Who actually owns your restaurant’s website?

The moment this usually comes up

It is the day before a holiday and you need to change your hours. Or a customer says the menu online is two prices out of date. Or you are selling the restaurant and the buyer’s lawyer asks a question you cannot answer.

So you go to change it, and you cannot. And then you realise you are not entirely sure who can.

Maybe there was a guy. A friend of a friend, a nephew, a marketing company, an employee who was good with computers. He set it all up years ago because you were busy running a restaurant, which is a full-time job that does not leave much room for administering DNS records. He did a decent job. Then he moved, or got busy, or stopped answering, or quietly went out of business.

Almost none of this starts with anyone behaving badly. It starts with somebody being helpful on a Tuesday in 2019. The problem is not usually a villain. It is unclear ownership, discovered at the worst possible time.

This article is the audit you can do before that happens.

Your website is not one thing

This is the part almost nobody explains, and it is the reason people get stuck.

When you say “my website”, you are talking about at least five separate assets. They can be owned or controlled by five different parties. You can hold some completely and none of the others.

A useful way to hold it in your head: the domain is your address, the website account is the building, the design is the fit-out, the Google profile is the sign on the road, and the photos are how it looks in the pictures. You can rent a building. You should not have to give up your address to leave it.

Access, control and ownership are different

Before you check anything, one distinction that will save you a lot of confusion.

Access means you have a login. It feels like ownership and it is not. You may be able to edit a page but not remove the person who built it.

Control means you can change the billing, add and remove administrators, move the asset somewhere else, or end the relationship without asking permission. This is the level that actually matters in practice.

Ownership is what a contract, a registration record or copyright law says. It is the level people assume they have because they paid an invoice.

Most restaurant owners have level one and believe they have level three. The audit below is really about finding out where you sit.

1. Who controls your domain?

Start here, because the domain is one of the most important digital assets the restaurant holds. Most other things can be rebuilt. Your address is what every printed menu, business card, Google listing, delivery app and returning customer points at.

The party who registers a domain and enters the registration agreement with the registrar is the registrant. The registrar is the company where it lives — GoDaddy, Namecheap, Squarespace Domains and so on.

Now, a correction to advice you will find everywhere else. Most articles tell you to do a WHOIS lookup and see who owns it. That advice is out of date, and only partly wrong, which is worse.

As of 28 January 2025, ICANN made RDAP the definitive source for generic top-level domain registration data, and WHOIS was sunset for most gTLDs. There is an important exception that happens to matter enormously to restaurants: .com, .name and .post still require WHOIS. So if you are on a .com — and you almost certainly are — the old tools have not vanished. But the tool you should actually use is ICANN Lookup, which is RDAP-based.

Here is the second thing nobody tells you: the lookup probably will not name the owner. Privacy rules mean registrant details are frequently redacted. You will usually see the registrar, not the person.

Which is fine, because the registrar is what you actually needed. The real test is not what a database says. It is this:

• Can you log in to the registrar account yourself?
• Do renewal notices arrive at an email address the restaurant controls?
• Can you change the nameservers or DNS?
• Can you renew it without asking anyone?
• Can you unlock it and get the transfer code?
• Is the payment card on that account yours?

If the answer to most of those is “my web guy handles that”, you have found something worth resolving. Not necessarily something sinister — just a critical business asset that currently depends on somebody else remembering to renew it.

Domains do not usually get stolen. They get forgotten, and then they expire.

What if someone else registered it?

First: this is common and usually fixable. Second: do not start yanking things at random, because domain transfers have rules that will bite you.

The practical mechanics for most generic domains:

• The domain has to be unlocked before it can move.
• You need an authorisation code (AuthInfo or EPP code). ICANN requires registrars either to let you generate it yourself or to provide it within five calendar days of your request.
• 60-day locks exist. They can apply after an initial registration, after a previous transfer, and after certain changes to the registrant details.

That last one is the trap. If you change the registrant name and email and then try to move registrars, you can lock yourself out of your own transfer for two months. Work out the order of operations before you change anything.

Worth noting that this is not a fringe concern invented by web designers. Toast’s own documentation tells restaurants that if a third-party website company owns or manages their domain, they should find out whether it can be transferred into the restaurant’s own account — and that if it cannot, buying a different domain may become necessary. When your POS provider is telling you to check who owns your domain, it is a real issue.

2. Who controls the website account?

Owning your domain does not mean you control the website itself. These are separate questions and the answers are often different.

Whatever the site is built on — Toast Websites, Squarespace, Wix, WordPress, Webflow, something custom — the questions are the same:

• Whose account is the website under?
• Who receives the invoices, and on whose card?
• Can you add and remove administrators?
• Could you export the content if you needed to?
• What happens, concretely, if that company stops answering next month?

Here is the thing worth saying plainly: “we rent the platform” is a perfectly healthy answer. You are not supposed to own a web server. Renting software is normal and sensible.

