Privacy Policy updated

(c) Information collected from visitors to websites where the Service is installed: IP addresses, user-agent and other browser information, browser fingerprints, page and referrer URLs, ad-click identifiers, site-scoped identifiers, behavioral signals and coarse geolocation. Depending on the measurement features in use, this also includes non-Bot quality observations and evaluations, whether a purchase was observed, and conversion records with an optional purchase value. Related classification and ad-platform dispatch records are also recorded. The retained information differs by record category, as described in section 7. This data is collected on behalf of the website operator (our customer), who is the data controller for their own end-users.

(g) conduct fraud-prevention analysis and verify and improve classification accuracy using the Bot analysis archives and qualifying non-Bot quality-candidate archives described in section 7, including archives retained after the customer’s contract ends.

Ordinary visit records. Ordinary visit and verdict records follow a seven-day deletion schedule across subscription plans. Fingerprint records are deleted when eligible and no longer referenced by retained visits. Some source records may remain longer while archive copying and verification are completed. Deletion from the ordinary visit tables does not delete archive copies described below.

Bot analysis archives. Records associated with saved Bot classifications may include full IP addresses, trusted-IP and transport observations, user-agent and other browser information, page and referrer URLs, ad-click identifiers, site-scoped identifiers, fingerprints, classification evidence, observations and ad-platform connection records. These archives are kept indefinitely, with no time-based automatic expiry. We generally retain them after the customer’s contract ends for fraud-prevention analysis and the verification and improvement of classification accuracy.

Non-Bot quality-candidate archives. Qualifying candidate records include interaction observations and evaluations, classification changes, ad-platform dispatch records, recorded collection-permission and ad-platform consent status, internal visit and classification record identifiers, whether a purchase was observed, and identifiers and optional purchase values from matched conversion records. This is a separate archive with a different field set; it does not copy the Bot archive’s full IP, URL, user-agent and fingerprint record set. These archives are kept indefinitely, with no time-based automatic expiry, and are generally retained after the customer’s contract ends for fraud-prevention analysis and the verification and improvement of classification accuracy.

Conversion records. Ordinary conversion records follow a 90-day deletion schedule. For conversions matched to qualifying non-Bot quality candidates, the relevant conversion fact, internal record identifier and optional value may remain in the non-Bot quality archive after the ordinary conversion record is deleted. Source deletion may be deferred if the archive copy cannot be verified.

Invalid-click evidence. A separate evidence record for Bot-classified ad clicks includes the ad-click identifier, landing URL, user-agent, a coarsened IP prefix and detection metadata. These separate records follow a 180-day deletion schedule and support the website operator’s requests for advertising-platform investigations or advertising-cost refunds or credits. This schedule does not apply to the Bot or non-Bot quality archives above.

Requests concerning archived personal information are handled under section 9. The absence of an automatic expiry does not exclude applicable rights under section 9, such as rights to request deletion or restrictions on processing. Ending a subscription does not, by itself, delete these archives.

The return-visit cookie has a seven-day lifetime, and ordinary server-side visit links follow a seven-day retention schedule. Copies of site-scoped browser-link information contained in Bot analysis archives instead follow the archive retention described in section 7. Deleting or expiring a browser cookie does not delete these previously stored copies. Identifier-free daily return-visit snapshots are retained for 90 days. The identifier is not proof of a person’s or physical device’s identity.

For ordinary return-visit measurement, these IDs support repeat-visit analytics and estimated protection effects; they are not used for individual live Bot verdicts, decisions on what to send to ad platforms or billing. Copies retained in Bot analysis archives are separately retained for the fraud-prevention analysis and classification-accuracy verification and improvement described in section 3(g).

Data-handling correction. This revision, limited to the corrected descriptions in sections 2(c), 3(g), 7 and 8 and this paragraph, takes effect when this revised policy is first published on the Service's public Privacy Policy page, while all customer accounts are self-operated and there are no external customers. For this revision only, the operator has authorized publication without the 14-day advance notice; this exception does not apply to later changes. It applies to handling from publication and does not apply retroactively to any period before publication. The storage processes were already operating before this correction. Consent requirements and the rights in section 9 remain unchanged, as do the choices in section 8, the contact points and the respective roles of the website operator and FID. Future material privacy changes affecting external customers remain subject to the 14-day notice rule.