Privacy Policy

Who we are

Ipsofax.com is operated by Ipsofax (“we”). We are the controller of the account and billing data described below. For any privacy question, contact privacy@ipsofax.com.

What we collect

• Account data: name, email address, sign-in provider identifier (Google/GitHub), tenant and plan details.
• API keys: stored only as SHA-256 hashes. We never store the key itself after it is shown to you once.
• Usage data: per-dataset click counts, credits used, endpoints and timestamps, used for billing, quotas and abuse prevention.
• Technical data: IP address at request time (rate limiting), user agent, and a signed first-party visitor cookie for the anonymous free allowance.
• Payments: handled by our payment processor. We do not receive or store card numbers. If you provide a billing address to the processor, it is held by them.

Address lookups are not stored. Query strings are excluded from our logs; the address text you search for is not written to our database.

Where your data is stored

Account, billing and usage data is stored in the United Kingdom. The address master datasets are served from Australia; regional nodes keep only hashed API keys, reservation counters and a short-lived settlement queue. Requests to update reservations or report settled clicks cross between these regions over encrypted connections.

If you are in Australia or New Zealand, this means your account data is disclosed to and processed in the United Kingdom. We take reasonable steps (contractual and technical safeguards, access controls, encryption) to protect it, and we only use it to provide and charge for the service. Australian (APP 8) and New Zealand (IPP 12) customers can contact us for details of the safeguards.

Sub-processors

We use the following categories of sub-processors:

• Cloud hosting (website and account database) — United Kingdom
• Cloud hosting (address lookup API) — Australia
• Payment processing, when you buy credits — see provider
• Transactional email delivery — EU/UK

A current named list is available on request at privacy@ipsofax.com.

How long we keep it

Account data is kept while your account is open. Usage and billing records are kept for as long as needed for accounting and dispute resolution, then deleted or aggregated. Operational logs are short-lived. Deleting your account removes your API keys and personal details; aggregated, non-identifying counters may remain.

Your rights

Depending on where you live you may have rights to access, correct, delete, restrict or export your personal data, and to object to processing. Contact us and we will respond within the time required by applicable law. You also have the right to complain to your local data protection authority (ICO in the UK, OAIC in Australia, OPC in New Zealand).

Cookies

We use a first-party visitor_id cookie (signed, HttpOnly) to count the anonymous free allowance, and an authentication cookie when you sign in. We do not use advertising or third-party tracking cookies.

Changes

We may update this policy; material changes will be posted on this page. See also our Terms of Service.