Privacy Policy

Data we collect about customers

When you create and use an account we collect:

• Account data: name, email, password hash, plan, and billing/wallet records.
• Usage data: dashboard activity, API requests, flow and white-page configurations.
• Technical data: IP address, browser/device info, and logs for security and diagnostics.

Data processed on your visitors

When you run the filtering engine or session recording, the Service processes visitor data such as IP address, user-agent, headers, approximate geolocation, and (if recording is enabled) on-page interactions. For this data, you are the data controller and we act as your processor under our Data Processing Addendum.

How we use data

• To provide, secure, and improve the Service.
• To make per-visitor filtering decisions and produce analytics/recordings you request.
• To process payments and prevent fraud and abuse.
• To communicate with you about your account and important changes.

Threat-intelligence

The filtering engine compares visitor IPs against public threat-intelligence feeds and our own reputation signals. This is used solely to classify traffic for your flows.

Sharing

We do not sell personal data. We share data only with the subprocessors needed to run the Service (see our Subprocessors page) and where required by law.

Advertising-platform integrations (OAuth)

If you connect a Google Ads, Microsoft Advertising, Meta Ads, or other advertising account to Cloackit, we receive an OAuth refresh token, your account/customer identifiers, and limited campaign metadata. We use it strictly to (a) report invalid-traffic IP addresses our engine detected on your behalf so the platform can issue you an invalid-click adjustment, (b) keep your IP-exclusion list in sync, and (c) read the minimum campaign data required to attribute clicks. We never use these tokens for any other Cloackit account, and you can revoke them from your dashboard or from the platform's permission page at any time.

Visitor IP addresses, user-agents, click timestamps, and the reason our engine classified the click as invalid are transmitted to the connected platform together with the relevant campaign identifier (e.g. gclid/wbraid/gbraid for Google Ads). No customer PII, password, or payment data is ever shared.

Retention

We keep account data for as long as your account is active and as needed for legal/financial obligations. Recordings and decision logs are retained per your plan and settings, after which they are deleted.

Your rights

Depending on your location you may have rights to access, correct, export, or delete your data. Contact privacy@cloackit.com to exercise them.

Contact

Privacy questions: privacy@cloackit.com.