Privacy policy

Controller and scope

The operator identified above is the controller for IPLumo's own processing. This policy covers visits, accounts, API use and support. Privacy contact: soporte@serversgame.es.

Data and purposes

Accounts and access: name, email, password hash, verification records, session IP and browser information. These support the service, authentication and account recovery under contract or pre-contractual measures (GDPR Article 6(1)(b)). Required fields are marked in forms; accounts cannot be opened or verified without the necessary information.

API and security: key prefixes and hashes, daily account counters and per-minute/key aggregates (requests, batches, errors and rate-limit rejections), queried IPs and approximate network data. The source IP is transformed into an identifier for temporary rate limits. Lookups support the contract; abuse prevention and service protection rely on legitimate security interests (Article 6(1)(f)), subject to your right to object where applicable.

Billing: customer, subscription and payment-event identifiers for paid plans. Stripe or PayPal processes payments, depending on your choice; IPLumo does not store full card numbers. Processing supports the contract and applicable legal duties (Articles 6(1)(b) and (c)). Support messages are used to answer your request. Registration alone does not subscribe you to advertising.

Lookups and recipients

Our database combines local IP ranges with a shared lookup cache. The cache stores IP, language, result and query dates, without linking each record to an account. When a current result is missing, the queried IP is sent to an external geolocation provider; domain queries also require DNS resolution. Installed IP range databases are queried locally, without sending each query to their publishers. We do not claim that every lookup is processed exclusively on our servers.

Hosting and SMTP providers may process information needed to operate the service and deliver email. Stripe or PayPal receives data required for subscriptions when payments are enabled. Authorities may receive data where legally required. Recipients are not necessarily located in Spain or the EEA. Request information about recipients and applicable safeguards at soporte@serversgame.es.

Retention

Account, key and usage records remain while the account is active and needed for service delivery; request account closure and deletion by email. Sessions are valid for seven days and may renew with use. Lookup rate limits use a 60-second window. Expiry of access does not necessarily mean immediate deletion of historical records.

Public range data and the shared IP cache are retained on an ongoing basis for service delivery and reviewed periodically; seven days is a refresh target, not a deletion deadline. The cache is not linked to your account. You may request correction or deletion where applicable. Detailed usage aggregates and status checks are purged after 31 days. Delivered email content and recipients are removed from the queue after 90 days; event identifiers remain to prevent duplicate emails. Cleanup runs periodically while the service is operating.

Records required for tax, accounting or legal claims will be separated from ordinary use for the applicable statutory period and will not be retained for incompatible purposes.

Security and international transfers

Passwords and API keys are stored as hashes. SMTP secrets saved in administration are encrypted. The website uses HTTPS once its domain certificate is active. The current external integration may use HTTP to its provider depending on the configured service tier. Website encryption does not mean every provider connection is encrypted.

Geolocation, payment or communication services may involve processing outside the EEA. Transfers requiring safeguards must have a valid GDPR mechanism, such as an adequacy decision or applicable contractual safeguards. Contact soporte@serversgame.es for information about recipients and safeguards relevant to your processing.

Your rights

You may request access, correction, deletion, restriction and portability where applicable, and object to processing based on legitimate interests. Where consent is the basis, it may be withdrawn without affecting earlier lawful processing. Email soporte@serversgame.es with your request; additional identity information will only be requested where necessary.

Requests are generally answered within one month, extendable by two further months where justified, with notice within the first month. You may complain to the Spanish Data Protection Agency (www.aepd.es). IPLumo does not use lookups to make decisions about people with legal or similarly significant effects; IP classifications are network estimates.

Cookies and changes

The cookie policy describes authentication and language preferences. Material updates will carry a new date and be communicated where appropriate. Acceptance of a privacy notice is not a substitute for specific consent where required.