Privacy Policy

1. Controller (Verantwortlicher)

The controller within the meaning of Art. 4(7) of the EU General Data Protection Regulation (GDPR / DSGVO) is:

For all data protection inquiries, please contact us at the address above.

2. Overview of data processing

ipctl.io is a network intelligence platform that provides information about IP addresses, autonomous systems (ASNs), and network prefixes. We process personal data only to the extent necessary to provide a functional website and our API services.

The legal bases for our data processing are:

• Art. 6(1)(b) GDPR - performance of a contract (providing the API service to registered users).
• Art. 6(1)(f) GDPR - legitimate interests (website security, abuse prevention, service improvement).
• Art. 6(1)(a) GDPR - consent (where explicitly obtained, e.g. optional email communications).

3. Data we collect

3.1 Website visits (server logs)

When you access our website or API, our servers automatically log the following data:

• IP address of the requesting device
• Date and time of the request
• HTTP method, requested URL, and HTTP status code
• Referrer URL (if transmitted by your browser)
• User agent string (browser/OS identification)
• Response size and request latency

This data is processed on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring the stability, security, and optimization of our services. Server logs are retained for 30 days and then automatically deleted.

3.2 Account registration

When you create an account, we collect:

• Name
• Email address
• Hashed password (we never store plaintext passwords)

This data is processed on the basis of Art. 6(1)(b) GDPR for the performance of our service agreement. Your account data is retained until you delete your account or request deletion.

3.3 API usage

When you use our API (with or without authentication), we log the request metadata described in Section 3.1. For authenticated requests, we additionally track the API key used and request counts for rate limiting and billing purposes. This data is processed on the basis of Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (abuse prevention).

3.4 IP abuse reports

When you submit an IP abuse report, we collect the IP address being reported, the report type, and optionally your email address and a description. Email addresses provided in reports are processed on the basis of Art. 6(1)(f) GDPR to enable follow-up communication about the report.

3.5 Crowdsourced geolocation

On certain pages (e.g. “What is My IP”), your browser may ask whether you want to share your location. This is a standard browser permission prompt - we do not control its appearance or timing.

If you grant permission, we receive your approximate coordinates and use them to improve the accuracy of our geolocation database. Your IP address is anonymized before storage - we only retain the network block your IP belongs to, not the IP itself. The contribution cannot be traced back to you as an individual.

If you deny the browser prompt, no location data is sent and the page works normally. This processing is based on Art. 6(1)(a) GDPR (consent via the browser permission dialog). Contributions are retained indefinitely to maintain geolocation accuracy.

3.6 Cookies and local storage

ipctl.io uses only technically necessary cookies and local storage:

• Session/JWT token - stored in an HTTP-only cookie or local storage to maintain your authenticated session. This is strictly necessary for the service to function (Art. 6(1)(b) GDPR) and does not require consent under § 25(2) TDDDG (formerly TTDSG).

We do not use tracking cookies, analytics cookies, advertising cookies, or any third-party cookies. We do not use Google Analytics, Facebook Pixel, or similar tracking services.

3.7 Newsletter

If you subscribe to our newsletter (IPv4 transfer market reports, notable BGP hijacks and RPKI changes, and product updates), we process your email address on the basis of your consent (Art. 6(1)(a) GDPR). Subscribing is optional and not required to use ipctl.io.

We use a double opt-in: you only receive the newsletter after confirming your subscription through a link or code sent to your email address. When you create an account, we offer the newsletter once right after your first sign-in; because you have just confirmed your email address with the sign-in link or code, the subscription starts right away. As proof of your consent we store the time and IP address of your sign-up and of your confirmation, the page where you signed up, the browser user agent and the version of the consent text you agreed to.

You can withdraw your consent at any time with the unsubscribe link in every newsletter or in your account settings, without affecting the lawfulness of processing before the withdrawal. After you unsubscribe we keep the consent record as proof for up to three years (Art. 6(1)(f) GDPR, defence of legal claims), but send you no further newsletters. Newsletters are sent via Amazon SES (see Section 4.4); we do not track opens or clicks.

4. Hosting and third-party processors

4.1 Server hosting

Our servers are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes data exclusively within the EU/EEA. A data processing agreement (Auftragsverarbeitungsvertrag) in accordance with Art. 28 GDPR is in place.

4.2 Cloudflare (CDN and DDoS protection)

We use Cloudflare, Inc. as a content delivery network and for DDoS protection. Cloudflare may process your IP address and request metadata in order to deliver content and filter malicious traffic. Cloudflare is certified under the EU-U.S. Data Privacy Framework. Our legitimate interest in using Cloudflare is the security and availability of our services (Art. 6(1)(f) GDPR). A data processing agreement is in place.

