Privacy Policy

Who we are

who.is is a WHOIS, RDAP, and DNS lookup service. The data controller for the personal data described here is who.is. You can reach us through the contact page.

Data we collect

• Account data. When you create an account we store your email address, your first and last name, and a password if you sign up with one. Accounts are optional; lookups do not require one.
• Purchase data. When you buy a product we store the email address you give at checkout, the product, and a reference to the payment. We never see or store your card number.
• Monitoring data. If you set up website, DNS, or certificate monitoring we store the domains you monitor, the regions you chose, the results of each check, and the email address that alerts go to.
• API data. If you create an API key we store the key, the plan it belongs to, and how much it is used.
• Usage and technical data. Our servers log requests, including IP address, user agent, and the domains looked up, to operate the service, enforce rate limits, and detect abuse. Clicks on partner links are also recorded.
• Cookies. A session cookie keeps you signed in. Google Analytics and Google AdSense set their own cookies; see the third-party section below.

Google user data

This section covers the data we receive from Google when you sign in with a Google account. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• What we access. We request only theuserinfo.email anduserinfo.profile scopes. From them we receive your Google account ID, email address, whether Google verified that address, and your first and last name. We do not request access to Gmail, Drive, Calendar, Contacts, or any other Google service.
• How we use it. We use this data to create your who.is account, to sign you in, to show your name in your dashboard, and to send you service emails such as purchase receipts and monitoring alerts. We do not use Google user data for any other purpose.
• What we store. We store your Google account ID, email address, first name, and last name. We do not store Google access tokens or refresh tokens after sign-in completes.
• Who we share it with. We do not share, transfer, or disclose Google user data to anyone except our infrastructure providers (Amazon Web Services for hosting and email delivery, and Stripe if you make a purchase, which receives your email address), and then only as needed to operate the service. We do not sell it.
• What we never do with it. We do not use Google user data for targeted advertising, sell it to data brokers or any third party, use it to determine creditworthiness or for lending, or use it to develop, improve, or train artificial-intelligence or machine-learning models.
• How to unlink or delete it. You can unlink Google from your who.is account or delete the account entirely from your dashboard. Deleting the account removes the stored Google data as described in the retention section. You can also revoke who.is from your Google account at myaccount.google.com/permissions.

How we use personal data

• To create and secure your account and to sign you in.
• To fulfil purchases and deliver the products you buy, such as domain history reports.
• To run monitoring you set up and to email you the alerts you asked for.
• To issue and meter API keys under the plan you chose.
• To operate, secure, and improve the service, including rate limiting, abuse detection, and diagnosing errors.
• To respond to support requests and to send legally required notices.

We send only service email: receipts, monitoring alerts, sign-in and security notices, and replies to your requests.

Who we share data with

• Amazon Web Services hosts the service, stores our databases and report files, and delivers our email.
• Stripe processes payments. Stripe receives your email address and payment details directly and handles them under its own privacy policy.
• Google provides sign-in, Google Analytics, and Google AdSense. Analytics and AdSense may set cookies and collect usage data under Google's privacy policy; you can opt out of personalised ads at adssettings.google.com.
• Cloudflare Turnstile protects forms from bots and may process your IP address and browser signals to do so.
• Legal requests. We may disclose data when required by law, subpoena, or court order, or to protect the rights and safety of who.is and its users.
• Business transfers. If who.is is sold or merged, account data may transfer to the new owner under this policy.

We do not sell personal data.

Public WHOIS and RDAP data

The lookup results shown on who.is come from public domain registries and registrars. They may include the names and contact details that a domain owner published in the public WHOIS record. We display and archive that public data; we do not create it. If your personal data appears in a domain record and you want it hidden from who.is, you can use our privacy blocklist through the domain's privacy page or contact us. Blocked domains are excluded from lookups, history products, and the API.

How we protect data

• All traffic to who.is is encrypted in transit.
• Stored data is encrypted at rest.
• Passwords are never stored in plain text.
• Access to production systems is limited to staff who need it.

Retention and deletion

• Account data is kept while your account exists. When you delete your account from your dashboard we remove your email address, name, Google account ID, password, API keys, monitoring configuration, and subscriptions. We keep a minimal record of the deletion, without your email address or name, so we can honour refunds and legal obligations.
• Purchase records are kept for as long as tax and accounting law requires.
• Server logs are kept for a limited period for security and troubleshooting and then discarded.
• Deletion requests. You can request deletion of your data at any time through the contact page.

Your rights

Depending on where you live you may have the right to access, correct, export, or delete your personal data, to object to or restrict its processing, and to complain to a data protection authority. To exercise any of these rights, contact us through the contact page. We will verify the request and respond within the time the applicable law allows.

Children

who.is is not directed at children under 18, and our Terms of Service require users to be over 18. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy. When we make a material change to how we use your data, we will update the date below and notify account holders by email. Continued use of who.is after a change takes effect means you accept the updated policy.

Last updated on September 20, 2026