Privacy

1. Roles

For account data, the operator is the controller. For the data that passes through the challenge and verify endpoints of your sites, you are the controller and the operator is your processor. The data processing agreement covers that part.

2. Data that the service processes

• Account data: your email address, sign-in tokens (hashed), secret key hashes, the IP address and browser of each signed-in session (listed under signed-in devices in Settings), billing status (the Stripe customer and subscription identifiers), your email choices (setup emails and site alerts on or off, with the date) and a record of which setup and alert emails you got. We delete both with the account. Until you pay, your email is the only personal data in the account. When you pay, Link and Stripe receive your card details, your billing address and your country. The operator never sees your card details.
• Visitor data: for each challenge, the service uses the IP address of the visitor's browser for rate limits and to see whether it belongs to a hosting provider. The address never sets the difficulty. It keeps the address in memory for one minute and never writes it to the database or to a log. For each verification the service stores the time, the origin host of the page, the difficulty and the result. The service stores no visitor IP address, sets no cookie, does not track visitors and never sees the content of a form.
• Technical logs: request logs (time, method, path, status, user agent and referrer) without IP addresses, kept for 30 days for security and debugging.
• Usage statistics of this website and the dashboard: we count page views on our own server, without cookies and without scripts. For each visit we make a one-day identifier: a hash of your IP address and browser name with a random key that we delete after two days. We never store your IP address or browser string. When you are signed in, we record which features of Bot403 you use (for example that you created a site or an API key, and how many verifications your sites had), to improve them. The challenge and verify endpoints that your sites call are not part of these statistics.

3. What the browser script does not do

The script sets no cookies, reads no storage, loads nothing from third parties and sends one request to the challenge endpoint. It does not fingerprint the browser. It does not know who the visitor is.

4. Purposes and legal bases

The service processes data to operate the service (contract, Art. 6(1)(b) GDPR), to prevent abuse and to count how the website and the dashboard are used (legitimate interest, Art. 6(1)(f)), and to bill you and keep the payment records that the tax law requires (contract and legal obligation, Art. 6(1)(c)).

The service sends three kinds of email to the address of the account. Each setup email and each site alert goes out at most once for each account. No email has tracking pixels or tracked links.

• Account emails: the sign-in link, the welcome, two-factor notices, quota warnings. They are part of the service (contract, Art. 6(1)(b)), so you cannot turn them off.
• Site alerts: when the script runs on a site but your server never verifies, or when a site that worked stops. They tell you that the protection fails (contract, Art. 6(1)(b)).
• Setup emails: a tip when a site never loaded the script, and a checklist after the first verification. They are about the service that you use (ePrivacy soft opt-in and legitimate interest, Art. 6(1)(f)).

Each site alert and setup email has a link that stops that kind of email with one click. You can also turn them off in the Emails section of the Account page.

5. Where the data is

The service runs on one server at Contabo GmbH, Germany. Backups stay in the EU.

6. Sub-processors

Stripe and Link for payments, Contabo GmbH, Germany for hosting, and Purelymail for outgoing email. The full table with locations and safeguards is on the sub-processors page. The operator does not sell data and does not use third-party analytics.

7. Retention

Verification records are deleted after the statistics period of your plan (30 or 90 days). Account data is deleted within 30 days after you close the account. Accounts that never created a site are deleted 7 days after sign-up. Usage statistics: page views are kept for 13 months, and account activity while your account exists, at most 25 months. Invoices stay as long as the tax law requires.

8. Your rights under the GDPR

You have the rights of access, rectification, erasure, restriction, portability and objection. Email [email protected] to use them. You can also make a complaint to the supervisory authority of your country.

9. International transfers

The data stays in the EU. Stripe and Link are in the US and process your email and payment details under the EU Standard Contractual Clauses and the EU-US Data Privacy Framework. The Stripe privacy policy tells how Stripe and Link use payment data.

10. Cookies

The service pages set only necessary cookies: the session cookie, the CSRF cookie, and a short-lived cookie for status messages. The browser script on your pages sets none. No cookie banner is necessary because there are no tracking cookies.

11. Changes

Updates appear on this page. Account holders get an email about material changes.