Privacy

Privacy and cookies

This notice explains what personal data bgp43.net processes, why, on what legal basis and for how long, and what rights you have. It covers the European General Data Protection Regulation (GDPR) and the Israeli Privacy Protection Law.

Updated September 30, 2026

Who is responsible

Controller: Vladyslav Koba, operator of bgp43.net, established in Israel. Privacy contact: admin@bgp43.net.
The controller is not established in the European Union and designates no representative in the Union: the processing is limited in scope, does not involve large-scale processing of special categories of personal data and is unlikely to result in a risk to the rights and freedoms of natural persons (Art. 27 (2) GDPR).
Data is processed on the operator's own server in Israel and on the routers that carry the service, which are hosted by sponsor networks in the European Union.
Transfers to Israel are covered by the European Commission's adequacy decision for Israel (Decision 2011/61/EU).

What we process and why

Account data: e-mail address, display name, password (stored only as a hash), interface language, traffic counters and the limits that apply to you - to run your account and the service you asked for; Art. 6 (1) (b) GDPR, and Art. 6 (1) (f) for protecting the service from abuse.
ASN ownership data: the AS number, prefixes, the registry contact addresses we look up (WHOIS, RDAP, IRR, PeeringDB), the verification code and its status - to confirm that you control the network you ask us to serve; Art. 6 (1) (b) and (f) GDPR.
Network objects: tunnel endpoints, BGP session parameters, prefix lists and routing metadata - to provision and operate what you requested; Art. 6 (1) (b) GDPR.
Operational records: job and deployment logs, traffic counters and error diagnostics (exception, message, stack trace, request URI, request identifier, account, time) - for troubleshooting, security, abuse handling and capacity protection; Art. 6 (1) (f) GDPR.
Rate-limit records: a salted hash derived from the address and the action, the attempt count and the time window - to stop brute force and abuse; Art. 6 (1) (f) GDPR. The address itself is not stored in readable form.
Verification mail: sender, recipient, subject and match status of messages arriving in the project's verification mailbox - to prove ownership and to document abuse; Art. 6 (1) (b) and (f) GDPR.
Correspondence: whatever you send us by e-mail - to answer it; Art. 6 (1) (b) and (f) GDPR.
Where a legal obligation requires us to keep or disclose something, for example a court or abuse request, the basis is Art. 6 (1) (c) GDPR.

Cookies and local storage

bgp43_session - your signed-in session; up to 14 days; strictly necessary for the login you asked for.
csrftoken - protects forms against cross-site request forgery; 1 year; strictly necessary for security.
Cloudflare may set __cf_bm or cf_clearance while the Turnstile bot check runs; strictly necessary for that bot check and its delivery. It is not used for delivery of the site itself.
localStorage entry bgp43-ui - stores the theme and accent you pick so the page does not flash the wrong colours; written only when you change the appearance; it holds no identifier and is not used to track you.
We use no analytics, advertising or tracking cookies of our own. Only strictly necessary storage is used, which is why no consent banner is shown (§ 25 (2) TDDDG).

Who receives data

TMW Shield (content delivery and proxy at the network edge, AS215828) processes connection data such as your IP address and request headers to deliver the site and protect it from abuse. Cloudflare, Inc. (United States) is used only for the Turnstile bot check: it processes connection data such as your IP address and request headers and validates the Turnstile challenge. Transfers rely on the providers' certification under the EU-US Data Privacy Framework and on standard contractual clauses.
88x31.lol - the small visitor-counter image in the footer is loaded from that service, which therefore sees your IP address and the page you requested. It is a single image and sets nothing on your device.
Sponsor and transit networks (Hop179.net, AS213449.net, Lyncqia, Lungu Stefan, as214757.net) - they carry the traffic and handle abuse reports for the networks they serve.
Public registries and databases we query (RIPE NCC, RADb and other IRR services, RDAP services, PeeringDB) - we send them the ASN or prefix being looked up; they receive no account data.
The mailbox host that receives mail for verify@bgp43.net - for ownership verification.
We do not sell personal data and do not pass any to advertisers. Advertising banners are served from this site; no data about you reaches the advertiser.

How long we keep data

Session: up to 14 days after sign-in.
Rate-limit records: deleted 7 days after the window closes.
Verification mail files: deleted after 30 days.
Job logs: 14 days. Deployment logs: 30 days. Error diagnostics: 30 days after the last occurrence.
Server journals (application and system logs): 30 days.
Database backups: rotating daily copies, deleted after 14 days.
Account, ASN request and network data: for as long as your account exists, and deleted within 30 days after you ask us to delete it.
Abuse, security or legal matters may be kept longer where that is necessary to defend claims or to comply with a legal obligation.

Your rights

You may request access to your data, its correction, deletion and restriction of processing, and - where the requirements are met - a portable copy (Art. 15 to 20 GDPR).
You may object to processing based on legitimate interests (Art. 21 GDPR); we then stop unless we can show compelling grounds.
You may complain to a data protection supervisory authority - in the EU, any authority in your country of residence; in Israel, the Privacy Protection Authority.
Exercise any of these rights by writing to admin@bgp43.net. We answer within one month.

Automated decisions

No automated decision-making and no profiling within the meaning of Art. 22 GDPR takes place.
Ownership of an ASN is checked by our rules and reviewed by a human before access is granted; traffic limits are applied by fixed technical rules that are visible in your dashboard.

Do you have to provide data?

You must give us an e-mail address, the ASN and the network data you request, and a reachable contact: without them we cannot verify ownership, provision anything or warn you about abuse.
Everything else is optional. If you do not provide the required data, we cannot serve you.

Security

Access to the control plane is authenticated, passwords are stored only as hashes, connections are encrypted in transit, server access is restricted to the operator, and the database is backed up daily.
No system can be guaranteed secure; we keep the surface small and store only what the service needs to operate.

Children

bgp43 is a service for network operators. It is not intended for children and we do not knowingly process data of persons under 18.

Changes

If the processing changes, this notice changes with it. The date at the top tells you the version in force.