Privacy Policy

The detection script is built to be privacy-preserving. It does NOT fingerprint visitors, does NOT build visitor profiles and does NOT store any identifier that singles out a visitor. It only reports anonymous, aggregated counters to us. For each customer Site and each calendar day: how many checks ran, how many indicated an ad blocker, how many were resolved, and counts by browser family, device type, approximate country, hour of the day (UTC) and page path (only the most visited paths), all derived from the standard headers every browser sends with a request and kept only as daily totals.

To count recoveries correctly, the script keeps a few small first-party entries on the customer's own domain: in the browser's local or session storage and, when the Site spans several subdomains, in a first-party cookie set on that domain. They hold only timestamps, sometimes with the kind of blocking seen (such as a browser extension), for example that an ad blocker was seen in that browser or that a recovery was already counted. They contain no identifier, are not used for advertising, profiling or tracking, and stop being used after 30 days at most. If a report cannot reach our servers, the script also keeps that pending report in the same storage, with no visitor identifier, and sends it again within 24 hours; it is deleted once delivered.

Because those entries are stored on the visitor's device, the customer should describe them in the privacy or cookie policy of their Site and decide, under the rules that apply to them, whether their consent tool must cover them. You remain responsible for any other tags on your Site.

Like any web server, ours receives the IP address of the visitors whose browsers load the script or send a report. We use it in transit to derive the approximate country and to protect the Service against abuse; it is not stored in the statistics and is not linked to any visitor identity. It is also recorded, together with the browser user agent and the requested address, in our server access logs, which are kept for security and troubleshooting and deleted automatically after 14 days.

A short-lived, server-issued session identifier and session key are embedded in each served script purely to authenticate event reports; they are not linked to any visitor identity and expire within minutes.

When you register and use the dashboard we process: your name and email; a securely hashed password; an encrypted optional security PIN; your plan and billing status; your verified Site domains; support tickets you open; and security metadata such as login timestamps and IP addresses used for rate-limiting and abuse prevention. If you choose to add them in Settings, we also store optional billing and contact details (a billing or postal address, a phone number, a tax identification number, and one additional contact channel), used only to prepare your invoices and to reach you about your account. These optional details are stored with your account, so they are included in any access or deletion request you make, and you can clear them yourself at any time.

We also record, at the moment you create your account, how you reached us: the referring website and any campaign tags in the address you arrived with (utm_source and similar), plus the first page of ours you opened. We use it only to understand which channels bring us customers. It is stored with your account, so it is included in any access or deletion request you make, and it never contains anything you typed.

IP addresses used in rate-limiting and abuse records are hashed with a secret salt. As a security measure we do keep, in plain form, the IP address of your most recent sign-in and a security log of your account: each sign-in, failed sign-in attempt, lockout after too many attempts and password reset request, and the changes made to your account, your Sites and your subscription, by you or by our administrators, each with its date and, where there is one, the IP address it came from. Sign-in and password-reset entries are deleted automatically after 30 days. Server access logs also record the IP address of every request to our service, as described in section 1.

If you write to us through the chat on our website, we keep the conversation (your messages and our replies), the email and name you choose to give us (or, if you are signed in, the email of your account), the language of the page, your approximate country, a short description of your browser and device (for example "Chrome · macOS"), the pages of ours where you started and where you were, the website you came from and any campaign tags. The chat sets one technical cookie, only from your first message and for 30 days, so that you keep the same conversation while you browse; your IP address is stored only as a salted hash, to protect the chat against abuse. If you leave your email and go before we reply, we send our reply there. We use all this only to answer you.

If you write to us through the contact form on our website, we receive your name, your email, your message and the IP address you send it from, in plain form, and we use them only to answer you and to protect the form against abuse.

We do not collect or store your card or payment details. Payments are handled by Stripe, which acts as Merchant of Record through its Link service and processes your payment information under its own privacy policy. We receive only the transaction result and the information needed to provision your plan.

We process customer data to perform our contract with you (provide the Service), to comply with legal obligations (accounting, tax), and on the basis of our legitimate interests (security, abuse prevention, improving the Service). Server access logs, including IP addresses, are processed on the basis of our legitimate interest in keeping the Service secure and available. Aggregated visitor counters are anonymous statistical data.

We share data only with processors who help us run the Service: our hosting/CDN provider, our payment provider (Stripe), and our email-delivery provider, each bound to protect it. We do not sell personal data. We may disclose data if required by law or to protect our rights.

We keep customer-account data while your account is active and for as long as needed afterwards to meet legal and accounting obligations. Aggregated daily statistics are retained for service history. Hashed security metadata is retained only as long as needed for abuse prevention. Server logs, which include IP addresses, are deleted automatically within 14 days. In your account's security log, sign-in and password-reset entries are deleted automatically after 30 days; the other entries are kept while your account is active and are deleted with it, except the payment records we must keep for accounting. The first-party entries kept in the visitor's browser expire after 30 days at most. Chat conversations are deleted 30 days after their last message, or earlier if you ask us (if we change this period, we will update this policy). The copy our website keeps of each message sent through the contact form (your name, email, IP address and the message) is deleted automatically after 30 days; the email we receive with that same information is deleted from our mailbox after 30 days. If we reply to you, the conversation continues by email and is kept as ordinary correspondence.

Under the GDPR and Spanish data-protection law you have the right to access, rectify, erase, restrict and port your personal data, and to object to certain processing. To exercise any right, or to complain, contact us at the address below. You may also lodge a complaint with the Spanish supervisory authority (AEPD).

Where data is processed outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. We protect data with encryption in transit (TLS), hashed credentials, encrypted secrets, scoped database access and least-privilege controls.

Data controller: AntiAdBlock Core. For any privacy question or request: [email protected].