Privacy policy

1. Who we are

ClickTrap is a service that protects businesses’ online advertising from invalid and fraudulent clicks. It is provided by Lanyards Trader LTD trading as ClickTrap trading as ClickTrap, a company registered in England and Wales (company number 09614643), whose registered office is at 37 Lonsdale Close, London, SE9 4HF (“Lanyards Trader LTD trading as ClickTrap”, “we”, “us”).

For any question about this policy or your personal data, email support@clicktrap.co.uk.

2. The people this policy covers, and our role

We handle personal data about three groups of people, in different roles:

• Our customers and their users: the people who sign up for and use ClickTrap, people who visit our own website, use our free tools, join our waiting list or apply to our partner programme. We are the controller of this data. Sections 3 to 5 cover it.
• Visitors to our customers’ websites who arrive from an ad. We process their data on our customers’ behalf, as a processor. The customer whose website they visited is the controller, and its privacy notice applies. Section 6 summarises what we do.
• IP addresses reported to the Collective Shield. For this pooled fraud-prevention list we are the controller. Section 7 covers it.

3. Data about our customers and users

We do not use your data for advertising, and we do not sell it. If you add our website badge to your site, the link carries your referral code, so we can credit you for customers who sign up through it.

The free Google Ads scan. If you use it without being a customer, we keep the email address you give and the figures in your report for 30 days, so the report link works, then delete both. The Google access you give is used only to read the last 30 days of reports, never to change anything, and is revoked as soon as the scan finishes. Legal basis: legitimate interests (giving you the report you asked for).

Data from Google. ClickTrap’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use the Google Ads data you let us read (your account names, campaigns, costs, click records and settings) only to provide and improve the features you use, for your own account. We do not sell it, use it for advertising, or use it to train general artificial intelligence or machine learning models. Our staff do not read it unless you ask us to, it is needed for security or to investigate abuse, or the law requires it. You can remove our access at any time from your settings or from your Google account’s security page, and we then stop reading your data.

4. Cookies and similar technologies

In our app, we use only cookies that are strictly necessary: a session cookie that keeps you signed in, a security cookie that protects forms against cross-site request forgery, and, if you tick “Remember me”, a cookie that keeps you signed in for longer.

On our public website, we use the same necessary cookies and, only as you choose, optional ones for analytics and advertising (such as Google Tag Manager and the services it loads). Where the law asks for consent first, nothing optional runs until you agree; elsewhere you can opt out at any time, and we honour your browser’s Global Privacy Control signal. You can change your choice from “Cookie settings” at the bottom of each page.

Every cookie, what it’s for and how long it lasts is listed in our cookie policy.

On our customers’ websites, our tracking code runs only when someone arrives from an ad. It does not set cookies. It uses the browser’s session storage (cleared when the tab is closed) to link the pages of one visit, and reads characteristics of the browser and device (such as screen size, time zone, language, installed fonts and how the device draws graphics) to recognise repeated clicks from the same device. Where a customer uses our device-identification provider, its script may also store an identifier in the browser. Where a customer switches the features on, the code also tells the website’s own tags (such as Google Tag Manager, the Google tag, Microsoft UET or the Meta Pixel) whether a visitor from an ad looks genuine or suspicious, and hides the website’s contact links and forms from visitors whose source is blocked; those tags are the customer’s, under its own cookie policy. Our customers are responsible for telling their visitors about this and for obtaining consent where the law requires it.

5. How long we keep customer data

• Account and user details: while the account exists. When a subscription ends, the whole account is deleted 30 days later.
• Invoices and billing records: six years after the end of the financial year they relate to, as UK tax law requires.
• Security and audit records: as long as the account exists.
• Support requests and emails: up to two years after the conversation ends.
• Partner programme records: while you are a partner; records of payments for six years, as UK tax law requires.
• Waiting list: deleted automatically 30 days after we email you that sign-up has reopened, and after a year at most. You can ask us to remove it sooner.

6. Visitors to our customers’ websites

When someone clicks a customer’s ad and lands on the customer’s website, our tracking code sends us, on the customer’s behalf:

• the IP address (both the IPv4 and the IPv6 address, where the visitor’s connection has both), and the country and network it belongs to;
• the browser’s user agent and the device characteristics described in section 4, from which we derive a device identifier;
• the ad click’s identifier and details (campaign, ad group, keyword and match type, network, the website or app the ad was shown on, device type and the approximate location Google gives, such as a town), the landing page address and the referring page;
• how long the visitor spent on the website and the paths of the pages they viewed (without any query string);
• counts of how the visitor behaved on those pages: how far they scrolled, how often they moved the pointer or touched the screen, and how many clicks, key presses and form fields there were. Never what was typed, or where on the page;
• where the customer switches it on, that the visitor sent a form, which form and on which page, but never anything typed into it;
• signs that the visit is automated or comes from a network real customers rarely use: whether the browser reports being driven by automation software, and whether the IP address belongs to a hosting provider or the Tor network (checked against lists we hold; nothing is sent to anyone);
• where the customer uses it, signals from our device-identification provider, such as whether the visitor is using a VPN or the browser has been tampered with.

