Data Processing Agreement

Last updated: 2 November 2026

1. When this applies

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Controller") and Mslm Dev, trading as InternetData ("Processor", "we", "us"). It applies where, and only to the extent that, we process personal data on your behalf in the course of providing the Service, and it takes effect when you begin using the Service. No signature is required. If you need a countersigned copy for your records, write to legal@internetdata.io.

Where this DPA and the Terms of Service conflict on the subject of personal data, this DPA governs. Where you have signed a license agreement with us that deals with personal data, that agreement prevails over this DPA to the extent the two conflict. Terms defined in the GDPR have the same meaning here.

2. What we process, and what we do not

The addresses your users connect from are not the subject of this DPA, because they never reach us. We license databases and answer no lookups: you query a database you hold, inside your own infrastructure, and we see none of it. Our datasets describe network infrastructure, are built from our own measurement and from public registry and operator records, and are not processed on your behalf. Section 2 of our Privacy Policy explains the distinction in full.

What we do process on your behalf is personal data about the people in your organization who use the Service, as described below.

3. Our obligations

We will:

• process personal data only on your documented instructions, of which your use of the Service and the Terms of Service are the primary ones, unless required otherwise by law, in which case we will tell you first unless the law forbids it;
• not use personal data processed on your behalf to train machine-learning or AI models;
• ensure that everyone authorized to process it is bound by an appropriate duty of confidence;
• take the measures described in section 5;
• assist you, so far as is reasonable and taking into account the nature of the processing, with data subject requests, security incidents, impact assessments and prior consultation;
• on termination, delete or return personal data as set out in section 6, except where law requires us to keep it;
• make available the information reasonably needed to demonstrate compliance with this DPA, and allow and contribute to audits as set out in section 7.

We will tell you promptly if, in our opinion, an instruction infringes data protection law.

4. Sub-processors

You give us general authorization to engage sub-processors. We impose data protection terms on each that are no less protective than this DPA, except on Anthropic, as set out below the list, and we remain liable to you for the performance of each. The current list is:

We use Claude under Anthropic's consumer terms, which include no data processing agreement, so Anthropic is not bound by terms equivalent to this DPA. Model training is switched off on every account we use it with, and Anthropic does not train its models on what Claude reads there, except content its safety systems flag for review.

We will give at least 30 days' notice before adding or replacing a sub-processor, by updating this page and emailing account holders. If you reasonably object on data protection grounds within that period, tell us and we will work with you in good faith; if we cannot resolve it, you may terminate the affected part of the Service and we will refund any prepaid license fees for the unused remainder of the term.

5. Security

We implement technical and organizational measures appropriate to the risk, which today include:

• encryption in transit for the console, the website, the API and database downloads;
• hashed passwords, first-party session cookies that scripts cannot read, and optional multi-factor authentication;
• access to production systems limited to those who need it, over authenticated channels;
• written confidentiality undertakings from everyone with access to personal data;
• organization roles that decide what each member of your account can see and do;
• API keys scoped to what each may do, which you can rotate and revoke at any time, and whose value is shown again only to a member permitted to reveal it, after re-authenticating;
• a record of every download attempt, refusals included, readable by you in the console's download history;
• logging of administrative actions against an account, readable by you in the console's audit log;
• limits on repeated sign-in and second-factor attempts, and a bot challenge on sign-up and sign-in;
• rate limiting and abuse controls on every public endpoint;
• hosting of the Service in the European Union;
• production kept separate from the environments we develop and test in;
• nightly backups, encrypted and kept off-site;
• centralized logging, monitoring and alerting, and a public status page;
• a documented incident-response procedure, kept as internal runbooks that take an incident from triage through to recovery;
• change management through version control: every change to the Service is recorded as a reviewable diff, passes automated checks before it is built, and is deployed from versioned configuration, normally to a staging environment before production, with database schema changes applied as numbered, append-only migrations.

We may change these measures as the risk or the state of the art changes, provided we do not materially reduce the overall level of protection.

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting your data, and provide the information you reasonably need to meet your own notification obligations. Our notice is not an admission of fault.

6. Retention, deletion and return

Records of download attempts are kept without a set deletion date, and records of API requests for 13 months, for support and abuse investigation, as section 8 of the Privacy Policy describes. Account information is kept for as long as you have an account, and for a limited period afterwards where we need it for legal, tax or accounting obligations or to resolve disputes.

On termination you may export your account data from the console. On your written request within 30 days of termination we will delete personal data processed on your behalf, except where law requires us to keep it, in which case we will keep it only for that purpose and for no longer than required.

7. Audits

On reasonable written notice, and no more than once in any twelve-month period unless a regulator requires otherwise or there has been a breach affecting your data, we will make available the information needed to demonstrate compliance with this DPA and respond to a reasonable written security questionnaire. Any on-site audit is at your cost, during business hours, subject to confidentiality, and must not disrupt the Service or compromise another customer's data.

8. International transfers

The Service is hosted in the European Union. Transactional email is delivered, and encrypted backups are kept, through a sub-processor in the United States, and Google Workspace, like the challenge and authentication sub-processors in section 4, may process outside the EEA and the UK. Anthropic receives what Claude reads in the United States, under its consumer terms and without Standard Contractual Clauses. Where any other personal data leaves the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, and the UK Addendum where the UK GDPR applies, together with any supplementary measures the transfer requires. By entering into this DPA you agree that the Standard Contractual Clauses, module two (controller to processor), are incorporated by reference, with you as data exporter and us as data importer, with the optional docking clause applying, with option 2 of clause 9 and the notice period in section 4, with clause 11 having no independent dispute resolution body, and with Irish law and the Irish courts governing.

For the annexes to those clauses, the parties and their contact details are as set out in sections 1 and 11, the description of the transfer is section 2, and the technical and organizational measures are section 5.

Insofar as a transfer is subject to the Swiss Federal Act on Data Protection of 25 September 2020 ("FADP"), the Standard Contractual Clauses apply to it with the adaptations the Federal Data Protection and Information Commissioner ("FDPIC") requires: references to the GDPR are read as references to the FADP, the FDPIC is the competent supervisory authority, Swiss law and the Swiss courts govern in place of Irish law and the Irish courts, and "member state" is not read so as to prevent a data subject in Switzerland from bringing a claim where they habitually reside, as clause 18(c) allows.

9. Your obligations

You are the controller. You are responsible for having a lawful basis for the processing you instruct, for the accuracy and lawfulness of what you submit, for giving whatever notice your own data subjects are owed, and for not submitting special category data. You must not use the Service as the sole basis for a decision producing a legal or similarly significant effect on a person; our classifications are probabilistic, as section 2 of the Terms of Service sets out.

10. Liability, changes and law

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service.

We may update this DPA to reflect a change in law, in our sub-processors, or in how the Service works. Material changes are notified to account holders, and the "Last updated" date above shows the current version. This DPA is governed by the law stated in the Terms of Service, except that where the Standard Contractual Clauses apply they are governed as set out in section 8.

11. Contact

Data protection questions, audit requests and countersignature requests go to legal@internetdata.io. General support is the contact form. Our registered office is:

Mslm Dev
195-B Jasmine Block Sector C Bahria Town
Lahore, Punjab 53720, Pakistan