Privacy Policy

Privacy Policy for ipbase.com

Last updated: 27 October 2026

This website collects certain types of personal information from its users.

You can print this policy at any time by using your browser’s print feature.

Data Controller and Owner

Everapi GmbH
Getreidegasse 22
A-2284 Untersiebenbrunn, Austria
Commercial register: FN569823a
Managing director: Dominik Kukacka
Email: office@everapi.com
Data protection officer: we have not appointed one. For privacy questions, write to office@everapi.com.

What Data We Collect

We may collect the following types of personal data, either directly or via third parties:

• First name
• Last name
• Email address
• IP addresses
• Geolocation data
• Your browser’s location, rounded to about 1 km, only if you use the location check (see “Location check (opt-in)” below)
• API usage data

Each category of data collected is described in detail in the appropriate section of this privacy policy or where specifically explained before data is gathered.

Users may voluntarily provide this data, while usage data is typically collected automatically when interacting with the site.

Unless otherwise noted, all requested data is necessary for proper functionality. If users fail to provide such data, we may not be able to offer our services effectively.

Where optional data is indicated, users can choose not to provide it without affecting service quality.

If unsure about what information is required, users are encouraged to contact the Owner directly.

This website does not use cookies for analytics or advertising. The free tools set one cookie that is strictly necessary for them: after an invisible Cloudflare Turnstile check, a cookie valid for two hours that only proves the check passed. The dashboard uses cookies to keep you signed in and for analytics.

Users are solely responsible for any third-party personal data shared through this Application.

How and Where Data Is Processed

Processing Methods

We implement suitable technical and organizational measures to prevent unauthorized access, alteration, disclosure, or destruction of personal data.

Data is processed using IT systems according to procedures closely aligned with stated purposes. Authorized personnel (such as staff in administration, marketing, legal, system operations) or third-party partners (e.g., hosting providers, IT firms) may access data when needed. These parties may be appointed as data processors, and an up-to-date list is available on request.

Processing Location

Our servers are rented from Hetzner Online GmbH and stand in data centers in Germany. Requests reach them through Cloudflare, which handles each request in one of its data centers, usually one near you; that data center can be outside the EU. Some of the service providers listed below are in the United States. See “Transfers Outside the EU” below.

Transfers Outside the EU

Some of our service providers are based in the United States or process data there. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). Otherwise, and in addition, we have agreed on the European Commission’s standard contractual clauses with the provider (Art. 46(2)(c) GDPR). You can ask us for a copy of these safeguards.

Data Retention

Unless otherwise stated, data is retained only as long as required for the purpose it was collected. We may keep it longer if required by law or with user consent.

Why We Process Data

We collect personal data for the following reasons:

• To deliver and maintain our IP geolocation services
• To comply with legal obligations
• To respond to legal or regulatory requests
• To defend our rights and those of our users or third parties
• To detect and prevent misuse or fraud
• To improve our geolocation accuracy and service quality

Examples of Processing

1. Contacting Users

When users fill out a contact form, we use the provided data to respond to inquiries.
Collected data: name, surname, email address

2. Hosting and Infrastructure

We use these service providers to host and deliver this Application and its features, and to understand how it is used. They process personal data on our behalf.

Hetzner Online GmbH
Servers for the API, the dashboard, the IP, ASN, range and domain pages of this website, our logs and our databases. API lookups are answered on these servers.
Location: Germany – Refer to their Privacy Policy for details.

Cloudflare, Inc.
DNS, network proxy and encryption (TLS) for the API and the dashboard, so every request to them passes through Cloudflare, including the IP addresses you look up. Cloudflare also hosts the rest of this website, its documentation and the free tools, protects the contact form and the free tools from bots (Turnstile) and delivers contact form messages.
Location: United States, global network – Refer to their Privacy Policy for details.

PostHog
Cookieless analytics for this website: PostHog sets no cookies and stores nothing in your browser, and email addresses and IP addresses are removed from page addresses and clicked text before an event is sent. In the dashboard, PostHog also links events to your account and records sessions.
Location: EU – Refer to their Privacy Policy for details.