4.3 Reverse geocoding (BigDataCloud)

When you contribute your location via the crowdsourced geolocation feature (Section 3.5), we send the coordinates to BigDataCloud Pty Ltd (Australia) to resolve them to a city and country name. Only latitude and longitude are transmitted - no IP address or other personal data. BigDataCloud publishes its privacy policy on its website (bigdatacloud.com). This processing is based on Art. 6(1)(a) GDPR (your consent to share location).

4.4 Email delivery (Amazon SES)

Transactional emails (account verification, sign-in links and codes, password reset) and the newsletter are sent via Amazon Simple Email Service (SES), operated in the EU (eu-central-1, Frankfurt). Amazon Web Services EMEA SARL acts as a data processor under Art. 28 GDPR. The data processed is limited to your email address and the email content. Amazon SES is used under the EU-U.S. Data Privacy Framework.

5. Public network data (IP addresses, ASNs, prefixes)

The core function of ipctl.io is to aggregate and display publicly available network infrastructure data - BGP routing tables, RIR allocations, RPKI validation results, geolocation data, IRR route objects, and threat intelligence from public blocklists.

IP addresses are considered personal data under GDPR when they can be linked to an identifiable natural person. However, the vast majority of IP addresses in our database belong to infrastructure (servers, network equipment, cloud instances) and cannot be linked to individuals.

We process this data on the basis of Art. 6(1)(f) GDPR. Our legitimate interest - and that of our users - is to provide transparency about public Internet infrastructure for network engineering, security research, and abuse mitigation purposes.

All data we display is sourced from publicly accessible, authoritative Internet infrastructure databases. We do not perform port scanning, traffic interception, or any form of active probing of end-user devices.

6. Data transfers outside the EU/EEA

Our primary servers are located in Germany. Data transfers to third countries occur only through:

• Cloudflare - certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR adequacy decision).
• Amazon SES - operated in eu-central-1 (Frankfurt); parent company certified under the EU-U.S. Data Privacy Framework.

We do not transfer personal data to any other third countries.

7. Data retention

• Server logs: 30 days, then automatically deleted.
• Account data: retained until account deletion. You can delete your account at any time through the dashboard or by contacting us.
• API usage records: aggregated usage statistics are retained for billing purposes. Detailed request logs are deleted after 30 days.
• Abuse reports: retained for the duration necessary to investigate and resolve the report.
• Newsletter: your email address and subscription status are kept until you unsubscribe (or until you delete your account, if you subscribed with one). Sign-ups that are never confirmed are deleted after 30 days. The consent record described in Section 3.7 is kept for up to three years after you unsubscribe.
• Email delivery events: for emails we send, we store the recipient address, the event type (for example delivered, bounced or marked as spam) and the diagnostic information returned by the receiving mail server (SMTP status and message). We use these records to stop sending to addresses that bounce or complain and to protect our sender reputation (Art. 6(1)(f) GDPR). Routine records (sent, delivered) are kept for 30 days, bounces, spam complaints, delays and rejections for 180 days. They are deleted earlier when you delete your account.

8. Your rights under GDPR

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) - you can request information about what personal data we hold about you.
• Right to rectification (Art. 16 GDPR) - you can request correction of inaccurate personal data.
• Right to erasure (Art. 17 GDPR) - you can request deletion of your personal data, subject to legal retention obligations.
• Right to restriction (Art. 18 GDPR) - you can request that we restrict the processing of your data.
• Right to data portability (Art. 20 GDPR) - you can request your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR) - you can object to processing based on legitimate interests (Art. 6(1)(f)). We will cease processing unless we can demonstrate compelling legitimate grounds.
• Right to withdraw consent (Art. 7(3) GDPR) - where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello [at] ipctl [dot] io. We will respond within 30 days as required by Art. 12(3) GDPR.

9. Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR (Art. 77 GDPR).

The competent supervisory authority for us is:

10. Data security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• TLS encryption for all data in transit (HTTPS enforced)
• Passwords stored using bcrypt with per-user salts
• API keys stored as SHA-256 hashes (the plaintext key is only shown once at creation)
• Database access restricted to the application server via private network
• Regular security updates and monitoring
• DDoS protection and WAF via Cloudflare

11. Children and minors

Our service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16 without parental consent, we will delete it promptly.

12. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes in our data processing practices or legal requirements. The current version is always available at ipctl.io/privacy. Material changes will be communicated via email to registered users.