Privacy Policy
Last Updated: October 27, 2026
This Privacy Policy explains how Geonode PTE. LTD. (“Geonode,” “we,” “us,” “our”) collects, uses, discloses, and protects personal data in connection with the Geonode website at geonode.com, the customer dashboard at app.geonode.com, our Scraper API, MCP Server, residential, ISP, datacenter proxy services, and other services made available by Geonode (collectively, the “Services”). This Privacy Policy forms part of and should be read together with the Geonode Terms of Service (“Terms”) and the Geonode Acceptable Use Policy.
For data protection purposes, Geonode acts as the controller (or “organisation” under the Singapore Personal Data Protection Act 2012) for personal data collected for our own account, billing, KYC, security, fraud-prevention, sanctions-compliance, abuse-prevention, analytics, support, and legal-compliance purposes. Where we process Customer Data (including any personal data contained in it) on behalf of a business customer through any part of the Services, we act as a processor or data intermediary, and that processing is governed by the Data Processing Addendum between Geonode and the customer.
The Services are intended for users aged 18 or older, consistent with our Terms of Service. We do not knowingly collect personal data from individuals under 18.
We may update this Privacy Policy from time to time with the “Last Updated” date indicated the most recently revised. If we make material changes, we will take reasonable steps to provide notice, such as by posting an updated version on our website or providing notice within the Services.
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about how your information is handled, you may contact us using the details below:
Address for notices: 60 Paya Lebar Road, #06-28 Paya Lebar Square, Singapore 409051.
Privacy queries or requests to execute rights: privacy@geonode.com.
Legal notices: hello@geonode.com
1. Information We Collect
1.1 Information We Collect
We collect personal data and related technical data only to the extent necessary to provide, secure, and improve the Services. The categories of information we collect are described below.
| Category of Information | What We Collect | Purpose of Collection |
|---|---|---|
| Account and Profile Data | Name, business or trading name, email, hashed password, role or title, country, profile preferences, time zone, language. | Account creation and management; authentication; service communications. |
| Billing and Payment Data | Billing email, billing address, postal code, tax ID where required, company name, payment method tokens, card brand, last four digits, expiry, transaction IDs, invoices, plan and active services, renewal status, auto top-up settings, refund and chargeback records. | Process payments, issue invoices, manage subscriptions and pay-as-you-go usage, prevent payment fraud, meet tax and accounting obligations. |
| KYC and Compliance Data | Government ID or business registration, named contact, stated use case, beneficial-ownership information where required, sanctions screening results, fraud and abuse checks, use-case review, business verification, and ongoing-monitoring outcomes. | KYC obligations, sanctions compliance, anti-fraud, AUP enforcement, network integrity. |
| Service Usage Data | Account identifiers, API keys, proxy credentials, whitelisted IPs, gateway and session settings, allocated IP records, bandwidth consumed, requests count, connection timestamps, target domain at aggregate level, success and error metrics, throughput, dashboard interactions. | Provide and meter the Services, billing, technical support, network management, security and abuse prevention. |
| Browser Extension and Free Tools Data | Where you use the Geonode browser extension, free proxy list, or "What is my IP" tool, we may process your IP address, browser type and version, extension version, page or tool interactions, basic telemetry, and the data the extension requires to operate the proxy or tool functions you invoke, in accordance with the permissions granted to the extension in your browser. | Operate the browser extension and free tools; troubleshooting and analytics. |
| Website and Cookies Data | IP address, browser and device data, pages visited, referrers, session identifiers, and other information collected through cookies and similar technologies as described in our Cookie Policy. | Operate the website, maintain session state, analyse usage, and (where consented) other purposes described in our Cookie Policy. |
| Communications and Support Data | Emails, support tickets, live-chat transcripts, sales-call notes, and attachments you send us. | Respond to enquiries, provide support, manage sales and account relationships, record-keeping. |
| Security, Abuse, and Enforcement Records | IP addresses linked to account activity, abuse signals, complaints received, investigation notes, enforcement decisions, and evidence-preservation logs. IP-to-user mapping is retained for no longer than 30 days except where necessary for abuse investigation, legal compliance, or dispute resolution. | Prevent fraud, abuse, cyberattacks, and policy violations; support investigations; respond to lawful requests; enforce the Terms and Acceptable Use Policy. |
In operating the Services, we collect usage metadata such as bandwidth consumed, Requests count, connection timestamps, and target domain at aggregate level. We do not, for our own purposes, access the content of proxied requests or responses, target page content, scraped data, or downloaded files, except where strictly necessary for security, abuse investigation, or legal compliance.