Stripe
Payments and invoices for paid plans. Stripe receives your billing details and payment information; we do not store card numbers.
Location: Ireland, United States – Refer to their Privacy Policy for details.

Functional Software, Inc. (Sentry)
Error tracking for the API and the dashboard. When a request causes an error, details of that request can reach Sentry, including data sent with it.
Location: United States – Refer to their Privacy Policy for details.

Postmark (ActiveCampaign, LLC)
Sending account emails, such as sign-in links, invoices and usage alerts. Postmark receives your email address and the content of the email.
Location: United States – Refer to their Privacy Policy for details.

Google
Our email (Google Workspace): messages you send us by email or with the contact form are stored in our support mailbox. Bot protection on the sign-up page of the dashboard (reCAPTCHA), which receives your IP address and information about your browser. Sign-in with Google, if you choose it.
Location: Ireland, United States – Refer to their Privacy Policy for details.

Anthropic, PBC
AI-assisted support: when you write to our support, an AI model reads your message, its attachments and the details of your account that are needed to answer, and drafts a reply. Replies drafted this way say that they were written with the help of AI. Anthropic does not use this data to train its models.
Location: United States – Refer to their Privacy Policy for details.

Slack (Salesforce, Inc.)
Internal notifications to our team, for example about sign-ups, payments and support requests. These can include your name, your email address and a summary of your request.
Location: United States – Refer to their Privacy Policy for details.

Backblaze, Inc.
Backups of our main database. They are encrypted on our servers before upload, so Backblaze stores only encrypted copies it cannot read. We keep them for 14 days.
Location: Netherlands (Amsterdam) – Refer to their Privacy Policy for details.

Adobe (Adobe Fonts)
The fonts of this website. Your browser loads them from Adobe’s servers, which receive your IP address and the address of the page. Adobe Fonts sets no cookies.
Location: United States – Refer to their Privacy Policy for details.

Sign-in with another account
If you sign in to the dashboard with Google, GitHub, GitLab or Microsoft, that provider tells us your name and email address. Their own privacy policies apply to what happens at the provider.

Emails From Us

• Account emails such as sign-in links, invoices, payment reminders and usage alerts are part of the service and are sent through Postmark
• Product news: we may tell customers about new features and similar products of ours by email. You can turn this off in the notification settings of the dashboard or with the link in every such email
• Every email we send through Postmark is logged there so that we can see whether it was delivered

3. IP Geolocation Service

When users look up IP addresses through our API, the free tools or the IP address pages on this website (such as /ips/1.1.1.1):

• We process the IP addresses provided for geolocation
• Lookups are answered by our own servers in Germany. Requests reach them through Cloudflare
• For requests made with an API key, our request log keeps the request URL, which can contain the IP address you looked up, the IP address the request came from and its user agent for 90 days, then deletes those fields
• The free tools on this website send their lookups with our own API key, so the request log can keep them in the same way. Cloudflare also caches each tool lookup, together with its result, for up to 7 days
• Lookups made without an API key are not written to that request log, which only counts them
• The IP address pages on this website are built by our servers. Cloudflare caches each page for up to two days
• The web server logs on our servers keep the request line, which can contain the IP address you looked up, for about 14 days
• To decide which networks’ location data to refresh first, we count lookups per network (the /24 block of an IPv4 address or the /48 block of an IPv6 address), not per address
• When you ask for the hostname, and on the IP address pages, we ask DNS for the address’s reverse DNS name and keep the name in a cache for 24 hours. This DNS query reaches public DNS servers, including those of the network operator the address belongs to
• If a request fails, its details, which can include the IP address you looked up, can go to our error tracker, Sentry (United States)
• If you use the API playground in the dashboard, the addresses you enter and the results shown can be part of our product analytics and session recordings at PostHog (EU)
• Cloudflare keeps logs of a sample of about one in ten requests to this website, including free tool lookups and the IP address pages, with the address in the request URL, for up to 7 days
• We do not sell the IP addresses you look up. Apart from the reverse DNS query described above, we share them only with service providers that process data on our behalf, such as Cloudflare, Sentry and PostHog

4. Location check (opt-in)

On the “What is my IP”, “What is my ISP” and IP lookup pages you can compare where ipbase’s database places your IP address with the location your browser reports. The check is optional and only runs when you click “Check our accuracy with your browser’s location”:

• Your browser first asks whether you allow it to share your location. The browser determines the position itself (for example from GPS, nearby Wi-Fi networks or its own location service); we only receive the result. If you do not allow it, or the browser cannot determine a position, nothing is sent to us
• Your browser rounds the position to about 1 km (two decimal places of latitude and longitude) and sends it, with the accuracy the browser reports, to our servers in Germany (app.ipbase.com). The request reaches them through Cloudflare
• We store your IP address, the rounded position, the reported accuracy, the location ipbase’s database gave for your IP address at that time, the distance between the two locations and the time of the check
• We use these checks only to measure and improve the accuracy of ipbase’s IP geolocation data, for example to correct the city we give for a network. We do not publish individual checks, and we do not sell them or share them with anyone except service providers that process data on our behalf (see “Hosting and Infrastructure” above)
• We delete each check after 12 months
• The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by clicking the button. You can withdraw it at any time by writing to office@everapi.com with the IP address you used; we then delete your checks. Withdrawing does not affect the lawfulness of processing before it
• Our website analytics (PostHog) only records that a check was made and how it ended, with the distance in rough bands such as “25–100 km”, never your position

Legal Basis for Processing

More on Data Retention

• Account data (name, email address, company and settings) is kept until you delete your account
• Invoices and payment records are kept for 7 years after the end of the year, as Austrian tax law requires (§ 132 BAO)
• Our web server logs, which contain the request line and the IP address a request came from, are deleted after about 14 days
• Sign-in sessions end after 7 days
• Contact form messages and support emails are kept as long as we need them to answer your request and later questions about it
• Backups of our main database are kept for 14 days
• If you gave consent, the data is kept until you withdraw it
• Legal obligations can require us to keep data longer
• IP addresses you look up are kept as described under “IP Geolocation Service” above, for example for 90 days in our request log
• Location checks (your IP address and your rounded browser location) are deleted after 12 months, see “Location check (opt-in)” above

Once the retention period ends, data is deleted and access/portability rights no longer apply.

GDPR Rights for Users

Under the GDPR, users have the right to:

• Withdraw previously given consent
• Object to data processing for specific reasons
• Request access to their data
• Verify or correct their data
• Restrict processing
• Have data deleted
• Receive data and transfer it to another provider
• Lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at

Users can also inquire about how data is protected when transferred abroad.

Objecting to Data Processing

If we process data under public interest or legitimate interest, users may object by explaining their specific situation.

Users may always object to direct marketing use without giving a reason. If objected, data will no longer be used for that purpose.

How to Use These Rights

To exercise these rights, users can contact the Owner using the contact details above. Requests are free and will be processed within a month.

If personal data has been shared with others, the Owner will attempt to notify them of any corrections or deletions, unless it’s impossible or overly difficult.

Additional Info

Legal Use

We may use personal data in legal proceedings or in preparation for legal action related to misuse of our Application or services.

Extra Information

Additional details about specific services or data handling may be provided on request.

System Logs and Maintenance

For maintenance and operational purposes, we or third parties may log interactions and collect information such as IP addresses.

Unlisted Information

Users can request further details about data practices by contacting the Owner.

Privacy Policy Updates

We may revise this privacy policy at any time. Users will be informed on this page or elsewhere in the Application. We may also notify users by email if possible.

Users should check this page regularly for updates. If consent is required for any changes, we will request it again as needed.

Legal Note

Unless otherwise mentioned, this privacy policy applies solely to this Application.

Definitions

• Personal Data: Information identifying a natural person, directly or indirectly.
• Usage Data: Automatically collected info like IP addresses, browser details, and time spent on pages.
• User: The person using this site.
• Data Subject: The individual to whom personal data refers.
• Data Processor: Entity processing data on behalf of the Data Controller.
• Data Controller: The party that determines how and why data is processed — in this case, the Owner.
• Service: The services provided via this Application.
• EU: References in this policy to the “EU” include both EU and EEA member states.