Own your domain. Rent the software.

Platforms come and go. Your restaurant’s address on the internet should outlive all of them. If you own the domain, changing platforms is a project. If you do not, it can mean starting your entire digital identity from zero.

3. Who owns the design and the files?

This is where we are going to be more careful than most articles in this space, because the honest answer is less flattering to people who sell websites.

Paying for something does not automatically mean you own the copyright in it. Under US copyright law, copyright generally belongs to the creator from the moment the work is made, unless the rights were transferred in writing or the work qualifies as a “work made for hire” — and for commissioned work that requires a signed written agreement, plus the work has to fall into specific statutory categories.

So “I paid for it” and “I own every component of it” are two different statements. Sometimes both are true. You find out by reading the agreement, not by remembering the invoice.

Questions worth asking, ideally before the project rather than after:

• Does the restaurant receive ownership of custom work, or a licence to use it?
• Are templates, stock assets or third-party components excluded?
• Can you get the files you would need to move elsewhere?
• What happens to all of that when the agreement ends?

We are not lawyers and this is not legal advice. The point is narrower and more useful: know which of the two you have. A licence can be completely fine. Not knowing is what causes the problem.

Does a more expensive website mean you own more of it?

No. Price and ownership are almost entirely unrelated, which surprises people.

A restaurant can spend five figures and still find the domain is registered to the agency, the platform account is in the agency’s name, the photography is licensed rather than owned, and the Google profile lists the agency as primary owner. A restaurant can spend very little and be structured cleanly, with everything in its own accounts.

The invoice tells you what you paid. The accounts, the contract and the registration records tell you what you got.

While we are on money, the related question is worth asking out loud: what is this website supposed to actually do for the business? Not as a philosophical exercise — as a number you can sketch on the back of a napkin before you spend anything.

The return does not have to come from one place. It can be direct orders instead of marketplace commission, catering enquiries, private events, reservations, people finding the right hours instead of driving to a closed restaurant, or simply more of the people already considering you deciding to come. Some of that is measurable and some of it honestly is not.

But you should be able to say, before you spend the money, what the site is meant to accomplish commercially. A website that cannot articulate how it earns its keep is decoration. That is true at $1,000 and it is true at $50,000.

4. Your agency should not own your restaurant on Google

This one is not our opinion. Google is unusually direct about it.

A Business Profile has owners and managers. Only owners can add and remove users, and there is one primary owner. Google’s guidance to third parties is explicit: when an agency creates or works on a profile for a client, the business owner should be the owner and the agency should be the manager. Google tells agencies to ask to be added as a manager, not an owner.

And Google goes further. Its third-party policies specifically prohibit keeping a profile hostage in exchange for money, and also prohibit threatening a client that they will lose their profile if they do not sign up.

You can quote that at anybody who resists. It is Google’s rule, not a negotiating position.

To check where you stand: Business Profile → settings → People and access. Look at who is listed as primary owner, who else is an owner, who is a manager, and whether anyone on that list left the business years ago. Google recommends separate accounts for each person rather than a shared password, which also means you can remove one person without locking everyone out.

If someone else holds it, there is a formal route. An authorised owner can find the business through Google’s claim flow and choose Request access. The current holder gets three days to respond. If they do not, you may get the option to claim and verify it yourself — and we want to be accurate here: Google says that option is not always available. It is a real process, not a guarantee.

If your listing is in worse shape than that, we wrote separately about why your restaurant might not be showing up on Google Maps, and about setting the profile up properly.

5. Who owns the photographs?

Restaurants live on photography, and this is the asset owners are most surprised by.

By default, the person who takes a photograph owns the copyright in it from the moment the shutter closes. That stays true unless the rights were transferred, or the shoot qualified as a work made for hire under the specific legal conditions that requires. Paying the invoice is not, by itself, the thing that transfers copyright.

Most of the time this never becomes an issue, and a usage licence is perfectly workable. It becomes an issue when the restaurant is rebranding, changing hands, or wants to use the photos somewhere the licence did not cover.

The practical questions: who took them, is there anything in writing, do you have the original high-resolution files, and are there restrictions on how you can use them? If nobody can answer those, you are relying on a JPEG somebody emailed you in 2021 and hoping it never matters.

What you do not need to own

We should say this clearly, because the rest of this article could tip someone into paranoia and that would be its own kind of bad advice.

You do not need to own the technology. Not Toast’s software, not Squarespace, not the servers, not Google, not every plugin, not the fonts, not your ordering platform. Renting tools is how every business operates and there is nothing fragile about it.

The goal is not technological self-sufficiency. It is much narrower:

If you replace one vendor, you should not have to replace the identity of the restaurant.

Which means keeping hold of the things that are genuinely yours: the domain, the core accounts, the Google profile, the content and images you own or have continuing rights to use, and a realistic ability to rebuild somewhere else. Everything else can be rented with a clear conscience.

