GeoIPGeoIP

Privacy Policy

As of: June 2026

1. Controller

sareba Computer & Software e.U.
Vorgartenstraße 441, A-2145 Hausbrunn, Austria
E-Mail: it@sareba.net . Phone: +43 2533 20200

A data protection officer is not legally required (no obligation under Art. 37 GDPR). For all data protection matters please contact us at the e-mail address above.

2. What data we process and why

2.1 Registration and account

We store your e-mail address and your password (solely as a bcrypt hash with cost factor 12, never in plain text). Purpose: account management, login, e-mail verification. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract). During registration you actively confirm that you have read this privacy policy and accept the terms of service.

2.2 Session management (login sessions)

When you log in we create a session (refresh token). For each session we store the IP address, the user agent (browser identifier) and timestamps. Purpose: protection against session theft, display of active sessions, token rotation / reuse detection. Legal basis: Art. 6 (1) (b) + (f) GDPR. Retention: the session is valid for up to 30 days; expired or revoked tokens are deleted after at most 7 days.

2.3 Use of the API

For each API call we log: timestamp, your caller IP address, the target IP address you queried (the lookup target, e.g. 8.8.8.8 - not your own), HTTP status, latency, the API key used and the derived country code. Purpose: protection against abuse and overload (rate limiting / DoS defence), fraud / abuse detection, billing accuracy, error diagnostics. Legal basis: Art. 6 (1) (b) (billing) and (f) GDPR (legitimate interest in the security and stability of the service). Retention: 30 days.

2.4 Visiting our website (reach measurement)

We use no cookies and no third-party trackers (no Google Analytics, no Facebook pixel, no retargeting). For our own visitor statistics we set a random session identifier that exists exclusively in your browser's sessionStorage and disappears when the tab is closed. We store: the page visited, the referrer, the user agent, the derived country code and the full IP address. This data allows a pseudonymous distinction of visits; it is not fully anonymous. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in reach measurement, abuse detection and technical optimisation). Retention: 90 days, then automatic deletion. We honour your browser's Do-Not-Track header: if DNT is set, reach measurement is suppressed entirely.

2.5 Protection against bot registrations (CAPTCHA)

During registration, Cloudflare Turnstile may be used to protect against automated sign-ups. In the process, technical connection and device data (incl. IP address, browser characteristics) are transmitted to Cloudflare. Provider: Cloudflare, Inc., USA. Legal basis: Art. 6 (1) (f) GDPR (protection against abuse). Third-country transfer: USA, safeguarded by EU Standard Contractual Clauses (Art. 46 GDPR) / EU-US Data Privacy Framework. Privacy: https://www.cloudflare.com/privacypolicy/

2.6 Payment processing

Payments are handled by external payment service providers; we ourselves store no credit card or bank account data.

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

3. Recipients / disclosure to third parties

| Recipient | Purpose | Location | Basis for third-country transfer |
|---|---|---|---|
| Stripe Payments Europe, Ltd. | payment processing | Ireland (EU) | not required (EU) |
| PayPal (Europe) S.a.r.l. | payment processing | Luxembourg (EU) / USA | Standard Contractual Clauses (Art. 46) |
| Cloudflare, Inc. | bot / abuse protection (CAPTCHA) | USA | Standard Contractual Clauses (Art. 46) / DPF |

Verification, password-reset and system e-mails are sent via a self-operated mail server - no external e-mail provider is involved, so there is no disclosure to third parties in this respect.

Beyond that, we disclose personal data only where we are legally obliged to do so (e.g. an order by an authority or a court).

4. Your rights under the GDPR

  • Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20 - provision in a structured, commonly used, machine-readable format) and
  • objection (Art. 21): you may object at any time to processing based on Art. 6 (1) (f) (reach measurement, logging) - informally at it@sareba.net. For reach measurement, setting the Do-Not-Track header in your browser is also sufficient.
  • complaint to the Austrian Data Protection Authority (https://dsb.gv.at).

Please send requests to it@sareba.net; we respond within the statutory period (generally within one month, Art. 12 (3) GDPR).

5. Retention overview

  • Account data: until termination, then deletion within 30 days
  • Session / refresh tokens: valid for up to 30 days, residual data of expired tokens max. 7 days
  • API request logs: 30 days
  • Website reach measurement (incl. IP): 90 days
  • Payment / invoice data: statutory retention period (generally 7 years, § 132 BAO)

6. Data security

Passwords are hashed with bcrypt (cost factor 12); API keys are likewise stored only as a hash. Access tokens are held exclusively in the browser's memory. Refresh tokens are HttpOnly, Secure and SameSite=Strict, are rotated on every refresh; a token used twice invalidates the entire session family (reuse detection). Transmission is exclusively encrypted (HTTPS/TLS).

7. Changes to this policy

We reserve the right to adapt this privacy policy to changed legal or technical conditions. The current version is always available at https://geoips.info/legal/datenschutz.

8. Language

The legally binding version of this privacy policy is the German one. This English translation is provided for convenience only.

Privacy Policy — GeoIP