This policy explains what happens with your data when you use vpnlookup.com. Short version: we do not want your personal data, we set no cookies, we store nothing on your device, and neither our logs nor our measurements contain your IP address.
Controller
The controller is VPN Lookup, Belgium. Contact for all privacy questions: contact@vpnlookup.com.
What we process and why
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Page requested, time, HTTP status, referring site, browser user-agent, country | Delivering the site, security, counting visits | Legitimate interest (art. 6(1)(f)) | Raw logs 14 days; visit statistics 24 months |
| Measurement by our own script, unless your browser sends Do Not Track or Global Privacy Control: pages viewed, scroll depth, time on page, clicks on buttons, links and filters, referring site and campaign parameters, country, language, type of device, browser and operating system, screen width in classes, loading performance, script errors, and which version of a page you saw during a test. Linked per visit by a code that changes every day | Understanding how the site is used and improving it; comparing two versions of a page | Legitimate interest (art. 6(1)(f)) | Per visit 90 days; after that only totals, 24 months |
Click on an outgoing /go/ link: time, page, link position, country, user-agent, random click reference | Knowing which pages refer sales; affiliate accounting | Legitimate interest (art. 6(1)(f)) | 24 months |
| Email you send us: address and content | Answering you | Legitimate interest (art. 6(1)(f)) | 12 months after the last message |
Our web server logs are configured not to record your IP address. The country is derived by our CDN and passed to us as a two-letter code. The IP address tool sends your address back to your own browser so the page can show it; that request is not logged or stored. Pages with prices use the same request to read your country code, so they can show the prices providers advertise for your country; your choice of another country stays in the page and is not stored. We do not use automated decision-making and we do not sell data.
To name the network the address belongs to, our server looks it up in a copy of a public address table (iptoasn.com) kept on our own server; the address is not sent to anyone for that.
The WebRTC leak test only starts when you click the button. Your browser then sends one request to a STUN server run by Cloudflare (stun.cloudflare.com), which replies with the address the request came from. The addresses found stay in your browser and are not sent to us or stored.
The DNS leak test only starts when you click the button. Your browser then looks up a few random names under leak.vpnlookup.com. We run the name server for that domain: it notes the address of the DNS resolver that asks (and the network that resolver passes on, if it does), keeps it in memory for ten minutes, writes it nowhere and returns it only to the page that made up the random name. To show the network name, our server looks up the resolver address (not yours) in the free DNS service of Team Cymru. The addresses from your first test stay in your browser.
The IP tool can show your IPv4 and your IPv6 address separately, also only after a click. Your browser then sends one request to each of two Cloudflare addresses (ipv4.icanhazip.com and ipv6.icanhazip.com), which reply with the address the request came from. Those addresses stay in your browser too.
The daily visit code
To see that two pages belong to the same visit, our server computes a visit code from your IP address, your browser’s user-agent and language setting, and a secret key that we replace every night. We store the code, never the IP address. Once the key is deleted, nobody, including us, can recompute the code or trace it back to an address, and the next day your visit gets a different code.
So we can follow one visit within one day, from the first page to a click to a provider, but we do not recognise you from one day to the next and we build no profile of you. When we test two versions of a page, the version you get is derived in the same way and nothing is stored on your device for it.
You can switch this measurement off: if your browser sends Do Not Track or Global Privacy Control, the script does not connect to our server and sends nothing. The server log in the first row of the table still records the page request, without IP address. The cookie policy describes the script in more detail.
You can switch the measurement off right here, for this browser. Your choice is remembered in this browser’s local storage (one item named vl-optout); it is saved only when you press the button and is never sent to us.
If you pick a currency yourself under a price table, your browser remembers that choice in its local storage (one item named vl-cur, for example “USD”), so the next page shows the same currency. That choice too is saved only when you make it and is never sent to us.
Processors and recipients
- Cloudflare, Inc. delivers the site (CDN, DNS, DDoS protection) and therefore necessarily processes your IP address to answer your request. Cloudflare acts as our processor under its data processing addendum, which includes the EU standard contractual clauses and the EU–US Data Privacy Framework for transfers to the United States.
- Google Cloud (Belgium region) hosts our server.
- Google Workspace (Google Ireland Ltd.) runs our mailbox: e-mail you send us is received and stored there.
- VPN providers you click through to. When you click an affiliate link we pass a random click reference to the provider or its affiliate network. It does not identify you to us. From that point the provider is an independent controller under its own privacy policy.
Cookies
We set none. See the cookie policy.
Your rights
Under the GDPR you have the right to access, rectify and erase your data, to restrict or object to processing, and to data portability. The only identifier we store is the daily visit code, which we cannot link to you or to an IP address, so we will usually be unable to find any data about you unless you emailed us. To object to the measurement, switch on Do Not Track or Global Privacy Control in your browser, or use the switch-off button above. Send requests to contact@vpnlookup.com; we answer within one month.
You can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be, or with the authority in your own EU country.
Changes
We update this policy when our processing changes. Last updated: 15 October 2026.