The GDPR or General Data Protection Regulation is a regulation within the European Union which protects the personal information of those living within the EU with regards to how their information is stored, accessed, processed and transferred online. Specifically it lays out a set of mandatory guidelines that we have to follow to maintain the privacy of both our customers and your customers when you send their personal information to us for processing.
As an address metadata company we need to receive the addresses of your visitors so that we can retrieve the data we already hold about that address in our database and then present that data to you.
Due to this it means for a brief time period we have IP address information from you and the GDPR considers IP addresses to be personal information as they can be correlated through your customers internet service providers billing system with a date and time stamp to identify who had an IP address at a specified time.
Yes you are still protected by our GDPR compliance. We protect all our customer data the same way regardless of where you visit us from and we extend the same rights for data portability and deletion to all customers. We strongly believe everyone should have the highest possible measure of privacy and control over their data.
We have gone over all of our information processes and concluded that we are using best practices for data storage and processing. We make good use of encryption for the little data we do collect and store, we only collect the bare minimum of personal information to make our business viable and we know our limitations and plan for them accordingly. Below are some examples of what we do for our own customers.
In addition to the above we also have a specified process for how we handle the IP addresses sent to us for processing by our customers. We have detailed that below also.
Any data you send us in an API call is only stored on our own servers and only accessible to us and you. We do not make available this data to any third-parties or sub-processors. Below we've detailed exactly what data we store and for how long we store it.
In the above we noted that we categorise tags and then sometimes store the categories but not the tags themselves. For example if you tagged a query with https://example.com/login our engine may determine that to be a login page and so the category would be Login Attempt. Other categories we save include Registration Attempt, Comment Spam and Vulnerability Probing among others.
In the above section we noted that Amazon AWS is able to access your email address when you give it to us. Amazon is one of our two email providers and all emails sent from proxycheck.io go through Amazon servers.
Amazon does not have permission to do anything with your email address other than to send you emails directly from us. This means you should not expect your email address to be sold, given away, added to spam lists or any other nefarious usage.
In the above section we noted that Hostinger is able to access your email address when you send us an email or use our contact form. Hostinger is one of our two email providers and all emails sent to proxycheck.io go through Hostinger servers.
Hostinger does not have permission to do anything with your email address other than to store the emails and web form messages you send us. This means you should not expect your email address to be sold, given away, added to spam lists or any other nefarious usage.
If you're a paying subscriber we also have information about you stored with our merchant of record, Stripe. Free users will not have any of their data shared with Stripe.
Yes you can. Within the customer dashboard on our website you'll find a red button in the top right corner of the settings tab called "Close account and erase all data", when you click this and confirm the deletion your entire account including all the data we hold about you will be erased from our live servers in 30 minutes time.
Please note however that some of your account data may live on in our off-site backups for 90 days, this is due to our backup systems being fully isolated from our live systems and so we cannot automatically expunge data from our backups through any mechanism on our live website. Instead our backups will naturally expire your data as time progresses with the very last copy being erased at the 90 day mark.
We have made your query statistics, positive detections, custom rules, custom lists and CORS domains downloadable and exportable from the dashboard and through JSON API's so that you can take a copy of your data to use with another data processing company at your convenience.
We take all information security very seriously. Every single one of our features has been designed with security in mind from the first moment. We hash all customer passwords, we limit how much personal information we hold and we make a conscious effort to keep all our software up to date.
When exchanging any data between the server nodes in our cluster we use strong encryption with a pre-shared key known only to us. Our checking API that receives IP data from customers also offers a TLS encrypted endpoint which customers are encouraged to use.
We know how important security is, it's after all what our entire company is built around, helping you to keep your own web properties safe.
What this responsibility means is, when you send IP or email addresses to us for processing we cannot then send those addresses to another entity to process on our behalf without written approval from the original address provider (meaning you).
We do comply with this stipulation as we do not use any sub-processors and we do not intend to ever use any.
In addition to this, anytime we take on a new data provider, we always download their data as one big contiguous block of information and then any data analysis is done on our servers by us. At no point are the IP or email addresses you send us sent to third parties.
Under the GDPR we're required to deliver a notice to our customers within 72 hours of us becoming aware of a data breach. We believe we can deliver such a notice within 24 hours and that is our current internal policy. All notices would be delivered by email directly to our customers. As of October 2025 we have had no data breaches of any kind.
Under the GDPR companies who deal in sensitive personal information must have a named data protection officer. But under the GDPR they specifically list IP addresses as a type of non-sensitive personal information and companies that deal solely in IP address metadata are not required to have a data protection officer. This would change if we held user-specific information like genetic data, health data, political opinions, names and identities etc. These are all examples of data types we do not collect or offer.
Also we should note, when you send an address to us to be checked we are providing you information we already hold on that address. The only time we're generating information based on a query you perform is to log for you that you performed an address check that resulted in an anonymous declaration from our database. In real terms this means we're not generating information about addresses that could ever lead to or point to a specific individual or group.
Before you send addresses to us for processing you should make your customers aware in plain english that their address will be sent for processing to a third party to check that they're not utilising an anonymising service to access your property.
As a data-controller you have the responsibility to take care of your customers information and you must make it clear to your customers that their data is leaving your organisation to be processed on your behalf by another organisation. You're free to make clear to your customers that proxycheck.io is your data processing partner.
To make sure you're compliant with the GDPR please read the official GDPR website here.