Buying or selling a restaurant

This is where unclear ownership stops being an annoyance and starts costing real money, and it is oddly absent from most closing checklists.

When a restaurant changes hands, it is entirely normal to find that the domain is still with the previous owner, the Google profile primary ownership never transferred, the POS account belongs to the old legal entity, a former manager still controls the Instagram, and nobody knows who has the photography files.

These things do not move with the keys to the building. Toast, for example, has a formal change-of-ownership process for its accounts, which tells you that these transfers are deliberate administrative acts rather than automatic ones. Google similarly recommends transferring primary ownership of the Business Profile when the business changes hands, so that the profile — and years of accumulated reviews — stays with the restaurant.

Buying the restaurant does not automatically hand you every account connected to it. Put the digital assets on the closing checklist.

If you are buying: ask for the domain registrar login, the Business Profile primary ownership transfer, the website platform account, and the original image files, in writing, before closing. If you are selling: sorting this out makes you easier to buy.

The ten-minute ownership audit

Set a timer. You will not finish all of it, and that is the point — whatever you cannot answer in ten minutes is your actual to-do list.

• Domain. Look yourself up on ICANN Lookup and find your registrar. Then try to log in to it. That second step is the real test.
• Website. Log in to the platform. Check who is billed and who the administrators are.
• Google. Business Profile → People and access. Confirm an account you control is the primary owner.
• Assets. Locate the original logo, the menu files and the high-resolution photographs. Not the versions on the website — the originals.
• Email. Check which address renewal notices go to. If it is someone’s personal Gmail from a previous job, fix that first.
• Recovery. Write down what you would actually do if your web company vanished tomorrow.

The one question to ask every vendor

If you do nothing else from this article, do this. Ask every company that touches your digital presence:

“If I stop working with you tomorrow, what exactly do I keep?”

Then ask for the answer in writing.

A good vendor will answer it immediately and without tension, because they have thought about it and they are comfortable with the answer. Some will be vague. A few will get defensive, and that reaction is itself the most useful piece of information you will collect all week.

It is a fair question. You are not accusing anyone of anything. You are asking what you bought.

How we think it should work

We should be direct about our own position here, because we are a company that would like to work on your website and you should be able to weigh that.

Front of House can build the site, manage it and keep improving it. We think we should have to keep earning that job.

Your restaurant should control its domain and its core business accounts. Your Google Business Profile should belong to you, with us as a manager if you want us involved at all. What happens to custom design, code, photography and third-party software should be written down before the project starts, not discovered by somebody who wants to leave.

A good vendor should have to earn the next invoice.

We charge for the work, not for captivity. And we keep projects lean deliberately, because an independent restaurant should not need an agency-sized jump in revenue just to justify having a decent website. Whatever you spend, with us or anyone else, there should be a plausible story for how it returns more than it costs.

The sharpest version of all of this, and the sentence we would leave you with:

If the only reason you cannot fire your web company is that you are afraid of what they would take with them, that is already useful information.

Common questions

How do I find out who owns my restaurant’s domain?
Use ICANN Lookup to identify the registrar. Registrant details are often redacted for privacy, so the practical test is whether you can log in to that registrar account and manage or transfer the domain yourself.

Is WHOIS still how I check a domain?
Partly. ICANN made RDAP the definitive source for generic top-level domains on 28 January 2025 and sunset WHOIS for most of them — but .com, .name and .post still require WHOIS. Since most restaurants are on .com, both exist in practice. ICANN Lookup is the tool to use either way.

Can my web company legally own my domain?
Whoever is the registrant holds the registration, and the agreement between you matters. Rather than argue about legality, find out whether it can be transferred into an account you control.

Can an agency refuse to hand over my Google Business Profile?
Google’s third-party policies prohibit keeping a profile hostage in exchange for money, and prohibit threatening a client with losing their profile. Google’s guidance is that the business owner should be the owner and the agency the manager.

How long does a Google ownership request take?
The current holder has three days to respond. After that you may get the option to claim and verify it yourself, though Google says that option is not always available.

If I paid for my website, do I own the design?
Not automatically. Copyright generally starts with the creator unless it was transferred in writing or the work qualifies as a work made for hire. Check the agreement.

If I paid a photographer, do I own the photos?
Usually not by default. The photographer generally owns the copyright unless it was transferred or the specific work-made-for-hire conditions were met. You may well have a licence, which is often perfectly adequate — the point is to know which you have.

Should I move everything into my own accounts right now?
Not necessarily, and not all at once. Sudden changes can cause outages, and changing registrant details can trigger a 60-day transfer lock. Audit first, understand the architecture, then move what actually needs moving in a sensible order.

Should my web company have access to my accounts at all?
Of course. Giving a vendor access is normal and necessary. The question is never whether they have access. It is whether you keep the restaurant if they go away.