We do not intentionally collect or process sensitive personal information as defined under applicable data protection laws, such as health data, biometric data, racial or ethnic origin, political opinions, religious beliefs, or sexual orientation. The Services are not designed to collect such information, and we request that you do not submit sensitive personal information to us.
1.2 Processing Overview
We process personal data only where necessary to provide the Services, maintain security, comply with legal obligations, and operate the Services described in this Privacy Policy. The table below summarises the categories of personal data we process, the purposes for which we process them, and the applicable legal bases for users in the EEA and UK.
| Category of Data | Purpose of Processing | Legal Basis (EEA/UK) |
|---|---|---|
| Account and Profile Data | Create and manage user accounts; authenticate access; provide customer support; service communications. | Performance of contract. |
| Billing and Payment Data | Process payments, invoicing, tax compliance, fraud prevention, billing dispute resolution. | Performance of contract; legal obligation (tax, AML); legitimate interests (fraud prevention). |
| KYC and Compliance Data | Verify customers; sanctions and fraud screening; network integrity; AUP enforcement; ongoing monitoring. | Legal obligation; legitimate interests (network integrity, abuse prevention, AUP enforcement). |
| Service Usage Data | Provide and meter the Services; billing; technical support; network management; security and abuse prevention. | Performance of contract; legitimate interests (metering, security, network management). |
| Security, Abuse, and Enforcement Records | Prevent fraud, abuse, cyberattacks, and policy violations; support investigations. | Legitimate interests; legal obligation (where applicable). |
| Communications and Support Data | Respond to enquiries; provide support; record-keeping. | Performance of contract; legitimate interests (service operation and record-keeping). |
| Website, Cookies, and Analytics Data | Operate the website; analyse usage; improve performance. | Legitimate interests; consent, where required for non-essential cookies. |
| Marketing Communications | Send product updates, newsletters, and promotional messages. | Consent, where required. |
| Legal Request Data | Respond to lawful requests and regulatory requirements. | Legal obligation. |
2. How We Share Information
2.1 Categories of Recipients
We may share personal data, where necessary, with: (a) payment processors for payment, fraud, and chargeback handling; (b) cloud and hosting providers; (c) infrastructure, network, and security providers; (d) analytics and product-telemetry providers; (e) customer-support and communications providers; (f) email and messaging providers; (g) professional advisers, including tax, accounting, audit, insurance, and legal advisers; (h) affiliated entities within our corporate group for operational, security, fraud-prevention, and administrative purposes; (i) governmental authorities, courts, regulators, and law-enforcement agencies where required by applicable law or lawful process; and (j) actual or prospective acquirers, investors, financing parties, and their advisers in connection with a corporate transaction, including a merger, acquisition, restructuring, financing, or sale of assets, subject to appropriate confidentiality safeguards.
2.2 Explicit Disclosures
We do not sell personal information for monetary value within the meaning of applicable U.S. state privacy laws, including the California Consumer Privacy Act (as amended). We do not share personal information for cross-context behavioural advertising or targeted advertising. In connection with the operation of our network Services, we may process routing and traffic metadata, including destination-level information such as domain or category indicators, for abuse prevention, policy and blocklist enforcement, and network integrity.
2.3 International Transfers
Personal data may be transferred outside the jurisdictions in which it is collected, including outside Singapore, the EEA, and the UK, to our service providers and affiliates. For transfers out of Singapore, we comply with the cross-border transfer requirements of the Personal Data Protection Act and its subsidiary regulations by ensuring overseas recipients are bound to a standard of protection comparable to that under the PDPA, including through contractual safeguards. For transfers out of the EEA or UK, we rely on European Commission or UK adequacy decisions where available, or on appropriate safeguards under Article 46 GDPR (and the equivalent UK GDPR provisions), including the EU Standard Contractual Clauses and, for UK transfers, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. A copy of the safeguards used for any specific transfer is available on request from the contact address set out in this Policy.
2.4 Data Retention
We retain personal data only for as long as necessary for the purposes set out in this Policy, or as required by applicable law. When personal data is no longer required, we delete or anonymise it.
