Privacy policy

1. Who we are

ClickShield is operated by the ClickShield platform team in Zagreb, Republic of Croatia ("we" or "ClickShield").

For any question about personal data processing and exercising your rights, contact us through the contact details in your ClickShield account or our official privacy contact.

2. What ClickShield does

ClickShield counts the clicks on an advertiser’s Google Ads per device. If a device opens the advertiser’s website more often than the advertiser’s rules allow, ClickShield flags it and adds the device’s latest IP address to the advertiser’s linked Google Ads campaigns as an IP exclusion, so their ads are no longer shown to that address. The exclusion is removed at the next sync with Google Ads after the flag expires, or when the advertiser lifts the flag. The advertiser can also flag a device by hand; such a flag lasts until it is lifted.

3. Visitors of advertisers’ websites

When you open the website of an advertiser that uses ClickShield from one of their Google Ads, the ClickShield script on that website sends us:

• the time of the visit and your IP address;
• the click identifier Google adds to the address of the page (gclid, wbraid or gbraid) and the campaign tags in that address;
• the page you opened, the page you came from and your browser’s language;
• your browser’s description (its user agent) and whether you opened the page anew, reloaded it or returned to it with the back button;
• a random device token that the script keeps in your browser’s local storage, so a return from the same browser is recognised.

The script then asks Fingerprint Pro, a device identification service, to identify your device. Fingerprint answers with a visitor identifier and signals about the device: whether a VPN or a private window was used, whether it looks like a bot, the browser, operating system and type of device, and an approximate location derived from the IP address (country and city). We store them with the visit.

ClickShield recognises a device across the websites of all advertisers that use ClickShield: Fingerprint gives the device the same visitor identifier on each of them, and ClickShield links the identifiers that belong to one device. So when an advertiser flags a device that has also visited other advertisers’ websites, the IP address the device last used on any of these websites can be added to that advertiser’s campaigns as an exclusion, and the advertiser sees that address to protect their own campaigns.

The advertiser decides to use ClickShield on their website and is the controller of this data; we act as the processor and process it on the advertiser’s behalf under our data processing terms. The advertiser’s own privacy policy tells you about it and how to reach them.

4. Why we process visitor data

We process the data of visits from ads:

• to count the paid clicks per device and recognise devices that click again and again;
• to add the latest IP address of a flagged device to the advertiser’s linked Google Ads campaigns as an exclusion, and to remove the exclusion at the next sync after the flag ends;
• to show the advertiser each device’s visits, so every exclusion can be traced back to the clicks that caused it.

The legal basis is the advertiser’s legitimate interest in protecting their advertising from repeated and fraudulent clicks (Article 6(1)(f) GDPR), or the visitor’s consent where the advertiser requests it before running the script.

5. People who use ClickShield

If you have a ClickShield account, we process:

• your name, email address and password (stored only as a hash), your phone number if you enter one, your role and your account settings;
• your profile picture, if you upload one;
• the domains you add, the pools and rules you set up, and the flags you add or lift;
• if you connect Google Ads: the access Google grants us (stored encrypted), the names and numbers of your Google Ads accounts and the campaigns you link;
• for each sign-in: the time, the IP address and the browser it came from;
• error reports from the app, which can include your user identifier and IP address.

We use this data to provide the service you signed up for (Article 6(1)(b) GDPR) and to keep it secure, for example to limit repeated sign-in attempts (Article 6(1)(f) GDPR).

6. Who receives the data

We share personal data only with these recipients:

• Fingerprint (FingerprintJS, Inc.), which identifies devices for us in its EU region;
• Google: the IP addresses of flagged devices go to Google Ads as exclusions in the advertiser’s own campaigns, and ClickShield runs on Google Cloud infrastructure in the europe-west4 region (the Netherlands), where its database and uploaded profile pictures are stored;
• our transactional email (SMTP) provider, which delivers password reset and email confirmation messages when email sending is enabled;
• the advertiser whose website you visited, who sees the visits and flags of devices on their own domains and, for a device they flag, its latest IP address, which may come from another advertiser’s website (as described above).

Fingerprint and Google are based in the United States, so data may be transferred outside the European Union under the EU-US Data Privacy Framework and the European Commission’s Standard Contractual Clauses.

7. How long we keep the data

We keep:

• visits and device records for the traffic retention period configured in the system, or while the account remains active when automatic traffic deletion is not switched on;
• an IP exclusion in Google Ads while its flag lasts and until the next sync after the flag ends: a flag lasts as long as the advertiser’s rules set (by default 1, 7 and 30 days for a device’s first three flags, while the fourth lasts until it is lifted), a flag the advertiser adds by hand lasts until it is lifted, and the advertiser can lift any flag at any time;
• account data while the account exists, and upon closure it is deleted without undue delay except where retention is required by applicable law;
• error reports, which can include the IP addresses of visitors and users, for up to 90 days once automatic log retention is switched on in the system (while switched off, they are kept until cleared).

An exclusion can stay longer. While ClickShield cannot reach the advertiser’s Google Ads account (it was disconnected or its access was revoked), or while Google Ads refuses to remove the exclusion, it stays until ClickShield manages to remove it or someone removes it in Google Ads. Once the advertiser’s ClickShield account is deleted, it stays until someone removes it in Google Ads.

8. Cookies and storage in your browser

The ClickShield website and app use no advertising or analytics cookies. They use:

• refresh_token, which keeps you signed in (30 days, or until you close the browser if you sign in without staying signed in); strictly necessary;
• cs_lang, which remembers the language you pick in the language menu (one year; in Safari and Brave, seven days from your last visit); set only when you pick one;
• google_ads_oauth_nonce, which protects the step of connecting Google Ads (10 minutes); strictly necessary;
• your browser’s local storage, for your sign-in token, a copy of your account details (such as your name, email address and role) and your display settings, and its session storage, for the time the app last reloaded itself after an update.

On the websites of advertisers that use ClickShield, the ClickShield script keeps the device token described above in local storage, and Fingerprint Pro may store its own identifiers; the advertisers inform their visitors about both.

9. Your rights

You can ask for access to your data, its correction or deletion, a restriction of its processing or a copy in a portable form, and you can object to processing that rests on a legitimate interest. You can send your request through the contact details in the app or our official privacy contact. If your request concerns a visit to an advertiser’s website, you can also contact the advertiser; we help them answer it.

You can also complain to the Croatian data protection authority, Agencija za zaštitu osobnih podataka (AZOP, azop.hr).

10. Changes to this policy

We publish every change to this policy on this page, with the date it takes effect.