Privacy policy

Official website: ip123.us

Privacy contact: support@ip123.us

This Policy explains how IP123 ("we" or "us") handles personal information and the rights you may exercise when we provide the user dashboard, proxy services, APIs, support, and IP123 Lookup query and browser environment tools through our official website at ip123.us.

Proxy services require network connection information, and some Lookup checks send requests to third-party testing nodes. Below, we distinguish local browser calculations, information submitted to IP123, and information sent to external services. Browser fingerprint hashes and random identifiers may remain linkable to a device or user; hashing does not automatically make information anonymous.

1. Policy Scope and Processing Roles

1. For account management, orders, payment reconciliation, website operations, and support data whose processing purposes and methods we determine, the entity identified at the beginning of this Policy bears the relevant responsibility.
2. Third-party websites, AI platforms, payment institutions, and other independent services you access through proxies process information under their own policies. We do not control all their activities. Our own disclosures to them remain subject to this Policy and applicable law.
3. If you engage us to process information about your customers, employees, or others, both parties must clarify their roles, instructions, and necessary data processing terms based on the actual arrangement. This Policy does not replace agreements required by law.
4. Browsing the website or accepting the Terms of Service does not imply consent to all nonessential processing. We must obtain consent, separate consent, or other special authorization individually where required by law.

2. Information We Process and Why

1. Account Registration, Sign-In, and Security

For registration, sign-in, email verification, password recovery, and profile maintenance, we process email, account ID, username, password verification information, verification codes and results, sign-in status, and necessary security records to identify accounts, protect access, and perform service commitments. Credentials such as passwords must be secured appropriately and not used for marketing or unrelated purposes.

We retain necessary account and sign-in records for account security, audits, abuse investigations, and legal obligations. Sign-in record details are [To be confirmed: log fields, purposes, retention periods, and authorized personnel].

Choosing Google sign-in directs you to its authentication flow. We receive identifiers and account details needed to sign you in within the actual authorization. Fields depend on the authorization page and API: [To be confirmed: identifiers, email, and other fields actually received from Google sign-in]. Declining third-party sign-in does not prevent using other sign-in methods actually offered.

2. Orders, Payments, and Wallet

For purchases, renewals, deposits, refunds, and reconciliation, we process product type, selected region, quantity, rental period, bandwidth, amount, currency, discounts, order number, payment channel, transaction status, deposit and spending records, balance, and refunds. Referral codes or related benefits also involve submitted codes and benefit-association records.

External payment channels receive information necessary for payment, risk controls, and reconciliation, and return payment status and necessary transaction identifiers. Card input is handled by payment services through integrated Stripe components. The full fields we receive and payment flow depend on configuration; third-party processing does not mean we never access any payment information.

On-chain payments such as USDT or USDC may involve addresses, assets, networks, amounts, transaction hashes, and publicly verifiable blockchain records. We generally cannot delete public blockchain records, which others may observe or correlate.

3. Proxy and API Services

For allocation, authentication, renewal, maintenance, and billing, we process account-resource associations, assigned IP addresses and ports, protocols, authentication settings, rental periods, order status, auto-renewal settings, API Key associations, and API authentication results.

We keep necessary proxy allocation records and use account, sign-in, order, and billing records to investigate security incidents and abuse complaints. Allocation records differ from logs of traffic content. Details are [To be confirmed: allocation log fields, retention periods, and access rights].

Network connectivity necessarily involves technical information such as source IP, proxy endpoint, target host or IP and port, connection time, traffic volume, and connection status. Immediate forwarding does not mean persistent storage. Specific log fields, purposes, and retention scope follow below.

Connection log disclosure: [To be confirmed: fields processed and retained separately by IP123 and upstream providers; whether DNS, target domains, URLs, headers, or content are involved; purposes, retention periods, and recipients].

HTTPS content is protected where encryption is not terminated. Visibility of unencrypted HTTP, DNS, destinations, and other metadata depends on connection methods and network nodes. Do not treat proxies as a guarantee of hiding identity or protecting sensitive content from all participants.

4. IP Queries and Risk Assessments

When you use Lookup, the IP service receives your request's network IP and any query IP you enter. It may also receive request time, path, browser headers, and response status to answer queries, maintain availability, and prevent abuse. When visit reporting is enabled, the page also calls IP123's visit-reporting endpoint.

