AbuseRoute: Privacy Policy

Version 1.0. Effective date: 17 September 2026

Who we are. AbuseRoute is operated by Khaled Doulami, trading as WappDev, Flat 17, 6 Violet Road, London E3 3QH, United Kingdom ("WappDev", "we"). For the personal data described in this policy, WappDev is the controller unless stated otherwise. Contact: contact@abuseroute.com.

This policy explains what personal data we process when you use the AbuseRoute API or website, why, on what legal basis, for how long, and your rights. It is written for the people at our business customers who deal with us, and for anyone whose contact details appear in the public registration records the Service returns.

1. What the Service does with data

Given a domain name, the Service looks up public registration and DNS records and returns the registrar, the network operators hosting the domain, and the abuse contacts those parties have published. It does not store the results beyond a short operational cache and does not build profiles of domains, people or our customers' investigations.

2. Personal data we process

2.1 Customer account data

Business contact details of the people who arrange and administer a customer's access: name, work email address, work phone number, employer, and correspondence with us.

Purpose: issuing and managing API keys, invoicing, support, legal notices.
Legal basis: performance of a contract with the customer, and our legitimate interest in administering the relationship.
Retention: for the life of the customer relationship and 6 years after its end (UK limitation period and tax record-keeping).

2.2 API request metadata

For each request to the API we record: the API key used (stored in full in a protected file on our server; shown masked in operator tooling), the time, the requesting IP address as seen by our edge, the path requested (which includes the queried domain name), and the outcome (served, rate-limited, expired, rejected).

Purpose: authentication, rate limiting and quota enforcement, billing, security monitoring, detecting misuse of the Service or of upstream data sources, and meeting our obligations to those sources.
Legal basis: performance of the contract (metering, billing) and our legitimate interest in the security and integrity of the Service and in complying with upstream terms of use.
Retention: per-key usage counters for the life of the key plus 12 months; request log lines for no more than 90 days, then deleted. Aggregated statistics with no IP or domain detail may be kept indefinitely.
Note: a queried domain name may in some cases reveal something about the customer's investigation. We treat this metadata as confidential, do not analyse it beyond the purposes above, and do not share it except as described in Section 4.

2.3 Registration data returned by the Service

When answering a lookup, the Service retrieves records from public sources (Regional Internet Registries, domain registries and registrars, and the DNS). These records may contain personal data: typically the name, email address and telephone number of a person or role account designated by a registrar or network operator as an abuse, administrative or technical contact. In most cases these are organisational role mailboxes; sometimes they are named individuals.

What we do: we extract only the fields needed for abuse routing (organisation name, network range, registrar identity, abuse contact) and return them to the requesting customer. Administrative and technical contact details of individuals are discarded. Results are cached for up to 24 hours (network data) or 1 hour (registration data) to avoid repeated queries to the same source, then dropped. We do not retain, index, enrich or compile this data.
Our role: for this data we act on the instructions of the customer making the lookup and as a conduit from the public source; we consider ourselves a processor for the customer in respect of the transient handling, and the customer the controller of what it retains. The public source remains the controller of the published record itself.
Legal basis (to the extent we are a controller of the transient copy): legitimate interest: facilitating the reporting of abuse to the party responsible, which is the very purpose for which the data was published. We have assessed this interest against the rights of the individuals concerned (see Section 8).
Retention: cache only; maximum 24 hours.

2.4 Website visitors

Our websites (abuseroute.com, api.abuseroute.com) are served through Cloudflare, which processes visitor IP addresses and request headers to deliver and protect the sites. We do not use analytics cookies or advertising trackers. Server access logs (IP address, requested URL, user agent, time) are kept for 30 days for security.

3. Where data is processed

Our servers are located in the United Kingdom (AWS, London region). Cloudflare, Inc. provides edge network services and may process request data at locations worldwide under its standard contractual terms. We do not otherwise transfer personal data outside the UK.

Queries to upstream sources are made from the UK to registries located in their respective regions (for example ARIN in the United States, RIPE NCC in the Netherlands). Those queries contain the IP address or domain being looked up, not any personal data of the customer.

Infrastructure providers: Amazon Web Services (hosting, UK), Cloudflare (edge and DNS). They process data only to provide their services to us.
Professional advisers: our accountant receives invoicing records as required for tax compliance.
Upstream data sources: if a customer's use breaches the terms of an upstream source and that source requires it, we may disclose the customer's identity and relevant request metadata to that source.
Authorities: where required by law, court order, or to protect the rights or safety of any person.
We do not sell personal data and do not share it for marketing.

5. Security

Access to the API is by per-customer key over TLS. Keys and usage records are stored on a hardened server with restricted access, in files readable only by the service account. Administrative access is by SSH key held by the operator only. See our Security & Data Handling summary for more detail.

6. Your rights

Under UK GDPR (and, for people in the EU, the GDPR) you may have the right to access, correct, erase, restrict or object to our processing of your personal data, and to data portability. To exercise a right, email contact@abuseroute.com. We will respond within one month.

If you are an individual whose contact details appear in a public registration record and you object to being contacted about abuse, please note that we do not control the source record; the registrar or network operator that published it does. We can, however, tell you which of our customers have retrieved a record containing your details in the previous 90 days, to the extent our metadata allows.

You have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EU, to your local supervisory authority.

7. Children

The Service is for business use and is not directed at children. We do not knowingly collect data from anyone under 18.

8. Legitimate interests assessment (summary)

We rely on legitimate interests for the transient processing of publicly published contact data (Section 2.3) and for security monitoring (Section 2.2). Our assessment: the data is published by the responsible organisations specifically so that abuse can be reported to them; our processing serves exactly that purpose and no other; we minimise to abuse-routing fields, discard individual administrative/technical contacts, hold nothing beyond a short cache, and contractually bind customers to the same purpose limitation; the risk to individuals is low and the public benefit (faster takedown of phishing, malware and fraud) is material. A fuller written assessment is available on request.

9. Changes

We will post changes here and, for material changes affecting customers, notify account contacts by email at least 30 days in advance.

Contact. Khaled Doulami, trading as WappDev. Flat 17, 6 Violet Road, London E3 3QH, United Kingdom. contact@abuseroute.com