3. Data Security
We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, misuse, or destruction. These measures include encryption of data in transit where appropriate, role-based access controls, internal confidentiality obligations, system monitoring to detect abuse or unauthorised activity, and established incident response procedures. Access to personal data is limited to authorised personnel and service providers who require such access for legitimate operational purposes. While we take appropriate steps to safeguard personal data, no method of transmission over the internet or electronic storage system can be guaranteed to be completely secure. Accordingly, we cannot guarantee absolute security.
Where a data breach meets the notification threshold under PDPA, we will notify the Personal Data Protection Commission and, where required, affected individuals within the timelines required by law.
4. Rights for European Users
If you are located in the European Economic Area or the United Kingdom, you may have certain rights under applicable data protection laws, including the General Data Protection Regulation (“GDPR”) and the UK GDPR. These rights may include the following:
- Right of Access. You have the right to request confirmation as to whether we process personal data about you and, where we do, to request access to that data together with details about how it is used.
- Right to Rectification. You have the right to request correction of inaccurate personal data and to have incomplete personal data completed.
- Right to Erasure. You have the right to request deletion of your personal data in certain circumstances, including where the data is no longer necessary for the purposes for which it was collected, or where processing is based on consent and you withdraw that consent.
- Right to Restriction of Processing. You have the right to request that we restrict the processing of your personal data in certain situations, such as where you contest the accuracy of the data or object to processing.
- Right to Object. You have the right to object to processing based on our legitimate interests where your particular situation gives rise to such objection. You also have the right to object to processing for direct marketing purposes (including profiling-based direct marketing where used).
- Right to Data Portability. Where processing is based on contract or consent and carried out by automated means, you may have the right to receive certain personal data in a structured, commonly used, and machine-readable format and to request its transfer to another controller where technically feasible.
- Right to Withdraw Consent. Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
- Right to Lodge a Complaint. You have the right to lodge a complaint with a supervisory authority if you believe that our processing of your personal data violates applicable data protection laws.
We may request information necessary to verify your identity before responding to your request. We will respond to valid requests without undue delay and, in any event, within one month, unless a longer period is permitted by applicable law.
5. Rights Under Singapore Law
If you are located in Singapore, you may have certain rights under the Personal Data Protection Act 2012 (PDPA). These rights include the following:
- Right of Access. You have the right to request access to your personal data that is in our possession or under our control, and to be informed of how such data has been or may have been used or disclosed within the year preceding your request.
- Right to Correction. You have the right to request correction of any error or omission in your personal data that is in our possession or under our control.
- Right to Withdraw Consent. You have the right to withdraw your consent for the collection, use, or disclosure of your personal data at any time. We will process your withdrawal request within a reasonable time and will inform you of the likely consequences of doing so. Withdrawal of consent does not affect any collection, use, or disclosure carried out before withdrawal, and we may continue to process personal data where permitted or required by law.
We will respond to valid requests within thirty (30) days, unless an extension is permitted by applicable law. We may charge a reasonable fee for access requests as permitted under the PDPA. If you are dissatisfied with our response, you may lodge a complaint with the Personal Data Protection Commission of Singapore.
6. Browser Extension and Free Tools
The Geonode browser extension and the free tools at geonode.com (including the free proxy list and “What is my IP” tool) process data necessary to operate those features, including IP address, browser type and version, extension version, basic telemetry, and interaction events. The extension operates within the permissions granted in your browser; you can review and manage those permissions through your browser settings and uninstall the extension at any time. The free tools do not require an account.
7. Cookies and Similar Technologies
Our use of cookies and similar technologies on geonode.com is described in our Cookie Policy, available at geonode.com/cookie-policy. You can manage your cookie preferences through our cookie banner. Strictly necessary cookies cannot be disabled. Where required by applicable law (including the EU ePrivacy Directive and UK Privacy and Electronic Communications Regulations), we obtain consent for non-essential cookies before they are set.
8. Marketing Communications
We send transactional communications (service notices, billing notices, security alerts, legal notices, support replies) without separate consent because they are necessary to perform our contract with you or to comply with legal obligations. We send marketing communications (product updates, newsletters, promotions) only where you have opted in, or where otherwise permitted under applicable direct-marketing law. You can opt out of marketing at any time using the unsubscribe link in each marketing message or by emailing privacy@geonode.com. Opting out of marketing does not affect transactional communications.