1. Who is responsible
The controller of your personal data is Netbase Enterprise Solutions and Applications Joint Stock Company (Netbase JSC), enterprise and tax code 0105951482, registered office No. 18, Lane 445/46 Lac Long Quan, Xuan La Ward, Tay Ho District, Hanoi, Vietnam (“Netbase”, “we”). Privacy requests: [email protected]. We have not appointed a representative in the EU or UK; you can still exercise every right below by writing to us.
2. What we process
| Situation | Data | Where it goes |
|---|---|---|
| Visiting adminkit.net | IP address, browser user agent, requested URL, time, and the network metadata Cloudflare attaches to a request (network/ASN, approximate country and city, protocol, TLS version). | Processed by Cloudflare to deliver the site. We do not run analytics or keep our own access logs of the website. |
| “What is my IP” and the home-page card | The same IP address and request metadata, shown back to you. | Computed per request in a Cloudflare function, returned with Cache-Control: no-store,
not written to any database or log by us. |
| DNS, MX, SPF, DMARC, DKIM, reverse-DNS lookups | The domain, selector or IP address you type. | Sent to a public DNS-over-HTTPS resolver (Cloudflare) to fetch the public records; not stored by us. |
| Whois / RDAP lookup | The domain or IP address you type, and your IP address. | Your browser requests it directly from rdap.org and the registry it redirects to; those operators see your request under their own policies. |
| Email to hello@, security@, privacy@ or abuse@ | Your email address, name and anything you write or attach. | Received through Cloudflare Email Routing and kept in our mailbox to answer you and keep a record of security and abuse reports. |
| Research sensors (honeypots) | When a system connects to an AdminKit sensor on a public IP address (ports such as 23, 502, 1883, 8765): source IP and port, time, protocol, the commands or requests sent, and login attempts stored only as a one-way hash and length — never the password in clear. | Stored on our own server to study attacks and protect users (Radar). These sensors do not answer real services; ordinary visitors of adminkit.net never reach them. |
| Theme preference | Light or dark mode choice. | Stored only in your own browser (localStorage); never sent to us. |
We do not ask for, and ask you not to send us, special categories of data (health, religion, biometrics and similar).
3. Purposes and legal bases
- Providing the site and the tools you request — performance of the service you ask for (GDPR Art. 6(1)(b)) and our legitimate interest in operating a secure website (Art. 6(1)(f)).
- Answering emails and handling security or abuse reports — legitimate interest and, where you are a customer, contract.
- Research sensors and abuse prevention — legitimate interest in protecting users and the internet from attacks (Art. 6(1)(f); GDPR Recital 49 recognises network and information security as such an interest).
- Legal obligations — keeping records and responding to lawful requests (Art. 6(1)(c)).
For people in Vietnam, we process personal data in line with the Law on Personal Data Protection and its implementing rules, including Decree 13/2023/ND-CP, on the grounds those rules allow; where consent is required we ask for it and you may withdraw it at any time.
4. How long we keep it
- Tool inputs and the IP card: not kept by us after the response is sent.
- Emails: as long as needed to handle the matter, and up to 3 years for security and abuse reports.
- Research-sensor raw events: up to 14 days on the sensor, then deleted; aggregated statistics that cannot identify anyone may be kept without limit.
- Data processed by Cloudflare: under Cloudflare's own retention policy.
5. Service providers
We use these providers, each bound by its own data protection terms:
- Cloudflare, Inc. — hosting (Pages and Functions), content delivery, DNS, DNS-over-HTTPS resolver, email routing, security.
- Contabo GmbH — virtual servers in the EU that run our research sensors and development systems.
- Google LLC — mailbox that receives forwarded emails.
We share personal data with professional advisers or authorities only where needed or legally required.
6. International transfers
Netbase is based in Vietnam and our providers operate worldwide, so your data may be processed outside your country. Where GDPR applies, transfers rely on the providers' standard contractual clauses or other safeguards recognised by law. Where Vietnamese law requires a cross-border transfer impact assessment, we prepare and keep it.
8. No selling, no advertising
We do not sell or rent personal data, do not use it for advertising, and do not build profiles of visitors.
9. Security
We use encryption in transit (HTTPS only), least-privilege access, separation between systems, and no long-term storage of tool inputs. No system is perfectly secure; if a breach affects your data we will notify you and the authorities where the law requires. Report vulnerabilities to [email protected] (see Security).
10. Your rights
Depending on the law that applies to you (including the GDPR, the UK GDPR, Vietnam's personal data protection law and US state privacy laws), you may have the right to: be informed; access your data; correct it; delete it; restrict or object to processing; data portability; withdraw consent; and not be subject to decisions based solely on automated processing (we make none). You may also complain to your data protection authority — in Vietnam, the Ministry of Public Security's data protection authority.
Write to [email protected]. We answer within 30 days (or the shorter period your law requires). Because we keep almost no data linked to visitors, we may be unable to find data about you; we may ask for information to verify your identity.
11. Children
AdminKit is not directed at children under 16, and we do not knowingly collect their personal data.
12. Accounts and device logs (not yet available)
Accounts, alerts, Protective DNS logs and device lists are not open to the public yet. DNS query logs and device lists can reveal habits and presence at home or at work, so before launch this policy will be updated and these features will require explicit consent from the person who manages the network, a default retention of 30 days, encryption, deletion on request, and a reminder to inform other people who use that network. AdminKit will not offer features for monitoring people (for example children or employees).
13. Changes
We will update this policy when our processing changes. The version and effective date are shown at the top of this page; material changes for account holders will be announced in advance.
Contact
Netbase Enterprise Solutions and Applications Joint Stock Company (Netbase JSC), enterprise and tax code 0105951482, registered office No. 18, Lane 445/46 Lac Long Quan, Xuan La Ward, Tay Ho District, Hanoi, Vietnam. Email [email protected] (general), [email protected] (privacy), [email protected] (security), [email protected] (abuse). Phone and WhatsApp +84 937 869 689.