Results may include approximate location, ISP, ASN, network origin, time zone, risk, or AI-service assessments. They generally derive from network-address information and assessments, not precise device geolocation, and should not be treated as verified personal identity information.

Query and visit API logs: [To be confirmed: fields actually logged, account or device linkage, legal basis, retention periods, and API operator]. Only query IP information you are authorized to process or have a lawful purpose to use.

5. Browser Environment and Fingerprint Checks

Testing pages use browser APIs within their permissions to read and calculate environment information, including browser and OS, language, time zone, screen, hardware, graphics and audio capabilities, fonts, automation indicators, network information, and permission status. Canvas, WebGL, audio, and font features may be used to compute fingerprint hashes and combined visitor identifiers.

Current fingerprint hashes and combined identifiers are computed locally and displayed in the browser. This does not mean the whole page makes no network requests. IP queries, WebRTC, DNS, reverse lookups, and page statistics contact servers through their respective flows, as described in Section 3.

For audio/video device checks, the browser may first return a device list within existing permissions. Active checks for expanded details request microphone or camera permission, which you may refuse or revoke in the browser. Currently, temporary media streams read device information and then stop their tracks; they do not record or upload audio/video. Browser restrictions may limit results.

6. Customer and After-Sales Support

Online support and support requests involve conversation content, attachments you provide, order explanations, contact details, and identifiers used to maintain session continuity.

The website and dashboard use a Chatwoot-based support system currently accessed through cloudunk.com. For signed-in users, the integration sends account ID, display name, email, and, when successfully retrieved, balance and total deposits to identify users and investigate orders and deposits. Signed-out users receive random visitor IDs and system-generated placeholder names or email identifiers; a placeholder email is not a real email you separately supplied.

Redact proxy passwords, Tokens, API Keys, card data, and unrelated personal information before sending logs or screenshots. We must process only what is necessary to resolve the issue and restrict support access. Support operators, locations, and retention are covered by the items awaiting confirmation in Sections 3 and 6.

7. Notices, Marketing, and Legally Required Processing

We use account contacts for necessary verification, security, order, expiry, and support notices. Marketing subscriptions, if offered, require applicable authorization and an opt-out. Declining marketing does not affect ordinary transactions or essential notices.

We may also process information as necessary and legally permitted or required to prevent fraud, respond to valid legal process, handle complaints, and protect lawful rights. "Security needs" do not justify unlimited collection or retention.

3. External Services and Information Recipients

1. Payments and Third-Party Authentication

Payment services include Stripe and channels actually offered at checkout; third-party authentication includes Google sign-in you choose. These organizations may act independently for payment, fraud prevention, or authentication. We must provide necessary explanations when used and not extend authorization to unrelated data.

Service-list additions: [To be confirmed: acquiring entities and payment aggregators, Google authentication recipients, their contacts, processing locations, data fields, and privacy policy links]. A displayed payment-method name does not necessarily identify every legal recipient.

2. Online Support

Chatwoot is the software name and cloudunk.com the configured endpoint; neither establishes the actual operator or server location. Received data includes the account identification, balance, total deposits, and conversations listed in Section 2.

Support processor: [To be confirmed: cloudunk.com's actual operator, whether self-hosted by IP123, processing relationship, locations, retention, and privacy policy links]. Disclosures to independent controllers require lawful notice and authorization; outsourced processing requires agreed purposes, access, and security obligations.

3. Website Analytics

Lookup integrates Google Analytics and Baidu Analytics. Its current production configuration enables both and IP123 visit reporting, subject to deployment settings and browser blocking. When enabled, requests reach Google and Baidu analytics endpoints. Google Analytics page-view events include the full page URL, path with query parameters and fragments, and page title; scripts may also process device and visitor identifiers, referral sources, and usage according to their settings. Do not put passwords, Tokens, or unnecessary personal information in URL parameters or fragments.

Recipients and subsequent processing are described in the providers' privacy notices, including Google's Privacy Policy and Baidu's privacy page. Advertising features and purposes apply only after clear notice and a lawful basis.

Analytics configuration: [To be confirmed: production scope, events and fields, Cookie lifetimes, retention settings, recipients, and cross-border arrangements]. Where law requires consent before nonessential analytics load, we must offer choices and enforce them first. Publishing this Policy alone is not valid consent.

4. DNS, WebRTC, and Reverse Lookup Checks

DNS leak checks currently request random subdomains under ipv4.surfsharkdns.com to observe resolvers. Surfshark's testing service and participating DNS infrastructure may receive source IP, resolver IP, query identifiers, and request times.

