Privacy Policy

Last updated: 2 November 2026

This notice explains how Mslm Dev, trading as InternetData ("we", "us"), collects, uses and shares personal information when you visit internetdata.io or use the InternetData API. Questions go to privacy@internetdata.io.

1. What we collect

We collect the following from you directly:

• Account details: your name, email address, and a hashed password. We never store your password in a form we can read.
• Authentication data: if you sign in with Google or GitHub, the identifier and email that provider returns to us.
• Licensing and invoicing details: the contact, entity and billing details needed to put a license agreement in place and to invoice under it.
• Support conversations: what you write to us in the chat on our sites, in the console, through the contact form or by email, the files you attach, the address you give us to reply to, and the page you wrote from. With each conversation we also record the IP address it came from and what our own network data says about it, to answer you well and to stop abuse.
• Newsletter: if you subscribe, your email address, the topics you choose, and a record of your signup and its confirmation (when, which page, your IP address and your browser), which we keep to show the subscription was asked for. We also record each email we send you and whether it was delivered.
• A location you choose to share: the What is my IP page shows where we place your address and asks whether that's where you are. Only if you say it isn't does your browser ask to share your location, once. Your browser works out the coordinates and sends them to us, and we use them only to find the nearest town. We keep that town with your address's network block (such as 192.0.2.0/24), the time, the place we had shown you, how precise your browser said the location was, and whether you were on a computer, phone or tablet. We don't keep the coordinates or your full address. Your answer to the question itself is counted with nothing that identifies you, and answers from your address are counted against it for an hour, as lookups are, to limit automated use.

We collect the following automatically when you use the Service:

• Session and security data: the IP address a request came from, the browser or client user agent, and timestamps. We use this to keep you signed in, to show you your own active sessions, and to detect abuse.
• Download records: a record of each database download, refused attempts included: the organization and, where one was used, the API key behind it, the database and format, when, the address it came from and the client's user agent. We use it to show you your download history, to support you and to investigate abuse.
• Usage data: a record of each API request, and of each address lookup and sample download on this website, including any key that made it, what it asked for and when, so we can support you and investigate abuse.
• Lookup counts: when you look up an IP address on this website, a count of the lookups made from your address in the past hour, kept against that address so we can limit automated use. Each count expires an hour after it starts.
• Server logs: for every request that reaches our servers, including visits to this website, the address it came from, the user agent, the page or endpoint asked for, the referring page and when. We use them to run and secure the Service, and match the address against our own network data to tell people from automated traffic.
• Site measurement: unless you turn measurement off, each page you view on our sites and in the console, how long it was in front of you, whether you scrolled, clicked or typed on it (never what you typed), the buttons we count, such as sign-up, where your visit came from, your screen size, time zone and language, and the address it came from. We match the address against our own network data to tell people from automated traffic, and use the rest to see which pages help.

We do not process special category personal information, and we do not buy personal information from third parties. The one sensitive item we receive is the precise location you may choose to share on the What is my IP page, which we reduce to the nearest town as it arrives.

2. IP addresses we classify are not personal information about you

This is worth stating plainly because it is the part people ask about. Our classification datasets describe network infrastructure, such as which ranges belong to VPN operators or hosting providers, and are derived from network measurement, published operator server lists and public internet registry records.

Because we license databases rather than answering lookups, the addresses your own users connect from never reach us: you query a database you hold, inside your own infrastructure, and we see none of it.

3. How we use it

• To create and operate your account, and to authenticate you.
• To provide the Service, and to administer and invoice your license.
• To keep the Service secure, including preventing fraud and automated abuse.
• To answer your support conversations. Our AI assistant answers chat and console questions first where it can, and a person takes over whenever you ask or it cannot help; a person answers everything sent through the contact form or by email.
• To send you the newsletter, if you subscribe or have an account.
• To understand aggregate usage so we can improve the Service.
• To place IP addresses more accurately, from the locations visitors choose to share, combined across several people on the same network.
• To comply with our legal obligations.

Account holders get the monthly product update unless they opt out. The sign-up form offers it with a box that's already ticked, which you can untick, and you can turn it off at any time under Notifications in the console's settings. Every newsletter email has a one-click unsubscribe link.

4. Legal bases (EEA and UK)

• Contract: operating your account, and providing the Service and the databases you license.
• Legitimate interests: securing the Service, preventing abuse, and improving what we offer, where those interests are not overridden by your rights.
• Legal obligation: retaining records we are required to keep, and responding to lawful requests.
• Consent: optional cookies, marketing email where we rely on consent, and a location you choose to share. You can withdraw consent at any time.

5. Canada

Where PIPEDA applies, we rely on your express or implied consent, which you may withdraw at any time. In limited circumstances the law permits processing without consent, for example to investigate a breach of an agreement or to detect fraud.

6. Sharing

We share personal information only with:

• Anthropic, whose Claude models power our support assistant: it receives the conversation it is answering, with the files you attach to it, and under its commercial terms does not use them to train its models. Our engineers also use Claude to build and run the Service, under Anthropic's consumer terms with model training switched off: it can read the personal information we hold while they work, and Anthropic does not train its models on it, except content its safety systems flag for review.
• Google Workspace, which hosts our email: it receives every message sent to an @internetdata.io address, the support addresses included, before our support inbox does.
• Amazon Web Services, which receives the email you send our support addresses and delivers our replies.
• Cloudflare, whose Turnstile challenge protects sign-up, sign-in, the contact form, the newsletter signup and the address lookup from automated abuse.
• Google and GitHub, if you choose to sign in with them.
• Google, whose Ads tag and conversion measurement tell Google Ads which of our ads brought you here, while you allow advertising.
• Infrastructure providers that host the Service under contract with us.
• Authorities, where we are legally required to.

