Data Processing Agreement
Last updated: 1 October 2026
This agreement is part of our Terms of Service. It applies when Clicky Fyre LLC ("Clicky Fyre", the processor) processes personal data about visitors to a client's website through Cinderblock on behalf of that client (the controller). It is written to meet Article 28 of the UK GDPR and the EU GDPR, and the UAE Personal Data Protection Law.
1. What is processed
| Purpose | Detecting and preventing invalid and fraudulent ad clicks and fake leads; reports and alerts for the client. |
|---|---|
| People | Visitors to the client's website, mainly those arriving from paid ads. |
| Data | IP address and its approximate location and network; browser, device, language and time zone; pages visited; Google Ads click details; behaviour counts (time on page, mouse moves, scrolls, taps, key presses, never what was typed); hashed device code where allowed; form checks (timing, email domain, hashed email, phone pattern, never the typed content); Google Analytics visitor code only where the client links Google Analytics. |
| Special data | None. Cinderblock is not built to collect sensitive data. |
| How long | While the service is active; visit records 90 days by default, or shorter if the client chooses. |
2. Our commitments as processor
- We process the data only on the client's documented instructions (these terms, the Portal settings the client chooses and written requests), unless the law requires otherwise, in which case we tell the client first where allowed.
- Everyone at Clicky Fyre with access to the data is bound by confidentiality.
- We keep the data secure: encrypted connections, hashed passwords, 2-step login, access limited per client, login limits, activity log and protected backups.
- We help the client answer requests from visitors (access, correction, deletion) and with data protection impact assessments where needed.
- We tell the client without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting their data.
- At the end of the service we delete the client's data within 30 days, or return it first if the client asks, unless the law requires us to keep it.
- We give the client the information needed to show compliance and allow reasonable audits, with 30 days' notice, at the client's cost.
3. Sub-processors
The client agrees that we use these sub-processors. We will tell clients by email at least 14 days before adding or replacing one, and the client may object.
| Sub-processor | What for | Data |
|---|---|---|
| Verpex (web hosting) | Servers and database for the Portal | All data above |
| ip-api.com | IP location and network lookup | IP address only |
| Google (Google Ads, Google Analytics) | IP exclusions in the client's own Google Ads; marking fake visits in the client's own Google Analytics (only if linked) | IP addresses of fake visitors; Google Analytics visitor code and fraud score |
| Cloudflare (only if the client links it) | Blocking rules in the client's own Cloudflare account | IP addresses of blocked visitors |
| Our email provider | Reports and alerts to the client | Totals and alerts, no typed form data |
4. International transfers
Where UK or EU personal data is transferred to a country without an adequacy decision, the transfer is covered by the European Commission's standard contractual clauses (with the UK addendum for UK data), which are incorporated into this agreement by reference.
5. The client's commitments as controller
- The client has a lawful basis for the processing and tells website visitors about it in its own privacy notice.
- Where the law requires consent (for example for UK and EU visitors and device codes), the client's website asks for it, and the client turns on Cinderblock's consent option.
- The client's instructions to us follow data protection law.
6. Contact
Data protection questions: info@clickyfyre.com. Clicky Fyre LLC, 7901 4th St N #23581, St. Petersburg, FL 33702, United States.