1. Who is responsible
The controller of your personal data is Netbase Enterprise Solutions and Applications Joint Stock Company (Netbase JSC), enterprise and tax code 0105951482, registered office No. 18, Lane 445/46 Lac Long Quan, Xuan La Ward, Tay Ho District, Hanoi, Vietnam (“Netbase”, “we”). Privacy requests: [email protected]. We have not appointed a representative in the EU or UK; you can still exercise every right below by writing to us.
2. What we process
| Situation | Data | Where it goes |
|---|---|---|
| Visiting adminkit.net | IP address, browser user agent, requested URL, time, and the network metadata Cloudflare attaches to a request (network/ASN, approximate country and city, protocol, TLS version). | Processed by Cloudflare to deliver the site. We do not run analytics or keep our own access logs of the website. |
| “What is my IP” and the home-page card | The same IP address and request metadata, shown back to you. | Computed per request in a Cloudflare function, returned with Cache-Control: no-store,
not written to any database or log by us. |
| DNS, MX, SPF, DMARC, DKIM, reverse-DNS lookups | The domain, selector or IP address you type. | Sent to a public DNS-over-HTTPS resolver (Cloudflare) to fetch the public records; not stored by us. |
| Whois / RDAP lookup | The domain or IP address you type, and your IP address. | Your browser requests it directly from rdap.org and the registry it redirects to; those operators see your request under their own policies. |
| Email to hello@, security@, privacy@ or abuse@ | Your email address, name and anything you write or attach. | Received through Cloudflare Email Routing and kept in our mailbox to answer you and keep a record of security and abuse reports. |
| "Notify me" / early-access form | Your email address; name and company if you choose to add them; the tool or product you asked about; the date and time you consented; a one-way hash of your IP address (not the address itself), used only to rate-limit abuse of the form. | Stored in Cloudflare Workers KV (binding EARLY_ACCESS); used only to notify you about the
thing you asked about — see section 12. |
| Research sensors (honeypots) | When a system connects to an AdminKit sensor on a public IP address (ports such as 23, 502, 1883, 8765): source IP and port, time, protocol, the commands or requests sent, and login attempts stored only as a one-way hash and length — never the password in clear. | Stored on our own server to study attacks and protect users (Radar). These sensors do not answer real services; ordinary visitors of adminkit.net never reach them. |
| Theme preference | Light or dark mode choice. | Stored only in your own browser (localStorage); never sent to us. |
We do not ask for, and ask you not to send us, special categories of data (health, religion, biometrics and similar).
3. Purposes and legal bases
- Providing the site and the tools you request — performance of the service you ask for (GDPR Art. 6(1)(b)) and our legitimate interest in operating a secure website (Art. 6(1)(f)).
- Answering emails and handling security or abuse reports — legitimate interest and, where you are a customer, contract.
- The early-access list — your consent, which you give by ticking the consent box on the form; you may withdraw it at any time (see section 12).
- Research sensors and abuse prevention — legitimate interest in protecting users and the internet from attacks (Art. 6(1)(f); GDPR Recital 49 recognises network and information security as such an interest).
- Legal obligations — keeping records and responding to lawful requests (Art. 6(1)(c)).
For people in Vietnam, we process personal data in line with the Law on Personal Data Protection and its implementing rules, including Decree 13/2023/ND-CP, on the grounds those rules allow; where consent is required we ask for it and you may withdraw it at any time.
4. How long we keep it
- Tool inputs and the IP card: not kept by us after the response is sent.
- Emails: as long as needed to handle the matter, and up to 3 years for security and abuse reports.
- Early-access list: see section 12 (until launch notice + 24 months, or until you unsubscribe).
- Research-sensor raw events: up to 14 days on the sensor, then deleted; aggregated statistics that cannot identify anyone may be kept without limit.
- Data processed by Cloudflare: under Cloudflare's own retention policy.
5. Service providers
We use these providers, each bound by its own data protection terms:
- Cloudflare, Inc. — hosting (Pages and Functions), content delivery, DNS, DNS-over-HTTPS resolver, email routing, security, and Workers KV (storage for the early-access list).
- Contabo GmbH — virtual servers in the EU that run our research sensors and development systems.
