Privacy Policy
Last updated 29 October 2026
This policy explains what personal data isipsafe collects, why, and what you can do about it. The controller is Wavecentric Ltd (company number 16276203), 23a Kenilworth Gardens, Hayes, Greater London, UB4 0AY, United Kingdom. You can reach us about anything in this policy through the contact form or by post at that address.
The short version
- No advertising, no advertising trackers, no selling data. We count page views with our own analytics service.
- Visitors who are not signed in: to apply the daily lookup allowance we keep a one-way, keyed hash of your IP address for 24 hours, not the address itself.
- Account holders: we keep your email, name, optional company and a hash of your API key. Your email address is never shown publicly.
- Public profiles are on by default: your display name, any logo, website and description you add, report statistics and latest reports are public until you switch the profile off.
- Reported IP addresses and report comments are public. That is the point of the Service.
1. What we collect and why
| Data | Purpose | Lawful basis (UK GDPR) | Kept for |
|---|---|---|---|
| Public profile: display name (company or name), logo, website, description, report statistics and latest reports | Crediting reporters for their contributions and letting others judge the source of reports | Legitimate interests (Art. 6(1)(f)); you can object at any time by switching the profile off | Until you switch it off, change it or delete your account |
| Email, name, company (account holders) | Signing you in, issuing your API key, contacting you about your account | Contract (Art. 6(1)(b)) | Until you delete your account |
| Sign-in events: time, IP address, browser user agent | Security, preventing abuse, understanding how the Service is used | Legitimate interests (Art. 6(1)(f)) | 24 months |
| Session and sign-in tokens (stored only as hashes) | Keeping you signed in | Contract | 30 days, or 20 minutes for sign-in links |
| Reported IP addresses, categories, comments, times | Running a shared database of network abuse | Legitimate interests: network and information security (Recital 49) | Reports older than 24 months may be deleted or anonymised |
| Keyed hash of a visitor's IP address with a lookup counter | Applying the anonymous allowance of 400 lookups per 24 hours | Legitimate interests | 24 hours |
| Keyed hash of the IP address of reporters who reported before accounts became mandatory | Counting each reporter once, stopping duplicate and abusive reporting | Legitimate interests | As long as the report |
| Contact form messages | Answering you | Legitimate interests | 24 months |
| Page views: page address, referrer, browser type, approximate location derived from IP address | Understanding which pages are used so we can improve the Service | Legitimate interests | 24 months, in aggregate form |
| Server logs (IP address, request, time) | Security, debugging, rate limiting | Legitimate interests | 30 days |
2. Reported IP addresses
An IP address can be personal data when it can be linked to an individual, for example a home broadband connection. We process reported addresses because sharing information about attacks helps everyone protect their systems, which UK GDPR recognises as a legitimate interest. To keep this fair we only accept reports about public addresses, weight recent and independent reports, let scores decay after 30 days, and review requests from people who believe they are listed wrongly.
If you think an address linked to you is listed, you can object to the processing and ask us to review or remove reports. See section 6.
3. Who we share data with
- Everyone: reported addresses, categories, comments and scores are published on the website, through the API and in blocklists. If your public profile is on, your reports show your display name and link to your profile, which search engines may index; if it is off they show as "Verified reporter". Your email address is never published.
- Our CRM provider: when you submit the contact form, create an account or sign in, the details you gave us (and, for sign-ins, the time, IP address and browser) are sent to the customer relationship system we use to manage enquiries and accounts.
- Our analytics service at analytics.polpo-8.com, operated within our group, which receives page view data from your browser. It is not used for advertising or shared with advertisers.
- Hosting and email providers who run our servers, database and email delivery under contract and only on our instructions.
- Authorities, where the law requires it.
We do not sell personal data. Where a provider processes data outside the UK we use an adequacy decision or the UK International Data Transfer Agreement or Addendum.
4. Location data
We show the approximate country, region, city and network for IP addresses using the DB-IP Lite database, which runs locally on our servers. Looking up an address does not send it to anyone else.
5. Cookies
We set two strictly necessary cookies and nothing else. Details are in the Cookie Policy.
6. Your rights
Under UK GDPR you can ask to access, correct or delete your personal data, to restrict or object to how we use it, and to receive it in a portable format. You can delete your account yourself on your account page. For anything else, contact us and we will reply within one month. We may need to confirm who you are first.
If you are unhappy with how we handle your data, please tell us first so we can try to fix it. You can also complain to the Information Commissioner's Office at ico.org.uk.
7. Security
Everything is served over HTTPS. Session tokens and sign-in links are stored only as SHA-256 hashes. API keys are stored as a SHA-256 hash, used to authenticate requests, and encrypted with AES-256-GCM so that you, and only you, can show and copy your key on your account page. Visitors' and anonymous reporters' addresses are stored only as keyed hashes. Access to production systems is limited to the people who need it.
8. Children
The Service is meant for people who run computer systems. It is not aimed at children under 16 and we do not knowingly collect their data.
9. Changes
If we change this policy in a way that matters, we will update the date above and, for significant changes, tell account holders by email.