This Privacy Policy explains what information BINtools.io ("we", "us") collects when you use the Service, how we use it, and your rights with respect to it. We are committed to keeping data collection to the absolute minimum required to operate the Service.
1. The Data We Collect
1.1 Data You Submit
The Service runs almost entirely in your browser. The values you type into BIN-lookup, IP-lookup, ZIP-radius, fraud-score, and the various generators are processed client-side wherever technically possible. When a server-side lookup is required (e.g., the BIN database, GeoNames ZIP table), only the specific value of the lookup is transmitted to our backend — never any identifying information about you.
1.2 Data We Receive Automatically
Like every web service that operates on the public internet, our HTTP servers automatically receive certain technical metadata with each request, including:
- your IP address (used solely for rate-limiting and abuse prevention);
- the HTTP user-agent string sent by your browser;
- the HTTP referrer, if any;
- the request path, status code, response size, and timestamp.
These access logs are retained for a maximum of 14 days and are used exclusively for security, abuse mitigation, and debugging. They are not analyzed, profiled, or sold.
1.3 What We Do Not Collect
- We do not require registration, accounts, email addresses, or any personal information.
- We do not use third-party advertising, behavioural tracking, or cross-site tracking.
- We do not sell, rent, lease, or otherwise transfer any user data to third parties.
- We do not retain the inputs to or outputs from the in-browser generators, period.
2. Cookies and Local Storage
The Service uses minimal first-party browser storage:
- a single
localStoragekey to remember your preferred UI language, if you choose one; - a single
localStoragekey to remember UI theme/dark-mode, if applicable.
We use Yandex Metrika for privacy-friendly aggregate analytics (visit counts and referrers only — session recording and click-maps are disabled). We do not use Google Analytics, Facebook Pixel, Hotjar, advertising trackers, or cross-site behavioural profiling. Please see our Cookie Policy for details.
3. Third-Party Reference Data
To provide certain lookups, the Service relies on publicly licensed reference data from third parties:
- GeoNames Postal Code dataset (CC-BY 4.0) for ZIP/postal-code coordinates;
- publicly available BIN/IIN reference tables;
- OpenStreetMap (ODbL) data (where applicable).
These datasets are queried on our servers; the third-party providers do not see your IP, your queries, or any other information about you.
4. Legal Bases (GDPR / UK GDPR)
Where the GDPR or UK GDPR applies, our legal bases for processing are:
- Legitimate interest (Art. 6(1)(f) GDPR) — for security logging, rate limiting, and abuse prevention;
- Consent (Art. 6(1)(a)) — for the strictly first-party preference cookies, which you may disable at any time in your browser.
5. Your Rights
Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or port your personal data. Because we do not maintain user accounts and our access logs contain only IP-level metadata that we cannot tie back to a specific individual without additional information, the practical scope of these rights is limited. You may, however, exercise your right to object to processing or to request access to any IP-keyed log entries by contacting us; we will respond within 30 days where required by law.
6. Data Retention
- HTTP access logs: maximum 14 days, then permanently deleted;
- Application-level error logs: maximum 30 days;
- No long-term retention of any user-submitted content.
7. International Transfers
The Service is hosted in a single region. If you access it from outside that region, your request metadata will necessarily transit international networks. Where applicable, we rely on Standard Contractual Clauses (SCCs) and the principles of necessity and minimization for any cross-border processing.
8. Children
The Service is not directed to children under the age of 16, and we do not knowingly collect any information from minors. If you believe a minor has accessed the Service in a manner that triggers data-protection obligations, please contact us and we will take appropriate action.
9. Security
We use TLS for all transport, hardened HTTP servers, rate-limiting at the application and network layers, automated dependency scanning, and the principle of least privilege on the server side. No system is perfectly secure, but we make a good-faith effort to keep the Service safe.
10. Changes
We may update this Privacy Policy from time to time. The current version is always available at https://bintools.io/privacy.html. Material changes will be reflected by updating the "Last updated" date.
11. Contact
For privacy questions or to exercise any data-protection right described above, see our About / Contact page.