Terms of Service

These terms cover the IP99 website and API, operated by THREATHUNTER TECHNOLOGIES PTE. LTD. (Singapore). By creating an account or calling the API you accept them.

In effect since 11 September 2026. Jump to cancellation and refunds.

1. What the service is

IP99 answers questions about IP addresses: geolocation, network type, and a risk score derived from observed evidence. It is available as an HTTP API, as a Model Context Protocol endpoint for agents, and as pages on this website.

The free tier works without an account. An account raises the limit and gives you API keys you can revoke. Paid plans raise the limit further.

2. Plans and limits

Limits are enforced per day and reset at 00:00 Asia/Shanghai:

• Free, no account — 1,000 lookups per day, counted per client IP address.
• Free, signed in — 5,000 lookups per day.
• Pro — 35,000 lookups per day (about 1,000,000 / month).
• Pro+ — 175,000 lookups per day (about 5,000,000 / month).
• Enterprise — volume, terms and deployment agreed in a separate contract, which prevails over this page where the two differ.

There are also short-window rate limits, so that one client cannot exhaust a day's quota in a minute. Requests over a limit are refused with HTTP 429; they are not queued and not billed.

Paid plans do not change the answer. Every plan returns the same score, the same fields and the same freshness. You are paying for volume.

3. Billing

• Prices are in US dollars and exclude any tax that applies where you are.
• Subscriptions are monthly and renew automatically until you cancel. The card on file is charged on each renewal date.
• Payment is processed by Stripe. We never receive or store your card number.
• If a renewal payment fails, Stripe retries it. If it keeps failing, the subscription ends and the account returns to the free tier — the account and its API keys survive; only the limit drops.
• Need an invoice, a purchase order, a contract, or payment in another currency? Talk to us — that is what the enterprise route is for.

4. Cancellation and refunds

Cancel any time, from the billing portal linked in your console. Cancelling stops the next charge. Your plan stays active until the end of the period you have already paid for, and then the account returns to the free tier.

Because cancelling leaves you with the access you paid for, the remainder of a started month is not refunded. Two exceptions, and we do not argue about them:

• Charged in error — a duplicate charge, or a charge after you cancelled. Refunded in full.
• The service did not work — if the API was unavailable or wrong for a material part of a billing period, that period is refunded.

Refunds go back to the card that was charged, and Stripe takes a few business days to settle them. Ask by email — see contact below — with the account email address; you do not need to explain yourself.

If something looks wrong on your bill, email us before disputing it with your bank. A dispute freezes the amount for weeks and we can usually resolve it the same day.

5. Acceptable use

Do not:

• Systematically enumerate the address space to reconstruct or resell the database. The service answers lookups; it is not a bulk data licence. Bulk and offline use is the enterprise route.
• Share or resell your API key. Keys identify the account they are billed to.
• Work around rate limits — rotating IPs, many accounts for one workload, or automating the free tier at scale.
• Use the service where the result would decide something about a person that the data cannot support. See section 6.

We may suspend an account that does one of these, or that is being used to attack the service. Where we can, we email first; where the service is being harmed we stop it first and email after. A suspension for abuse is not refunded.

6. What the data means, and what it does not

The risk score measures the freshness and strength of verifiable evidence about an address. It is not a probability that the address belongs to an attacker, and it is not a statement about any person.

• score 0 with evidence_state: "none" means we hold no evidence. It does not mean the address is safe.
• Addresses change hands. Every answer carries the time it was computed, and an answer without that timestamp cannot be acted on.
• An address is not a person. Many people share one address, and one person moves between many.

So: use the result as one input among several, not as the sole basis for denying someone access, credit, employment or a service, and keep a route for a human to review. We provide the service as is, without a warranty that it is accurate, complete or uninterrupted.

7. Your data

• Account — we store the email address you sign in with, and your API keys.
• Requests — we log API requests (the address looked up, the time, the key or IP that made the call) to enforce limits, bill accurately, and investigate abuse.
• We do not sell your request logs, and we do not use them to build a profile of your end users.
• Payment records are held by Stripe under their own terms.
• Ask us to delete your account and we delete it, including its keys. Records we must keep for accounting stay for as long as the law requires.

8. Availability and changes

We aim to keep the API available continuously, and we publish no uptime guarantee on self-serve plans — a contractual SLA is part of an enterprise agreement.

We may change the API, but not silently: a breaking change to a response field gets advance notice by email to account holders. We may change prices; a change takes effect for you at your next renewal, with at least 30 days' notice by email, and you can cancel before then.

We may update these terms. The date at the top says which version is in effect. If a change materially reduces what you get on a paid plan, we email you first.

9. Liability

To the extent the law allows, our total liability for any claim relating to the service is limited to what you paid us in the 12 months before the claim, and we are not liable for indirect or consequential loss, including lost profit or lost data. Nothing here excludes liability that cannot legally be excluded.

These terms are governed by the laws of Singapore, and the courts of Singapore have exclusive jurisdiction.

10. Contact

Billing questions, refund requests, data deletion, or anything about these terms: tim@threathunter.com. Include the email address on the account.

THREATHUNTER TECHNOLOGIES PTE. LTD., Singapore.