Last updated:
Bin Search Lookup provides BIN and IIN lookup services via our website and API. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use our services. By using the services, you agree to this policy and to our Terms and Conditions. If you do not agree, you must not use the services.
We are based in Montreal, Quebec, Canada, and we comply with applicable privacy laws, including GDPR, CCPA, and Quebec privacy requirements.
We do not separately store or log visitor IP addresses in our own analytics systems. If you opt into "Analytics" in our cookie banner, our analytics providers (Google Analytics, Yandex Metrika) do receive your IP address directly, as part of the normal request each of those services makes to their own servers — that is outside our control and is disclosed in the Analytics section below. Operational security systems may process network metadata in memory for short periods for fraud detection and abuse prevention, independent of analytics consent.
If you use our "Invite Friends" feature, the email address you submit for a friend is used only to send that one invitation on your behalf and is not stored in our database or added to any marketing list. It is passed to our transactional email provider solely to deliver the message, where it may briefly appear in standard delivery logs subject to that provider's own retention practices. A person you've referred who wants that transient log entry purged early can contact us at the address in the Contact section.
Where GDPR applies, we rely on the following legal bases: contract performance, legitimate interests such as security and service improvement, compliance with legal obligations, and your consent where required, for example certain cookie categories.
If you opt into "Analytics," we use Google Analytics and Yandex Metrika to understand feature usage and reliability. These are third-party services: once loaded, your browser communicates with them directly, which means they receive your IP address as part of that normal request, along with standard technical data like your browser and device type. We do not separately store that IP address ourselves, and we do not use analytics to build profiles for advertising. Analytics scripts are never loaded before you make a choice, and never load at all if you choose "Reject All."
Yandex Metrika's session-replay ("webvisor") feature, which can record on-page interactions such as clicks, scrolling, and mouse movement, is a separate "Session Recording" category with its own toggle, off by default — opting into Analytics does not enable it, and it never runs unless you separately opt in.
When you delete your account, your profile data and API keys are deleted immediately — this is not reversible and cannot be recovered. Specific records that carry an independent legal retention requirement are kept separately, in an access-restricted store not used for day-to-day operation of your former account, and deleted once that requirement lapses: invoices and billing records (kept per applicable tax law, currently 7 years), and any records tied to an active fraud, abuse, or dispute investigation (kept until that matter is resolved). We retain personal data only as long as necessary for the purposes described in this policy, including service operation, security, legal compliance, and dispute resolution. Retention periods vary by data type and applicable law.
Data is encrypted in transit using TLS 1.3. User passwords are stored as secure hashes using the Argon2id algorithm. Personal data such as email addresses is encrypted at rest using the ChaCha20 cipher.
No method of transmission or storage is completely secure. You are responsible for safeguarding your account credentials.
If you have an account, you can self-serve an export of your account details, subscription metadata, API key metadata, and usage history at any time from Settings → Privacy & Data, without contacting support. For all other requests, contact us using the information in the Contact section. We may ask you to verify your identity before responding.
We may process data outside your jurisdiction. Where required, we use appropriate safeguards such as standard contractual clauses or equivalent mechanisms to protect personal data during transfers.
Our services are not directed to children under the age required by applicable law. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will take appropriate steps to remove it.
The service may contain links to third party sites. We are not responsible for their privacy practices. Review the privacy policies of those sites before providing personal data.
Bin Search Lookup is the data controller for personal data processed in connection with the services, unless stated otherwise in a specific context.
We may update this Privacy Policy from time to time. If changes are material, we will provide reasonable notice before they take effect. Continued use of the services after the effective date means you accept the updated policy.
If you have questions about this Privacy Policy or our data practices, contact us:
Email: [email protected]
Address: Montreal, Quebec, Canada