Reverse DNS queries and some WebRTC node resolution use Cloudflare DNS over HTTPS. The service may receive source IP, queried domains or reverse names for IP addresses, request time, and browser request metadata.

Quick WebRTC checks try Google's STUN nodes, using Cloudflare if needed. Multi-node checks also try public STUN nodes from QQ, Bilibili, Xiaomi, and others. Nodes receive public IP, ports, and connection times needed to establish connections; exact data depends on node and browser behavior.

These checks may start automatically when you open the relevant page. WebRTC may use a different network path from ordinary web requests, displaying or exposing a public address different from your proxy exit IP. To avoid such requests, do not enter or leave the page, or restrict network capabilities in the browser. Some checks will then be unavailable.

Additional node disclosure: [To be confirmed: operators, regions, privacy policies, and necessary cross-border arrangements for these public and other actual nodes]. We must not describe independent public-node logs as controlled or deleted by us.

5. Infrastructure and Other Necessary Recipients

Hosting, network, email, and security vendors may process data only as necessary for the features they actually provide. The list is [To be confirmed: actual vendors, roles, purposes, data categories, locations, and policy links]. Services not actually used are not listed as integrated.

Providing services does not automatically authorize sale or publication of personal information. Sharing, selling, or disclosing to independent controllers beyond this Policy requires compliance with law and additional notice. For lawful authority requests, we verify the basis, powers, and scope, and explain to affected users where legally permitted.

Mergers, reorganizations, or business transfers must use lawful, necessary arrangements and safeguards for affected data and provide required notice. Recipients changing original purposes or methods must meet new notice and authorization obligations.

4. Cookies and Browser Storage

1. Sign-in Cookies and session storage maintain sign-in status and necessary account displays on ip123.us. Language Cookies or local storage retain language preferences.
2. Online support uses Cookies, session identifiers, and browser storage to maintain conversations, and pages may save the support button's position. Some Lookup AI-related IP query history is stored in the current browser's localStorage for local review; this does not automatically make it a cross-device account record.
3. Enabled analytics services may set their own Cookies or identifiers according to actual configuration. Cookie inventory: [To be confirmed: names or categories, providers, purposes, lifetimes, necessity, and available controls].
4. Browser controls let you view, delete, or limit Cookies, localStorage, sessionStorage, and permissions, alongside any actual page clearing features. Clearing may sign you out and remove local history and preferences; it does not automatically delete server or third-party records.
5. Where law requires nonessential Cookie choices, controls must match actual loading behavior, and refusal or withdrawal must not affect necessary functions. The choice entry point is [To be confirmed: available controls to reject and withdraw nonessential Cookies].

5. Legal Bases and Necessity

We determine lawful bases under the laws applicable to each user, business, and processing activity. These may include necessity to enter into or perform your contract, legal obligations, valid consent, and legitimate interests only where local law recognizes them and necessary assessments are completed. Bases from different jurisdictions are not interchangeable.

Authentication, delivery, payment reconciliation, and essential support generally relate to performance. Marketing, nonessential analytics, and sharing, sensitive processing, or international transfers requiring special consent must each meet their requirements. Under GDPR legitimate interests, we must identify the specific interest and assess impacts on individuals; simply stating "improving services" is insufficient.

Refusing necessary information may prevent the relevant feature; we will explain the effect. Refusing or withdrawing nonessential consent does not invalidate earlier lawful processing or justify denying unrelated basic functions.

Before using information for a new purpose, we must verify the legal basis, compatibility, and necessity and provide additional notice or obtain fresh authorization where required.

6. Retention and Deletion

Retention follows the shortest period necessary for the specific purpose, applicable accounting, tax, and mandatory requirements, and disputes, not indefinite storage. At expiry, data is deleted or lawfully anonymized. Hashes or deidentified records still linkable to individuals are not treated as anonymous.

• Account and authentication data: [To be confirmed: rules while active and deletion or anonymization after closure].
• Order, payment, and wallet records: [To be confirmed: applicable law, starting points, and years retained].
• Proxy connection and API logs: [To be confirmed: field categories, respective periods, and upstream rules].
• Lookup query, visit, and security logs: [To be confirmed: fields, periods, and aggregation rules].
• Support conversations, attachments, and account snapshots: [To be confirmed: periods after conversations and necessity of linked financial fields].
• Website analytics: [To be confirmed: actual Google Analytics, Baidu Analytics, and internal statistics retention settings].
• Backups: [To be confirmed: rotation, maximum residual period, and deletion after restoration].

