Privacy Policy

IPMeta ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and what rights you have in relation to it. It applies to ip-meta.xyz and all services we provide through it.

Who We Are

IPMeta is an IP intelligence API operated from the United States. We provide IP geolocation, proxy/VPN detection, ASN data, and threat scoring to developers and businesses via a REST API.

For the purposes of data protection law, IPMeta is the data controller for information you provide to us directly (account data, billing, correspondence). For IP address data processed through our API on behalf of customers, we act as a data processor.

Information We Collect

We collect information in two ways: information you give us directly, and information generated automatically when you use our services.

Information you provide:

• Email address and password when you create an account
• Billing information (processed by Paystack — we do not store card details)
• Any messages you send us via email or support channels

Information collected automatically:

• API request logs: IP address queried, timestamp, endpoint, response code, and your API key identifier (not the key itself)
• Your own IP address when you access the dashboard or website
• Browser and device type via standard server logs
• Usage metrics: request counts, error rates, plan consumption

How We Use Your Information

• To create and manage your account
• To provide and improve the API service
• To send transactional emails (API key generation, billing receipts, usage alerts)
• To enforce our Terms of Service and prevent abuse
• To comply with legal obligations
• To send product updates and announcements (you can opt out at any time)

We do not sell your personal data. We do not use your data to train machine learning models. We do not share your data with advertisers.

IP Addresses and the API

The core function of IPMeta is to enrich IP addresses with location and risk data. This section explains how that works from a privacy perspective.

What we log per API request:

• The IP address you queried (required to provide the service)
• Your API key identifier (to attribute usage to your account)
• Timestamp and response time
• HTTP status code

We do not log the end-user's identity, device fingerprint, or any other data beyond what is listed above. Request logs are retained for 90 days, after which they are purged automatically.

We do not use the IP addresses submitted via the API to build profiles of individual users, sell data, or share it with third parties except as described in Section 5.

Data Sharing and Disclosure

We do not sell, rent, or trade your personal data. We share data only in the following circumstances:

• Service providers: Firebase (Google Cloud) for hosting, authentication, and database; Paystack for payment processing; Resend for transactional email. Each is bound by appropriate data processing agreements.
• Legal requirements: If we are required to disclose information by law, court order, or valid governmental request, we will do so. Where legally permitted, we will notify you.
• Business transfers: If IPMeta is acquired or merged, your data may transfer to the successor entity. We will notify you before that happens.
• With your consent: For any other sharing not described here, we will ask you first.

Data Retention

• Account data — retained for as long as your account is active, plus 30 days after deletion to allow for recovery.
• API request logs — retained for 90 days, then permanently deleted.
• Billing records — retained for 7 years as required by applicable U.S. financial regulations.
• Email correspondence — retained for up to 2 years for support quality and legal purposes.

You may request deletion of your account and personal data at any time. See Section 8 for how to do this.

Security

We take security seriously. Measures we employ include:

• All data in transit encrypted via TLS 1.2+
• API keys hashed in storage; you only see them once at creation
• Firebase Authentication with bcrypt-hashed passwords
• Firestore security rules enforcing per-user data isolation
• IP-level rate limiting and anomaly detection on the API
• Regular review of access controls and third-party dependencies

No system is 100% secure. If you discover a security vulnerability, please report it to hello@ip-meta.xyz and we will respond within 48 hours.

Your Rights

Depending on where you are located, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Restriction: Request that we limit processing of your data.
• Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email hello@ip-meta.xyz with the subject line "Privacy Request". We will respond within 30 days. We may need to verify your identity before acting on a request.

You also have the right to lodge a complaint with your local data protection authority.

Cookies and Tracking

We keep cookie use minimal. Here's what we use and why:

• Firebase Authentication session cookies — strictly necessary to keep you logged in. These expire when you sign out or after 30 days of inactivity.
• localStorage — used to remember UI preferences (e.g. selected plan, sidebar state). No personal data is stored.

We do not use Google Analytics, Facebook Pixel, or any third-party advertising trackers. We do not run behavioural advertising.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. For material changes, we will notify registered users via email at least 14 days before the changes take effect.

Continued use of IPMeta after a policy update constitutes your acceptance of the revised terms.

Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or your personal data, reach us at: