Privacy Policy

1. Who We Are

ClickSentry is a fraud detection and bot protection platform operated from the Netherlands, European Union. We provide browser fingerprinting, behavioral analytics, bot detection, click fraud detection, email security, and consent management services to businesses.

Controller and processor roles: 1018 Commerce (trading as ClickSentry) is the data controller for personal data of visitors to clicksentry.nl and of our own customer accounts. For visitor data collected through the ClickSentry SDK on our clients' websites, the client is the data controller and ClickSentry acts as data processor on the client's behalf. A data processing agreement is available on request. Visitors to a client's website who wish to exercise their rights should primarily contact that client.

2. What Data We Collect

We collect data in two contexts: (a) from visitors to our clients' websites through the ClickSentry SDK, and (b) from users of our own platform and website.

2.1 Data Collected via the ClickSentry SDK (Client Website Visitors)

When the ClickSentry SDK is embedded on a client's website, we collect the following data from that website's visitors for the purposes of fraud detection and bot protection:

• Browser fingerprint data: Canvas rendering hash, WebGL renderer and vendor information, AudioContext fingerprint, installed font enumeration, screen resolution and color depth, timezone, language preferences, browser plugins, platform information, and hardware concurrency.
• Behavioral data: Mouse movements, clicks, scrolling, touch events on mobile devices, keystroke timing (timing only, never content), and page interaction timing.
• Network data: IP address, user agent, and referrer. IP addresses are used for fraud and bot detection, IP intelligence (e.g. VPN, proxy, Tor, datacenter), and, coming soon, automatic IP exclusion in Google Ads where the client has enabled this.
• Automation indicators: Presence of WebDriver, headless browser markers, known bot signatures, and browser consistency checks.

Important: The SDK does not collect names, email addresses, physical addresses, or payment information. Note that IP addresses, visitor identifiers, and device fingerprints can qualify as personal data under the GDPR; we process them only for the purposes described in this policy and on behalf of our clients.

2.2 Data Collected from Our Platform Users

When you register for and use the ClickSentry platform (dashboard, API), we collect:

• Account information: Name, email address, company name, and billing information.
• Usage data: API usage statistics, dashboard interactions, and feature usage.
• Technical data: IP address, browser type, and device information when accessing our platform.

2.3 Data Collected on Our Website

When you visit clicksentry.nl, we use the ClickSentry SDK on our own website for fraud and bot detection and consent registration. We also use Google Analytics (measurement ID G-81YC049HS0) to collect web analytics data such as pages visited, referral source, and session duration. Google Analytics runs in Google Consent Mode: analytics cookies are only placed after you consent via our cookie banner. Our website also loads fonts from Google Fonts, which means your IP address is sent to Google when the fonts are loaded. Google may process this data outside the European Economic Area (EEA); such transfers to the United States are based on the EU-US Data Privacy Framework (see Section 5 and Section 7).

3. Purpose of Processing

We process data for the following purposes:

• Fraud detection and prevention: Identifying fraudulent clicks and fake account registrations through behavioral, fingerprint, and IP analysis, and, once available (coming soon), excluding fraudulent IP addresses in Google Ads where the client has enabled this.
• Bot protection: Detecting and flagging automated traffic including scrapers, credential stuffers, and click bots.
• Device identification: Recognizing returning visitors across sessions without relying solely on cookies, for the purpose of multi-account detection and session continuity.
• Service improvement: Analyzing aggregate, anonymized usage patterns to improve our detection algorithms and platform reliability.
• Platform operation: Managing user accounts, processing payments, providing customer support, and maintaining service availability.

4. Legal Basis for Processing

We process personal data based on the following legal grounds under the General Data Protection Regulation (GDPR):

• Legitimate interest (Article 6(1)(f) GDPR): The collection and processing of browser fingerprints, behavioral data, and network data for fraud detection and bot protection is based on the legitimate interest of our clients to protect their businesses against fraudulent activity. Where ClickSentry acts as processor, the client as controller determines the legal basis; for fraud prevention this is typically legitimate interest. We limit the data collected to what is necessary for fraud and bot detection.
• Contractual necessity (Article 6(1)(b) GDPR): Processing of platform user data is necessary for the performance of our service contract.
• Consent (Article 6(1)(a) GDPR): For marketing communications and non-essential cookies on our website, we rely on your explicit consent, which you can withdraw at any time.

5. Cookies

We use the following types of cookies. The complete, current list of all cookies and similar technologies on clicksentry.nl, with purpose and retention period, is in our Cookie Policy, where you can also change or withdraw your consent.

Essential cookies are required for the basic functioning of our service and cannot be disabled. Google Analytics cookies (_ga, _ga_*) are only placed after you give consent for statistics via our cookie banner; until then, Google Consent Mode is set to "denied". Google may process Google Analytics and Google Fonts data outside the EEA, based on the EU-US Data Privacy Framework. You can manage your cookie preferences at any time through our consent management tool or on our Cookie Policy page.

6. Data Retention

We retain data for the following periods:

• Browser fingerprint data: Retained only as long as necessary for fraud and bot detection, in line with the retention period of the client's plan and settings.
• Behavioral data: Retained for the same period as the associated fingerprint data.
• IP addresses: IP addresses of visitors to client websites are stored for fraud and bot detection (including, once available, Google Ads IP exclusion) and are kept only as long as necessary for that purpose, in line with the retention period of the client's plan and settings, after which they are deleted.
• Platform user data: Retained for the duration of the account plus 30 days after account deletion.
• Aggregated analytics: Anonymized aggregate data may be retained indefinitely for service improvement purposes.

Automatic data cleanup processes run daily to ensure data is deleted in accordance with configured retention policies.

7. Sharing with Third Parties

We do not sell, rent, or share personal data with third parties for marketing purposes.

Data collected through the ClickSentry SDK is only accessible to the client who installed the SDK on their website. Each client's data is strictly isolated and cannot be accessed by other clients.

We may share data only in the following limited circumstances:

• Legal obligation: When required by law, regulation, or valid legal process.
• Service providers: With carefully selected infrastructure providers located within the EU who assist in operating our service, bound by data processing agreements.
• Google (our own website only): Our website clicksentry.nl uses Google Analytics (after consent) and Google Fonts. Google may process this data outside the EEA, based on the EU-US Data Privacy Framework.
• Google Ads (coming soon, on client instruction): Google Ads exclusion is not yet available. Once released, and only if a client connects its Google Ads account, IP addresses flagged as fraudulent will be sent to that Google Ads account as IP exclusions.

8. Security

We implement comprehensive technical and organizational measures to protect your data:

• Encryption in transit: All data is transmitted over TLS 1.2 or higher. We enforce HTTPS across all endpoints.
• Restricted storage: Stored data is kept on access-restricted infrastructure within the EU.
• EU hosting: Data processed by the ClickSentry platform is stored on infrastructure located in the Netherlands, European Union. The only exceptions are Google Analytics and Google Fonts on our own website and Google Ads IP exclusions on client instruction (see Section 7).
• Access controls: Strict role-based access controls, API key authentication with bcrypt hashing, and comprehensive audit logging.
• Tenant isolation: Each client's data is logically isolated at the database level, preventing unauthorized cross-tenant access.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Article 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Article 16): You may request correction of inaccurate personal data.
• Right to erasure (Article 17): You may request deletion of your personal data. We provide a dedicated API endpoint for data deletion requests.
• Right to restriction (Article 18): You may request restriction of processing of your personal data.
• Right to data portability (Article 20): You may request your data in a structured, commonly used, and machine-readable format (JSON or CSV).
• Right to object (Article 21): You may object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds.

To exercise any of these rights, please contact us at [email protected]. If your data was collected through the SDK on a client's website, we will forward your request to that client, who is the data controller. We will respond to your request within 30 days, as required by the GDPR.

10. Contact for Privacy Inquiries

For any questions or concerns regarding this Privacy Policy or our data processing practices, please contact us:

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify platform users via email and update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Continued use of our services after changes to this policy constitutes acceptance of the updated terms.

12. Supervisory Authority

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is: