moved into an account owned by your email, with the agency added as a collaborator. Do it while the relationship is good, because it is administrative now and a negotiation later.
Do I own my business name?
Operating under an unregistered name carries real but limited rights. Search the federal trademark register for your name and anything close to it; it is free and occasionally alarming. Trademark law is fact-specific and gets revised, so if the search turns up something similar, that is a conversation with a lawyer rather than something to settle from a web page.
What should I check first?
The domain, because everything else attaches to it and losing it costs you every link anyone ever made to you. Look up the public registration record and see whose name and email appear. Then work through the other seven: website admin, copy and photos, ad accounts, Business Profile, booking system, client list, and the business name.
Sources & methods
- ICANN Transfer Policy: five-day AuthInfo release, the payment-dispute prohibition, the 60-day locks, and the advice to transfer before changing registrant
- Google Business Profile: transferring primary ownership of a listing
- USPTO trademark basics: what a registered mark gives you, for the business-name question
Every figure here is traced to a named public source and checked against it. Licensing, tax, and fee rules change. Verify your state’s current rules with the agency directly before you count on any number here.
More field notes
Run the eight checks tonight.
I'm Evan. Driftline sets the domain, the accounts and the listing up in your name at the start, so this audit is boring when you run it. Free preview first.
