Privacy Policy
Last updated: 4 November 2026
1. Who we are
MAC Probe ("we", "us") operates https://macprobe.com. Data controller contact: support@macprobe.com. Registered address: [INSERT LEGAL ADDRESS].
2. What we collect
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Hashed IP address (SHA-256 with secret pepper) | Rate limiting, abuse prevention | Legitimate interest | 48 hours |
| Account email (AES-256-GCM encrypted at rest) | Account management, billing, key delivery | Contract | Life of account + 30 days |
| API key hash and per-day request counts | Quota enforcement, billing accuracy | Contract | 24 months (aggregate) |
| Server access logs (host-level, by Hostinger) | Security and diagnostics | Legitimate interest | Per hosting provider policy |
3. What we do not collect
- We do not store the MAC addresses you look up against your identity, and we do not build query histories per user.
- We do not use advertising or cross-site tracking cookies.
- We do not sell, rent or share personal data with data brokers.
4. Cookies
Two mechanisms only: a localStorage entry remembering your light/dark theme choice, and a strictly-necessary session cookie (MACPROBE_SID) used solely for administrator login. Neither is used for profiling, so no consent banner is required for them.
5. Is a MAC address personal data?
A MAC address can be personal data under GDPR when it is linkable to an identifiable individual. Our vendor database contains only organisational registry prefixes published by the IEEE — never full device addresses tied to people. Addresses you submit for lookup are processed in memory to produce a response and are not persisted.
6. Security measures
- HTTPS/TLS enforced site-wide with HSTS.
- Parameterized SQL queries only (PDO prepared statements) — no string-concatenated queries.
- Passwords stored with bcrypt; API keys stored as SHA-256 hashes; emails encrypted with AES-256-GCM.
- Admin login hardened with CSRF tokens, session rotation, user-agent binding and lockout after 5 failed attempts.
- Credentials and secrets kept outside the web-accessible path or in directories denied by
.htaccess.
7. Processors and transfers
Hosting and database services are provided by Hostinger International Ltd. Payment processing, if you subscribe, is handled by the payment provider named at checkout; we never store card numbers. Data may be processed in the EU and other jurisdictions under standard contractual clauses.
8. Your rights
Subject to applicable law (EU/UK GDPR, UAE PDPL and others), you may request access, correction, deletion, restriction, portability, or object to processing, and may withdraw consent at any time. Email support@macprobe.com; we respond within 30 days. You may also complain to your local supervisory authority.
9. Children
The service is not directed at children under 16 and we do not knowingly collect their data.
10. Changes
Material changes will be announced on this page with a revised "last updated" date, and by email to active subscribers.