Do I own the domain name or does the website company?

It depends on the arrangement, and that's fine, as long as it's clear. Some web design companies register and manage your domain as a custodian, which is a normal, legitimate setup. The real question isn't who technically holds it, it's whether the company has told you that's the arrangement, and whether you can take the domain with you at any time if you ask.

The problem isn't custodianship itself, it's custodianship nobody told you about, or one where "you can have it anytime" turns into delays, extra fees, or silence the moment you ask. If a company won't put that answer in writing, or won't hand it over when asked, that's the real red flag, not the fact that they're holding it in the first place.