Privacy Policy

1. Introduction

BlurLoc is an IP geolocation service that is designed around prefix-based lookups. The goal is to provide location and network signals while minimizing how often exact IP addresses need to be disclosed to the lookup service.

This policy describes data processing for:

• the public website at blurloc.com, and
• the BlurLoc IP prefix lookup API.

2. Website data processing

When you visit the BlurLoc website, your browser sends the usual technical information needed to deliver pages securely. BlurLoc operates with a narrow set of processing activities and avoids unnecessary tracking.

• The website uses only technically necessary cookies.
• The website does not use analytics tools.
• The website does not run third‑party trackers.
• The website does not embed third‑party resources (such as external fonts, CDN widgets, or social media scripts).
• The website is protected by basic bot protection and a web application firewall (WAF).
• Basic error tracking is in place to keep the service reliable.

The web server is configured so that request payloads, user agents, and similar metadata are not used for profiling or marketing. Only operationally necessary information is processed for security, performance, and troubleshooting.

3. API data processing

The BlurLoc API is designed so that the lookup service does not require the exact IP address in the intended architecture. Clients are expected to send coarse prefixes, for example /16 ranges or truncated dotted prefixes.

In the intended flow:

• Clients send a network prefix instead of a full IP address.
• The lookup payload describes a range of addresses, not a single host.
• BlurLoc receives a coarse network signal rather than an individual user address.

Exact IP addresses may still be submitted if the calling integration disables Strict Mode. In that case:

• The request is accepted and processed.
• The response indicates that an exact IP was submitted.
• Exact IP addresses are not logged or stored by the BlurLoc service.

BlurLoc is therefore designed to minimize the disclosure of exact IP addresses to the lookup service, while still allowing integrations that occasionally send full IPs when Strict Mode is not enabled.

4. Infrastructure and subprocessors

BlurLoc is operated by Sebastian Beyer – BlurLoc, an Austrian Einzelunternehmen.

The current infrastructure is:

• Hosting provider: Hetzner Online GmbH (Germany).
• All servers are located in the European Union.
• Monitoring and error tracking: a self‑hosted SigNoz instance.
• Payment processor for future paid plans: Stripe.

No other subprocessors are currently used. If this changes, the list will be updated accordingly.

5. Data retention

BlurLoc aims to keep operational data retention narrowly scoped.

• Operational logs that are needed to keep the service secure and stable may be stored for up to 30 days.
• Backups that include operational data are stored for up to 30 days.
• No lookup request payloads (such as prefixes or IP addresses) are stored as part of these logs or backups.

BlurLoc does not log client IP addresses, request payloads, request metadata, user agents, or API lookup inputs for analytics or profiling purposes. Minimal operational data may be logged for incident investigation and security, for a limited time.

6. Cookies

BlurLoc uses only technically necessary cookies that are required to operate the website and API securely.

• No analytics cookies are set.
• No marketing or tracking cookies are set.
• No third‑party cookies are used.

7. Payments

BlurLoc is not currently charging customers. When paid plans are introduced, payments will be processed through Stripe.

In that future setup, Stripe will receive the payment information necessary to complete a transaction. BlurLoc will not store full payment card details on its own servers.

8. Data subject rights

Individuals in the European Union and other regions may have rights under applicable data protection laws. Depending on the legal framework, these can include:

• the right to request access to personal data;
• the right to request correction of inaccurate data;
• the right to request deletion of data where appropriate;
• the right to request restriction of processing in certain circumstances;
• the right to object to certain types of processing; and
• the right to data portability where technically feasible and applicable.

Because BlurLoc is designed so that the lookup service does not usually receive exact IP addresses in the intended prefix‑based architecture, there is often very little personal data to link to a specific individual. Where BlurLoc does act as a controller or processor for personal data, requests will be handled in line with applicable law and technical feasibility.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

9. Contact for privacy inquiries

For questions about this policy or the handling of personal data, please contact:

Sebastian Beyer – BlurLoc
Effingergasse 18
1160 Vienna
Austria

Email: [email protected]