We also read the customer’s own records of each click from its advertising account, such as whether Google counted the click or filtered it as invalid.

We use this data only to detect invalid clicks for that customer, to exclude IP addresses from its advertising under the rules it sets, and to show it reports. Where the customer switches the features on, we also use it to send Google only the conversions from genuine visitors (the click’s identifier and the time, nothing typed), and, where the customer uploads a list of the click identifiers of leads that became its customers, with the date and sale value, to send Google the genuine ones, to tell the customer’s Meta Pixel about blocked visitors from its Meta ads (their IP address, browser and click identifier, through Meta’s Conversions API with the customer’s own access key), to briefly pause the part of a campaign under attack, and to give the customer’s own systems this data through the API tokens and webhooks it sets up. We keep it for the retention period of the customer’s plan (Sentry: 90 days; Patrol: 180 days; Garrison: 365 days; Fortress: 730 days) and then delete it, or earlier when the customer’s account is deleted. Our data processing agreement governs this processing. If you visited one of our customers’ websites and want to exercise your rights, please contact that customer; we will help them respond.

We may publish totals across all customers, such as the share of ad clicks that were invalid in a quarter. These are anonymised and never identify a visitor, a customer or a website.

7. The Collective Shield

For the Collective Shield, Lanyards Trader LTD trading as ClickTrap is the controller.

What we do. When our service blocks an IP address on any customer’s account, or detects a strong sign of fraud from it (such as automation software or a known attack source), we record that address, the kind of signal, which customer and website saw it, and the date. We do not pool device identifiers, page details or ad details. When several different customers independently report the same address, we list it, and customers who use the Collective Shield then exclude it from their advertising.

Why, and our legal basis. We do this to prevent fraudulent and invalid clicks on online advertising. Our legal basis is legitimate interests: ours and our customers’ interest in preventing fraud, which UK data protection law recognises. We have assessed that it does not override the interests of the people concerned, because we hold minimal data for a short time, and the only effect of a listing is that an address stops being shown some ads.

Safeguards. One customer alone can never cause an address to be listed. Addresses that many people share, such as mobile networks, are never listed automatically. Customers never see each other’s reports; they see only whether an address is listed. Listings that customers remove go to staff review.

How long. Reports are deleted after 90 days. A listing ends 30 days after the address was last reported.

Your rights. You can object to this processing, or ask us to check or remove a listing for your IP address, by emailing support@clicktrap.co.uk. More detail is on our Collective Shield page.

8. Who we share data with

We use the following providers (sub-processors) to run the service. Each processes data only on our instructions, under a written contract with appropriate security and confidentiality obligations.

When a customer connects Google Ads, we send Google, on the customer’s instruction, the IP addresses to be excluded and, where the customer switches them on, its verified conversions and the other changes described in section 6. Where a customer uses Meta’s Conversions API, we send Meta the details of blocked visitors described in section 6. Each platform handles this data under its own terms with that customer. Alerts a customer chooses to receive in Slack or Microsoft Teams go to the addresses it gives us, and events it chooses to receive by webhook (such as a newly blocked IP address) go to the web addresses it gives us. We may also disclose data where the law requires it, to protect our rights or others’ safety, or to a buyer if our business is sold, under the same protections as this policy.

IP address locations and networks are looked up in data from DB-IP, licensed under CC BY 4.0. The lookup happens on our own servers; no data is sent to DB-IP.

9. International transfers

Where a provider processes personal data outside the UK, we make sure it is protected by UK adequacy regulations, or by the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional measures needed. You can ask us for details of these safeguards.

10. How we protect data

All connections to our service use encryption (HTTPS). Passwords are stored only as secure hashes; access tokens and secret keys are encrypted at rest. Each customer’s data is kept separate from every other customer’s, and access by our staff is limited, recorded and protected by two-factor authentication. We keep regular backups and review our security measures regularly. No system is completely secure; if a breach affects your personal data, we will tell you and the regulator where the law requires.

11. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted, or its use restricted, in some circumstances;
• object to our use of your data based on legitimate interests, including for the Collective Shield;
• receive data you gave us in a portable format;
• withdraw consent, where we rely on it.

To use any of these rights, email support@clicktrap.co.uk. We may need to check your identity first, and will reply within one month. If you are unhappy with how we have handled your data, please tell us, and you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

12. Children

Our service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18 as a customer or user.

13. Changes to this policy

We may update this policy. The date at the top shows when this version took effect. If we make a significant change, we will tell account owners by email before it applies.