Local browser history and preferences follow their storage mechanisms and may remain until you clear them, the browser cleans them, or features change. Session storage generally lasts for the browser session, but closing and restoration behavior is browser-dependent.

Data legally exempt from deletion is retained only for the applicable purpose and period, with other use restricted. For public blockchains or independently processed third-party data, we explain what we control without promising to reverse public records.

7. Storage Locations and International Processing

IP123's primary business data is stored in [To be confirmed: actual countries or regions]; backups and disaster recovery are in [To be confirmed: countries or regions]. Support, payment, analytics, and public testing nodes may be elsewhere. Recipients, data categories, and locations are disclosed in the additional lists in Section 3.

Selecting an overseas exit does not mean all account and query data is stored there. A domain, CDN node, or proxy country does not establish the actual database location.

Restricted international disclosures require lawful notices, impact assessments, separate consent, or other procedures, plus applicable standard contracts, certifications, adequacy decisions, or other valid safeguards. Actual mechanisms and document access: [To be confirmed: each cross-border arrangement and request channel]. Continued use is not blanket consent to all international disclosures.

8. Security and Incident Response

We must use risk-appropriate access controls, transmission protection, credential management, staff confidentiality, and incident response, restricting account, payment, and support data access. Details are [To be confirmed: actually deployed safeguards suitable for public disclosure].

Internet transmission and storage cannot be absolutely secure. For incidents affecting personal information, we promptly investigate, contain, remediate, and provide legally required notices to regulators and affected individuals, including relevant circumstances and available measures.

Use reliable passwords and encrypted connections, and protect sign-in devices and proxy credentials. Report account anomalies or information leaks through the contact details at the beginning of this Policy or official support.

9. Your Rights and How to Exercise Them

Under applicable law, you may request information about processing, access and copies, correction, deletion, restriction, consent withdrawal, and account closure. Where eligible, rights also include portability, objection to specific processing, and challenges to automated decisions.

Supported email and password changes are available in the dashboard. For closure, export, deletion, other privacy requests, or corrections you cannot make yourself, email support@ip123.us or use official support. Not every right has a self-service button; we handle requests through actual channels.

To prevent impersonation, we verify identity proportionately to risk, prioritizing existing account relationships without unnecessary identification documents. Acting for another person may require reasonable proof of authority.

We respond within statutory time limits, or a reasonable time with progress updates if none applies. Service target and escalation: [To be confirmed: response times, responsible team, and complaint route]. If unable to comply, we explain reasons, legal grounds, and remedies.

Before closure or deletion, outstanding orders, active resources, disputes, and refunds must be handled properly. Mandatory retention does not prevent deletion of other unnecessary data. Revoke media permissions or clear history in your browser, and stop marketing through available unsubscribe channels.

Lookup risk scores and browser results are informational, not directly decisions with legal or similarly significant effects. If we later use personal information for such automated decisions, we must separately explain the logic, effects, and human-review and objection channels.

If your rights are not properly addressed, you may complain to a competent data protection or other authority or seek judicial remedies. Required regional representative or data protection officer details: [Complete if applicable: name or organization and contact details].

10. Minors

IP123 accounts and paid proxy services are for users aged 18 or older with legal capacity, not minors. This statement does not release us from legal duties concerning minors' information we actually encounter.

Guardians may contact us if a minor's information was processed without valid authorization. We will verify, restrict processing, and delete information that should not be retained under applicable law. Additional child-data, guardian-authorization, and protection requirements apply where required.

11. Policy Updates

We display update and effective dates here. Material changes to purposes, data categories, recipients, international arrangements, or your rights are notified clearly and reasonably. Processing requiring renewed consent or other procedures begins only after those steps are complete.

Updates do not retroactively legalize processing that lacked a lawful basis. After notice, you may contact us about changes and exercise your applicable rights.

12. Contact Us

For access, correction, deletion, account closure, third-party recipients, retention, or international arrangements, email support@ip123.us or use official support at ip123.us.

Please state the request type, relevant account or usage context, and the response you seek. Do not include complete passwords, verification codes, card numbers, or other unnecessary sensitive information in the initial request.