We may transfer information in connection with a merger, acquisition or sale of assets. We do not sell personal information. While you allow advertising, we share the pages you visit on our sites, the ad click that brought you and, if you sign up or buy, a hashed form of your email address with Google, to measure our ads and show them to you on other sites, which California law calls sharing for cross-context behavioral advertising. Advertising is off until you allow it in the EEA, the UK and Switzerland, and off everywhere for a browser that sends Global Privacy Control.

7. Cookies

We set strictly necessary cookies, one optional functional cookie that is off until you agree to it, and analytics cookies of our own that measure how the site is used, which are on until you turn measurement off. Google sets advertising cookies, which are on until you turn advertising off, and off until you allow them in the EEA, the UK and Switzerland. In full:

Signing in with Google or GitHub sends you to that provider, which sets its own cookies on its own domain under its own privacy policy. We do not set cookies on their behalf.

Everything above except the Google sign-in prompt, the search recents, and the analytics and advertising cookies is strictly necessary to provide a service you asked for. The prompt and the recents are conveniences rather than necessities, so they are off until you accept functional cookies, and nothing is loaded from Google for the prompt until you do. The analytics cookies are on until you turn measurement off; turning it off deletes them and stops our measurement. The advertising cookies are on until you turn advertising off, except in the EEA, the UK and Switzerland, where they are off until you allow them, and for a browser that sends Global Privacy Control; turning advertising off deletes ours, stops Google's tag from loading and stops us telling Google which ad brought you. You can change any choice at any time in the cookie banner or from the Cookie preferences link in the footer.

There is no single agreed standard for Do Not Track signals, so we do not currently respond to them. We do honor Global Privacy Control, as above.

8. Retention

We keep account information for as long as you have an account, and for a limited period afterwards where we need it to meet legal, tax or accounting obligations or to resolve disputes. Session and security logs are kept for a short period appropriate to detecting abuse. Download records, holding the time, the database, the address the request came from, the client's user agent, and the organization and any API key that made it, are kept without a set deletion date, for support and abuse investigation. Server logs, and what we derive from them about each address, are kept for 90 days, as is our own measurement of the site with the address of each page view; the per-visit figures we build from it, without the address, are kept for 400 days. Records of API requests and of this website's lookups and sample downloads, holding the time, what was asked for and, where there is one, the key and organization that made it, are kept for 13 months, for support and abuse investigation. Hourly counts of the addresses and user agents that make the most of those requests are kept without a set deletion date, and those of the addresses and user agents that reach our servers most for 400 days. A location you choose to share, held as the nearest town with your address's network block, is kept for 13 months, and the address it came from for 31 days, so that we count one location per address. A newsletter subscription and the record of its signup are kept until the address is removed. If email to an address bounces or is reported as spam, we keep the address on a list of addresses not to email again, even after it is removed. A support conversation started from an account is kept until the account is deleted, which deletes it; one started without an account, or by email, is deleted 24 months after its last message. Email to our support addresses is kept with its conversation, and our email provider deletes its own copy 7 days after it arrives. What our support assistant spent on each answer is kept for 13 months, without the conversation's words. When we no longer need information, we delete or anonymize it.

9. Security

We use technical and organizational measures appropriate to the risk, including encryption in transit, hashed passwords, first-party session cookies that scripts cannot read, and optional multi-factor authentication. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Your rights

Depending on where you live, you may have the right to access your personal information, to correct it, to delete it, to restrict or object to processing, to portability, and to withdraw consent. We will act on requests in line with applicable law and will not treat you differently for exercising a right.

To exercise a right, email privacy@internetdata.io. We will verify your identity before acting, usually by confirming control of the account email. You can also export your data, deactivate your account or delete it yourself, from Settings → Data & privacy in the console. If you subscribed to the newsletter without an account, you can delete your address and its record yourself from the preferences page every newsletter email links to. A location you shared is kept with neither your address nor anything else that identifies you, so once it is kept we cannot find it again to show, change or delete it.

If you are in the EEA or UK and believe we are processing your information unlawfully, you may complain to your local supervisory authority. In Switzerland, that is the Federal Data Protection and Information Commissioner.

11. California

The categories of personal information we have collected in the past twelve months, using the CCPA's own categories:

We have not sold personal information in the preceding twelve months, and we do not intend to. Since October 21, 2026, while you allow advertising, we share the pages you visit, the ad click that brought you and, if you sign up or buy, a hashed form of your email address with Google, as section 6 says, which California law counts as sharing. You can opt out from the "Your privacy choices" link in the footer, or with Global Privacy Control. California residents may request access, deletion, or correction, and may use an authorized agent who provides proof of authorization.

12. Children

The Service is for users aged 18 or over. We do not knowingly collect information from children. If you believe a child has provided us information, contact privacy@internetdata.io and we will delete it.

13. Changes

We update this notice as our practices or the law change. The "Last updated" date above shows the current version, and we will notify account holders of material changes.

14. Contact

Mslm Dev
195-B Jasmine Block Sector C Bahria Town
Lahore, Punjab 53720, Pakistan
privacy@internetdata.io