Pricing
Docs

Privacy Policy

Last updated: 24 June 2026

IPTruth is a trading name of Athlok Ltd, a company registered in England and Wales (company number [COMPANY NUMBER]) whose registered office is at [REGISTERED OFFICE ADDRESS] ("IPTruth", "we", "us", or "our"). We are the controller of the personal data described in this policy, except where we act as a processor on a customer's behalf (see "IP addresses and queries"). This policy explains how we collect, use, and protect personal data when you use our website, tools, and API (the "Services"), and your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where it applies, the EU GDPR.

For any data protection question, contact our data protection team at privacy@iptruth.com. We are registered with the UK Information Commissioner's Office (ICO) under registration number [ICO REGISTRATION NUMBER].

Information we collect

Account information

When you create an account, we collect your name, email address, and, where relevant, company name. If you subscribe to a paid Plan, our payment processor collects your billing details on our behalf; we do not store full card numbers.

Usage data

We automatically collect information about how you interact with the Services, including API call volumes, endpoints accessed, timestamps, and response codes. We use this to operate the Services and to show usage analytics in your dashboard.

IP addresses and queries

Our core Services process IP addresses. This happens in two ways. First, we maintain IP intelligence datasets in which IP addresses appear as network identifiers. Second, when you submit an IP address to look up, we process that query. We log query inputs and the visitor IP addresses connecting to the Services for a limited period for rate limiting, security, and abuse prevention, then aggregate or delete them. Where you submit IP addresses to our API as part of your own product, we generally act as a processor handling that data on your behalf and on your instructions.

Website analytics and cookies

We use Google Analytics and Google Tag Manager to understand how visitors use the website, with IP anonymisation enabled. We set essential cookies for authentication and security, and use non-essential analytics cookies only where permitted. See our Cookie Policy for details and choices.

Is an IP address personal data?

An IP address, or coarse location derived from it, can be personal data under the UK GDPR in some circumstances, and may not be in others. The location data we provide is network-level and approximate (typically country, region, or city) and is not intended to identify an individual or household. Where we do process information that is personal data, we handle it in accordance with this policy and applicable law, whether or not a given data point identifies a person on its own.

How we use personal data and our lawful bases

  • to provide, maintain, and improve the Services, and to provide support (lawful basis: performance of a contract, and our legitimate interests in running and improving the Services);
  • to process payments and manage subscriptions (performance of a contract);
  • to secure the Services and prevent fraud, abuse, and rate-limit evasion (legitimate interests, and compliance with legal obligations);
  • to send service messages, and, where you have opted in, marketing (legitimate interests or consent, which you can withdraw at any time);
  • to comply with legal, tax, and accounting obligations (legal obligation).

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms.

Sharing and processors

We share personal data only as needed to run the Services, with processors acting on our instructions:

  • Payments: Stripe, to process subscription payments. We do not store full card details.
  • Infrastructure and security: Cloudflare, for hosting, content delivery, and protection against attacks.
  • Analytics: Google (Analytics and Tag Manager), with IP anonymisation, to analyse website use.

We do not sell, rent, or trade personal data. We may disclose data where required by law, to enforce our terms, or to protect our rights, our users, or the public. If we are involved in a merger, acquisition, or sale of assets, data may transfer subject to this policy.

International transfers

Some of our processors are based outside the United Kingdom and the European Economic Area, including in the United States. Where we transfer personal data abroad, we rely on an adequacy decision where one exists, or on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses, together with additional measures where needed. You can ask us for more detail using the contact below.

Data retention

We keep personal data only as long as necessary:

  • account data: for the life of your account and up to 30 days after deletion, subject to the items below;
  • query inputs and visitor IP logs: for up to 90 days for debugging, security, and abuse prevention, after which they are deleted or anonymised;
  • billing and transaction records: for at least six years, to meet UK tax and accounting requirements;
  • aggregated or anonymised data, which no longer identifies anyone: indefinitely.

Your rights

Under the UK GDPR (and the EU GDPR where it applies) you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where we rely on it. To exercise any of these, email privacy@iptruth.com.

Because we usually cannot link an IP address to a named person, requests about a specific IP address may need extra verification, for example confirmation that the request comes from, or with the authority of, the holder of that IP address or network. This protects against disclosing or changing data at the request of someone unconnected to it.

If you are in California, the CCPA gives you rights to know what personal information is collected, to request deletion, and to opt out of "sales"; we do not sell personal information. If you are in the EEA, you may contact our EU representative at [EU REPRESENTATIVE CONTACT].

If you are unhappy with how we handle your data, you can complain to the ICO at ico.org.uk, or to your local supervisory authority. We would appreciate the chance to address your concern first.

Correcting or delisting an IP record

If you believe an IP address is associated with the wrong location or details, you can ask us to review it. Email privacy@iptruth.com with the IP address or range and the correct information, or your request that we stop associating it with a particular location. We review such requests, may ask you to verify control of the IP address or network, and update our datasets in a future release where a change is justified. We may decline requests that cover very broad ranges or shared addresses, or suggest you contact the relevant network operator.

Security

We use appropriate technical and organisational measures, including encryption in transit (TLS) and at rest, access controls, and monitoring. No method of transmission or storage is completely secure, but we work to protect your data and to meet our breach-notification obligations.

Children

The Services are not directed to children under 18, and we do not knowingly collect their personal data.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and change the "Last updated" date, and will tell you about material changes where required.

Contact us

For privacy questions or to exercise your rights, contact: