Privacy Policy
Last updated: Oct 8, 2026
This notice is provided under the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK). It explains which data is processed when you use whoistool.net, why, and what your rights are.
1. Controller
Controller: [not specified yet]
Address: [not specified yet]
Contact: [not specified yet]
2. What we process
Lookups: the domain, IP address or keyword you type. If you paste a URL, your browser sends only its domain to our server; if you paste an e-mail address, only the domain after the @ sign.
Technical logs: our lookup service does not log your IP address; it keeps a short irreversible hash instead. The per-minute lookup limit that prevents abuse also keeps only a hash of your IP address, for at most one minute. The hosting server's web access logs contain your IP address, the requested page and browser details for security purposes.
Account (only if you use watching): your e-mail address, language, the domains you watch and your notification channel choices, your Telegram chat ID if you connect Telegram, a record of the alerts sent to you and session data.
Domain records: public whois/RDAP, DNS and SSL data of the domains you look up is cached briefly. For watched domains we keep a history of registrar, dates, status codes and name servers; this history never contains the domain holder's personal data (name, e-mail, phone, address).
In your browser: your recent searches and your cookie choice are kept only in your browser's local storage and are never sent to us.
Google Analytics: only if you allow it, Google collects usage statistics such as pages visited, device and browser type and approximate location.
3. Purposes and legal bases
Answering lookups and providing the service: performance of a contract and legitimate interests (GDPR Art. 6(1)(b), (f); KVKK Art. 5/2-c, f).
Security, preventing abuse and overload: legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-f).
Account, sign-in links and watch alerts: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c).
Usage statistics (Google Analytics): your consent (GDPR Art. 6(1)(a); KVKK Art. 5/1). You can withdraw it at any time on the Cookie Policy page.
4. Who receives data
When you look something up, the domain or IP address you asked about (not your identity) is sent to: domain registries and registrars (RDAP/WHOIS), Cloudflare and Google for DNS queries (DNS-over-HTTPS), Team Cymru and the regional internet registries (RIPE NCC, ARIN, APNIC, LACNIC, AFRINIC) for IP and network data, and the server you looked up itself for the SSL check.
Alert and sign-in e-mails are sent from our own mail server. If you connect Telegram, alerts are delivered through Telegram (Telegram Messenger Inc.).
If you allow it, usage data is shared with Google Analytics (Google LLC / Google Ireland Ltd.).
Cloudflare, Google and Telegram operate servers outside Türkiye and the EU. What is transferred to them is limited to the domains and IP addresses being looked up, analytics data if you consented, and alert messages if you connected Telegram. Your data is not sold and not used for advertising.
5. How long we keep it
| Data | Retention |
|---|---|
| Cache of lookup results (public data) | 1 minute – 24 hours |
| IP hash for the lookup limit | At most 1 minute |
| Lookup service logs (hash instead of IP) | Size-limited; about 30 MB at most, then deleted |
| Web server access logs (contain IP) | At most 30 days |
| Sign-in link | 15 minutes; deleted once used |
| Session | 30 days or until you sign out |
| Account, watched domains, alert history, Telegram link | Until you delete your account |
| Record history of watched domains (no personal data) | Indefinitely |
| Google Analytics data | As set in Google Analytics data retention |
6. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, to withdraw consent, and to learn who received your data (GDPR Art. 15–21; KVKK Art. 11).
You can delete your account and all data tied to it at once with the "Delete my account" button in the watch panel. For any other request write to [not specified yet]; we answer within 30 days.
You may also lodge a complaint with your data protection authority (in Türkiye: the Personal Data Protection Board, KVKK).
7. Changes
When we update this notice we change the date at the top of the page.