- Google LLC — mailbox that receives forwarded emails.
We share personal data with professional advisers or authorities only where needed or legally required.
6. International transfers
Netbase is based in Vietnam and our providers operate worldwide, so your data may be processed outside your country. Where GDPR applies, transfers rely on the providers' standard contractual clauses or other safeguards recognised by law. Where Vietnamese law requires a cross-border transfer impact assessment, we prepare and keep it.
8. No selling, no advertising
We do not sell or rent personal data, do not use it for advertising, and do not build profiles of visitors.
9. Security
We use encryption in transit (HTTPS only), least-privilege access, separation between systems, and no long-term storage of tool inputs. No system is perfectly secure; if a breach affects your data we will notify you and the authorities where the law requires. Report vulnerabilities to [email protected] (see Security).
10. Your rights
Depending on the law that applies to you (including the GDPR, the UK GDPR, Vietnam's personal data protection law and US state privacy laws), you may have the right to: be informed; access your data; correct it; delete it; restrict or object to processing; data portability; withdraw consent; and not be subject to decisions based solely on automated processing (we make none). You may also complain to your data protection authority — in Vietnam, the Ministry of Public Security's data protection authority.
Write to [email protected]. We answer within 30 days (or the shorter period your law requires). Because we keep almost no data linked to visitors, we may be unable to find data about you; we may ask for information to verify your identity.
11. Children
AdminKit is not directed at children under 16, and we do not knowingly collect their personal data.
12. Early-access list
If you ask to be notified about a product, tool or early-access programme — for example through the "Notify me" form on a tool page or on this site — we process: the email address you give us; your name and company if you choose to add them; which tool or product you are interested in; the date and time you consented; and a one-way hash of your IP address (not the address itself), kept only to help us detect abuse of the form. This is stored in Cloudflare Workers KV, a key-value store Cloudflare operates on our behalf under the processors in section 5.
We use this list only to tell you when the tool or product you asked about launches or materially changes, and for abuse prevention. We do not use it for general marketing, and we do not sell or share it with anyone else. If you ask about more than one tool, we keep one record per email address and add to the list of things you are interested in, rather than creating a second record.
We keep this data until the later of 24 months after we send you the launch notice for everything you asked about, or until you ask us to delete it or unsubscribe. There is no self-service unsubscribe link yet — email [email protected] and we will remove you.
13. Accounts, API logs and apps
Account sign-up is open. Alerts, API usage logging, monitored-asset lists and the mobile/desktop apps described elsewhere on this site are not open to the public yet. This section describes how we intend to handle their data once each feature launches — it applies when that feature launches, not before, and this policy will be updated again at that point.
- Accounts and API usage logs. Once accounts exist, we will log API calls (endpoint, timestamp, result status, and the account or key used) to operate quotas, billing and security, without logging the content of the domains, IPs or files you check beyond what is needed to show you your own history.
- Monitored assets and alerts. Assets you ask AdminKit to watch (a domain, IP or device) and the alerts we generate about them will be kept only for the account holder who added them, with deletion on request.
- Mobile and desktop app scan data. Where the AdminKit app scans the network you are physically on, it processes device metadata (for example vendor information derived from MAC/mDNS/UPnP, open ports, hostnames visible on that network) on your own device and, only if you choose to sync it, in your account.
DNS query logs and device lists can reveal habits and presence at home or at work, so each of these features will require explicit consent from the person who manages the network, a default retention of 30 days unless you choose otherwise, encryption, deletion on request, and a reminder to tell other people who use that network. AdminKit will not offer features for monitoring individual people (for example children or employees).
14. Changes
We will update this policy when our processing changes. The version and effective date are shown at the top of this page; material changes for account holders will be announced in advance.
Contact
Netbase Enterprise Solutions and Applications Joint Stock Company (Netbase JSC), enterprise and tax code 0105951482, registered office No. 18, Lane 445/46 Lac Long Quan, Xuan La Ward, Tay Ho District, Hanoi, Vietnam. Email [email protected] (general), [email protected] (privacy), [email protected] (security), [email protected] (abuse). Phone and WhatsApp +84 937 869 689.