This policy applies to the Whatoblock public website, dashboard, accounts, subscriptions, support channels, threat intelligence tools, and industry blocklists.
Overview
Whatoblock.com is responsible for the personal data described in this policy. This includes data provided by visitors and account holders, technical information created when the service is used, and network source data observed by our sensors.
Questions and privacy requests can be sent to [email protected]. We may ask for enough information to confirm your identity before acting on a request.
Information we collect
Website and device information
When you visit or use the service, our systems may receive your IP address, request time, requested page or resource, browser and device information, referring page, and security events connected with the request.
Account and authentication information
When you create an account, we collect a username, email address, password hash, verification status, profile preferences, and newsletter choice. If you enable additional authentication, we also store the credential and recovery information needed to operate two factor authentication or passkeys.
Subscription and billing information
For paid services, we keep your plan, subscription status, entitlement, billing period, Stripe customer and subscription identifiers, and related transaction events. Stripe processes complete payment card details. Whatoblock does not store your complete card number.
Product use and communications
We may record searches, downloads, saved preferences, alert settings, request counts, support messages, contact form submissions, and email delivery events. These records help deliver the requested feature, answer support questions, and investigate abuse or failures. When you accept our terms, for example before creating a blocklist feed, we record which version you accepted and when.
Sensor and threat data
Our sensors record connections made to the services they expose. A record may include the source IP address, observation time, transport, port, protocol or service, and limited characteristics of the connection or payload where collected for security analysis.
We may add network and location context such as country, autonomous system number, internet service provider, organization, hosting classification, and related observation history. We use this data in Scanner Recon, Heartbeat, Botnet and C2, OpenData, network rankings, and industry blocklists.
A source IP address associated with suspected malicious activity may constitute personal data where it can be linked, directly or indirectly, to an identifiable person. A sensor observation alone does not prove who controlled the source, their intent, or whether the activity was malicious.
Why we use information
We use personal and technical information for the following purposes and legal bases:
- Provide the service: To create accounts, authenticate users, deliver searches, downloads, feeds, alerts, subscriptions, and support. This processing is necessary to perform our agreement with you or take steps you request before entering it.
- Protect the service: To detect abuse, enforce limits, secure accounts, investigate incidents, and maintain reliable infrastructure. We rely on our legitimate interests in operating and protecting Whatoblock and its users.
- Produce threat intelligence: To catalogue sensor observations, relate activity across records, maintain threat history, and provide research and defensive security products. We rely on legitimate interests in cybersecurity research, measurement, and network protection.
- Meet legal obligations: To keep records, respond to valid legal process, handle consumer rights, and meet accounting, tax, and regulatory duties where they apply.
- Send optional communications: To send newsletters or other optional messages when you request them. You can withdraw that choice at any time.
- Understand the website: To measure public page use and improve performance through analytics where permitted by applicable law.
International transfers
Our hosting infrastructure, including servers, databases, and storage, is located in the European Union. Some service providers, such as Cloudflare, Stripe, and Google, may process information outside the European Economic Area, including in the United States.
When information is transferred outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or on standard contractual clauses approved by the European Commission. We select providers that maintain relevant security and data protection certifications, including ISO/IEC 27001 where applicable.
Retention
We retain personal and technical information only for as long as reasonably necessary to provide the service, protect users, investigate security issues, meet legal obligations, and resolve disputes. Retention periods vary by the type of information and the purpose for which it is used. We may retain account, billing, support, security, administrative, sensor, and threat records for different periods where necessary for those purposes.
When information is no longer needed, we delete it or irreversibly anonymize it, subject to lawful retention requirements and legitimate security or dispute-resolution needs.
Security
We maintain appropriate technical and organizational safeguards designed to protect personal data against unauthorized access, loss, misuse, and disclosure. We review and update these safeguards as appropriate to the risks and needs of the service.
No service can guarantee absolute security. If you believe your account or personal data may be at risk, contact [email protected] without sending passwords, session cookies, backup codes, or API keys.
Your rights
Depending on your location and the processing involved, you may have the right to:
- Access personal data held about you and receive information about its use
- Correct incomplete or inaccurate personal data
- Request deletion where the data is no longer needed or is processed unlawfully
- Restrict processing in circumstances provided by law
- Receive data you provided in a portable format where the right applies
- Object to processing based on legitimate interests, including certain processing of source IP records
- Withdraw consent for future processing where consent is the legal basis
- Ask for human review where a decision with legal or similarly significant effects is made solely by automated means
Send a request to [email protected] or use the contact form. You may also complain to the Hellenic Data Protection Authority or the supervisory authority where you live or work.
Account deletion
You can request permanent account deletion from the profile page. Before deleting local account data, the service attempts to cancel active subscriptions so billing does not continue without an account you can access.
Account deletion stops future subscription renewals. It does not automatically refund the current paid period or unused time. Refund rights are described in our Terms of Service.
Deletion removes the main account and linked local authentication, preference, entitlement, and activity records covered by the deletion process. Limited security events, deletion records, provider records, or information required by law may remain for their applicable retention period.
Children
Whatoblock is a technical cybersecurity service and is not directed to children. We do not knowingly invite children to create accounts or submit personal data. If you believe a child has provided personal data, contact us so we can review and remove it where appropriate.
Changes to this policy
We may update this policy when the service, providers, or legal requirements change. For material changes, we may notify registered users by email or through the service. The last updated date at the top shows when this version took effect.
Contact
For privacy questions or to exercise a data protection right, email [email protected] or use the contact form. For suspected vulnerabilities or urgent security issues, email [email protected].
This Privacy Policy applies from the last updated date shown above.