This policy explains which personal data is processed when you use the ipaddress.ee website, for what purpose and on what legal basis, to whom it may be transferred, how long it is kept and how you can exercise your rights. It provides the information required by Articles 13 and 14 of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Estonia’s Personal Data Protection Act, and describes how the software behind this site actually works (see also How it works). The Estonian version is the binding one; the English version says the same.
Controller
The controller responsible for your personal data is the operator of ipaddress.ee (name not yet published), with an address at an address not yet published; until then, use the contact form. You can reach us about any personal data matter through the contact form, choosing “Privacy request” in the form.
What we process, why and on what legal basis
IP address and request headers. To show you your IP address, network and approximate location, our server reads the IP address of the incoming connection and the headers your browser sends (such as the user agent and preferred languages). Together with other data an IP address can identify a person, so we treat it as personal data. We use it only to answer your request and to protect the site from abuse.
- The application does not store your IP address. For rate limiting it keeps a keyed hash in memory or in Redis that is rotated every day and expires automatically.
- Network, routing, location and Tor data for your address come from our own database. Your address is not sent to any IP intelligence service.
- To show reverse DNS and registration data, your IP address is included in a DNS query to a recursive resolver and in an RDAP request to the regional internet registry responsible for it (for Estonian addresses, the RIPE NCC in the Netherlands).
Legal basis: our legitimate interest in providing the service you ask for and in its security (GDPR Art. 6(1)(f)).
Lookups you perform. IP addresses, domain names and AS numbers you enter are answered from our own database where possible; DNS and registration lookups are sent to the name servers and registries that hold the answer. We keep no history of your lookups. Results are cached for a limited time without any link to you.
Tools that contact other servers. The TLS, HTTP header, security header and redirect tools connect from our server to the public address you enter. The port checker opens a single connection, on the port you choose, only to the address your request comes from. The blacklist check queries public DNS blocklists with the address you enter. The WebRTC leak test asks Cloudflare’s public STUN server for your address from your browser — only when you start the test — so Cloudflare sees your IP address. The latency test only sends requests to our own server. Addresses in a bulk lookup are processed in memory and not stored.
Aggregate statistics. We count page views per page and per day, with lookup values removed from the path. No IP address, cookie or identifier is stored. Counting is skipped when your browser sends Do Not Track or Global Privacy Control.
Contact form. If you write to us, we store your name, email address, subject and message so we can reply (GDPR Art. 6(1)(b) and (f)). Messages are deleted at the latest 12 months after receipt. The form may use Cloudflare Turnstile to prevent spam; in that case Cloudflare processes technical data about your browser. Providing these details is voluntary; without them we cannot reply.
Server logs. Our hosting infrastructure may keep short-lived technical access logs (including IP addresses) for security and troubleshooting.
We do not use your data for other purposes such as direct marketing or profiling.
Cookies and third-party services
We set no tracking cookies. If you switch language, a strictly necessary cookie remembers your choice. If the site operator enables Google Analytics or Google AdSense, these are loaded only after you give your consent in the banner (GDPR Art. 6(1)(a)), and you can change your choice at any time under “Cookie settings”. Details are in the Cookie Policy.
Transfers
We do not sell or hand over your personal data. Lookup values, including your IP address when you look it up, can reach DNS resolvers and internet registries answering RDAP and WHOIS queries, some of them outside the European Economic Area (for example ARIN in the United States). They receive only what is needed to answer the query. If Google’s services are enabled, transfers to the United States through them take place only with your consent and under the EU–US Data Privacy Framework. If the site operator connects optional commercial data providers, they are listed with their status under How it works.
Retention and security
We keep only contact-form messages (up to 12 months) and anonymous counters (up to 400 days). They are stored on our own server, protected by access controls, encrypted connections and an authenticated admin panel.
Your rights
Under the GDPR you may request access to your personal data, its rectification or erasure, restriction of processing and data portability, object to processing based on legitimate interest, and withdraw consent at any time. Because we do not store visitor IP addresses or lookup histories, in most cases there is no personal data we could provide or correct; contact-form messages are the exception.
To exercise your rights, send your request through the contact form. We answer free of charge within one month. If you believe your rights have been infringed, you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, www.aki.ee) or to the supervisory authority of your country of residence.
Changes
We will update this page when the way the site processes data changes. The date at the top shows the latest revision.