Privacy policy
In short. ClickedAds protects advertisers from fake ad clicks and fake leads. To do that we look at visits that arrive from a paid ad on our customers' websites: the IP address, browser details, the ad click ID and how the visit behaved.
We never read what people type into forms. We don't follow anyone across other websites. We don't sell personal information. Visitor data is deleted after 6 months.
1. Who we are
ClickedAds ("we", "us") runs clickedads.com. We act in two roles:
- For our customers (the businesses and agencies who sign up), we decide how their account information is used.
- For visitors to our customers' websites, we process information on our customer's behalf and on their instructions. The website owner is responsible for that information, and their own privacy notice applies to it.
2. Information about our customers
- Account: your email address and a securely hashed password (scrypt). We never store your password itself.
- Billing: your plan, subscription status and usage. Payments are handled by Stripe; we never see or store card numbers.
- Connected ad accounts: if you connect them, an access token for Google Ads, and the Pixel ID, Events Manager token and ad account details for Meta and TikTok. All tokens are stored encrypted.
- Settings and content you give us: your websites, block and allow lists, agency branding (name, logo address, colour), client names and the email addresses you ask us to send client reports to.
- Referrals: which account referred yours, and the credit earned.
- Messages: anything you send to our support address.
3. Information about visitors to our customers' websites
Our script only does anything when a visitor arrives from a paid ad: the address contains an ad click ID (such as gclid, fbclid or ttclid) or marks the visit as paid. Other visitors are ignored. For ad visitors we collect:
| What | Details |
|---|---|
| Network | IP address. We check it against public lists of data centres and of AI companies' servers. |
| Ad click | The ad platform's click ID, and the campaign, keyword, ad set, placement and network passed in the address. |
| Page | The landing page address and the referring page. |
| Browser and device | User agent, screen size, time zone, languages, number of processor cores, touch support, a few signs of automated browsing (for example whether the browser reports it is controlled by software), and a device fingerprint. The fingerprint is a one-way hash of these browser characteristics; it doesn't identify a person on its own. |
| Behaviour on the page | How long the visit lasted, and how many mouse movements, clicks, key presses, scrolls and touches happened, including whether any were generated by a script. We count these events; we don't record what was typed or where the mouse went. |
| Ad platform cookies | If the website already runs Meta's or TikTok's pixel, the values of their own cookies (_fbp, _fbc, _ttp). We don't set these. |
| AI agents | Whether the visit was made by an AI agent (for example ChatGPT or Perplexity), identified from its user agent, published IP ranges or a cryptographic signature on the request. |
| Form submissions | Only if the website owner turns on fake-lead protection or Verified Conversions: the form's name or address, how long it took to submit, how many keys were pressed and fields filled, and whether a hidden trap field was filled. Never the contents of any field. |
| Conversions | If the website owner sends them to us: the conversion's name, value, currency, order reference and time. |
We don't collect names, email addresses or anything typed into forms from visitors. We don't track visitors across websites, and we don't build profiles of people.
4. How we use information
- To score each paid click for signs of fraud, and to show our customers what happened and why.
- Where our customer has turned it on, to exclude fraudulent IP addresses and bad placements from their ad campaigns.
- To check form submissions for bots and junk leads.
- To tell ad platforms which conversions came from real people (Verified Conversions), so their bidding learns from real customers.
- To protect all our customers together (the ClickedAds Network): if an IP address sent fraudulent clicks to several of our customers in the last 30 days, or a placement sent mostly fraud to several of them, we count that against it when scoring clicks for every customer. Customers only ever see counts (for example "flagged by 3 other advertisers"), never another customer's clicks, visitors or identity. In the same way, we compare how often AI agents' ad clicks convert relative to people's across customers (only once 3 or more customers have data), and show that ratio.
- To produce reports, audits and evidence our customers can use to request refunds for invalid clicks.
- To run our service: accounts, billing, usage limits, support, security, and emails you've asked for or need (password resets, usage warnings, weekly summaries, client reports).
We process visitor information for our customers' legitimate interest in preventing advertising fraud and measuring their advertising accurately, and customer information to provide the service you signed up for.
5. Who we share it with
We don't sell personal information. We share it only as needed to run the service:
| Recipient | What and why |
|---|---|
| Google Ads | On our customer's instruction: IP addresses to exclude, placements to exclude, and verified conversions (Google click ID, time, value and currency, plus consent status if the customer confirms it). We don't send Google visitors' IP addresses or browser details as part of conversions. |
| Meta (Facebook, Instagram) | On our customer's instruction: verified conversions with the Meta click ID or cookie, the page address and value. IP address and browser details are included only if our customer confirms their website collects consent for advertising. |
| TikTok | The same as Meta, using TikTok's click ID and cookie. |
| Network score API customers (ad networks, publishers, ad-tech and AI agent platforms) | For fraud prevention only, when they ask about an IP address or ad placement they already have: a risk score, whether fraud from it was seen by two or more of our customers in the last 30 days (as a range, e.g. "2-4"), and the date last seen. Never which customers, never browser or visit details, and nothing based on a single customer's data. Their terms forbid using it to profile people or reselling it. |
| Stripe | Customer billing: email address, plan and payments. |
| Resend | Sending email: account emails to our customers, and client reports to the addresses our customers give us. |
| Fly.io | Hosting for our servers and database. |
| Zoho | Our support email inbox. |
We also download public lists (data-centre IP ranges, and AI companies' published IP ranges and signing keys) to recognise bots and AI agents. No personal information is sent to get them. For Microsoft Advertising we only prepare a list that our customer copies in themselves.
Results you publish: if you choose to publish a split-test result, it becomes a public page with the figures and the name and industry you chose (or none). It contains no visitor data. You can withdraw it at any time; the page then says it was withdrawn.
The ClickedAds Network shares nothing outside ClickedAds; it's a calculation inside our own database, and its public figures (sites protected, IPs and placements flagged) are totals only.
We may disclose information if the law requires it, or to a buyer if ClickedAds is sold, under the same protections described here.
6. Google user data
ClickedAds' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
When you connect Google Ads, we access only what the features you use need:
- Read: the ad accounts you can access, campaigns, spend and invalid-click statistics, conversion actions, and existing IP and placement exclusions.
- Change, only for features you turn on: add and remove IP and placement exclusions, add tracking parameters to your account's URL suffix, create a conversion action for verified conversions, send verified conversions and retract bad ones, and, if you start a split test, temporarily change which conversions selected campaigns bid on, restored when the test ends.
We never change bids, budgets, ads or targeting. We don't use Google user data for advertising, sell it, or use it to train AI models. You can disconnect Google Ads at any time from your Account page, and remove ClickedAds' access in your Google account's security settings.
7. Meta and TikTok
If you connect Meta or TikTok, we use the tokens you give us only to send verified conversions for your website and to read your ad sets and spend for reporting. We don't read your audiences, messages or customer lists. You can remove a connection at any time by deleting the token in ClickedAds, or revoking it in Meta Business Settings or TikTok Events Manager.
8. Cookies and browser storage
- Our dashboard uses one cookie,
ca_session, to keep you logged in (30 days), and stores your light/dark theme choice in your browser. - Our script on customers' websites sets no cookies. It uses the browser's session storage, which is cleared when the tab closes, to recognise a page refresh and to connect later pages of the same ad visit. It reads Meta's and TikTok's own cookies if they're already there (see section 3).
9. How long we keep it
- Visitor information (clicks, form-submission checks and conversions) is deleted automatically after 6 months.
- Blocked IP addresses stay on a customer's block list while it's active, and are deleted 6 months after being unblocked.
- Account information is kept while your account is open and deleted when you delete your account. That includes all your websites and their visitor data.
- Billing records are kept by Stripe for as long as tax and accounting law requires.
- Backups: the database is continuously backed up to encrypted storage in the same cloud provider; backups roll off after 7 days (daily disk snapshots after 5). Occasional backups taken before maintenance are deleted within 30 days.
10. Security
All traffic is encrypted (HTTPS with HSTS). Passwords are hashed with scrypt. Access tokens for Google, Meta and TikTok are encrypted with AES-256-GCM. Other safeguards include rate limiting, protection against cross-site request forgery, and keeping each customer's data separate from every other customer's. No system is perfectly secure; if a breach affects your information, we'll tell you as the law requires.
11. Where it's stored
Our servers and database are in Sydney, Australia. Some service providers in section 5, such as Stripe and Resend, process information in other countries, including the United States, under their own data-protection commitments.
12. Your rights and deleting data
Depending on where you live, including under Australia's Privacy Act and the GDPR, you may have the right to access, correct, delete or export your personal information, and to object to or restrict how it's used. You can also complain to your data protection regulator.
- Customers can delete their account, and all associated data, from the Account page, or email us.
- Website visitors: because we process your information for the website you visited, please contact that website first. If you can't, email us with the website, the approximate date and time, and your IP address, and we'll help.
- Data deletion for Meta and TikTok connections: removing your Pixel and token in ClickedAds stops all further sending immediately. To delete everything we hold, delete your ClickedAds account or email us and we'll do it within 30 days.
- Marketing emails: every weekly summary has a one-click unsubscribe link.
13. Our customers' responsibilities
Customers who install ClickedAds on their websites are responsible for telling their visitors about it in their own privacy notice, and for getting consent where the law requires it (for example in the EEA and UK). They should only confirm in ClickedAds that their site collects advertising consent if it does.
14. Children
ClickedAds is a service for businesses and isn't directed at children. We don't knowingly collect information from anyone under 16.
15. Changes
If we make significant changes we'll update this page, change the date at the top, and tell customers by email before the change takes effect.
16. Contact
Questions or requests: hello@clickedads.com.