Privacy Policy

Last updated: 1 October 2026

This Privacy Policy explains how Clicky Fyre LLC ("Clicky Fyre", "we", "us") collects, uses, stores and shares personal data when you visit clickyfyre.com, when you work with us as a client, and when you use our click-fraud protection tool Cinderblock (the "Portal", at iptracking.clickyfyre.com), including data we receive from Google APIs.

1. Who we are

Clicky Fyre LLC, 7901 4th St N #23581, St. Petersburg, FL 33702, United States.
Contact for privacy questions: info@clickyfyre.com.

For our own website and our client relationships we are the controller. When Cinderblock checks visitors to our clients' websites, our client is the controller of that visitor data and we act as their processor, following their instructions.

2. What we collect

2.1 Visitors to clickyfyre.com

What you send us through a contact form, email or WhatsApp (for example your name, email, phone number and message).
Basic technical data kept by our hosting provider in its server logs (IP address, browser, pages requested, time).
If our website uses analytics or advertising cookies (for example Google Analytics or the Google Ads tag), we ask for your consent first where the law requires it, and you can change your choice at any time through the cookie banner or your browser settings.

2.2 Our clients and their team (Portal users)

Name, work email address, company name, login details (passwords are stored only as secure hashes), optional 2-step login settings, and a log of actions taken in the Portal (for example who blocked an IP and when).
Devices a user chooses to receive Portal notifications on (a push address and encryption keys provided by the browser).

2.3 Visitors to our clients' websites (fraud prevention)

When a client adds the Cinderblock script or WordPress plugin to their website, we receive, for each visit:

IP address, and the approximate country, city, network and whether it is a data centre, VPN or proxy (looked up from the IP address).
Browser and device type, screen size, language, time zone, the page address and the referring page.
Google Ads click details in the page address (for example the Google click ID "gclid", campaign, ad group, keyword, network and placement).
Behaviour signals such as time on page and counts of mouse movements, scrolls, taps and key presses (not what was typed).
Where allowed, a device fingerprint that is stored only as a one-way hash (for UK and EU visitors only after consent).
When a form is sent: only checks about how it was filled (time taken, whether a hidden trap field was filled, the email's domain, a hashed form of the email address, and the phone number's country code, length and pattern). We do not collect or store what the visitor typed into the form.
Taps on phone or WhatsApp links (only that a tap happened).
Only on websites where the client switches on "marking fake visits in Google Analytics": the Google Analytics visitor code and session number that the website's own Google Analytics has already set in the browser, and whether the visitor accepted advertising cookies (Google Consent Mode). The script only reads these; it does not set them.

The script sets no cookies. If the client turns on the optional "clean conversions" feature, the script keeps one value ("suspect" or not) in the browser's session storage for that browser tab only.

3. Data we receive from Google APIs

With the permission of the Google Ads account owner (given through Google sign-in, or by linking their account to our manager account), Cinderblock accesses Google Ads data through the Google Ads API and Google Ads Scripts:

Sign-in: when a client connects their own Google Ads, Google gives us the name and email address of the Google account they signed in with (so we know which account it is) and an access token. The token is stored encrypted, is never shown to anyone, and ends when the client clicks "Disconnect" in Cinderblock or removes Cinderblock in their Google account (Security, Third-party connections).
Read: the list of Google Ads accounts the sign-in can reach (account number, name, currency, time zone); account, campaign and ad group names and IDs; the websites the ads lead to; performance numbers (impressions, clicks, cost, conversions, invalid clicks); keywords and search terms; placements; and the account's existing IP exclusions. An account is read every day only after the client asked for its protection and our staff approved it.
Write: only adding IP address exclusions (and, if the advertiser chooses, an excluded placement list) to the accounts we manage, following the protection rules our staff set for each account; and, only when our staff tick it for an account that has none, setting the account's Final URL suffix to Google's own click-detail parameters. We also send and withdraw invitations to link an account to our manager account, which the account's owner accepts or refuses. We never create or change ads, bids or budgets, and never remove what the advertiser added.

We use this data only to protect that advertiser's account from invalid clicks and to show that advertiser (and the agency staff working on their account) their own reports. We do not sell it, do not use it for advertising, do not use it to train general AI or machine learning models, and do not let people read it except the advertiser, our staff working on their account, where needed for security or to comply with the law.

If a client links their Google Analytics 4 property, Cinderblock reads (read only) that property's own totals for visits from Google Ads: sessions, engaged sessions and key events, per day and campaign. If the client also switches on "marking fake visits", Cinderblock sends that property an event named "cinderblock_suspicious" for a visit that looks fake, with only Google Analytics' own visitor code, session number and a fraud score. It never sends a name, email, phone number or IP address, never sends Google's own visits, and sends visits from the UK, EU, EEA and Switzerland only when the visitor gave advertising consent.

Clicky Fyre's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Cinderblock's access at any time in your Google Account (myaccount.google.com/permissions) or by asking us.

4. Why we use the data (and our legal basis)

To detect and stop invalid and fraudulent ad clicks (scoring visits, blocking abusive IP addresses on the client's website and in their Google Ads account, and preparing refund claims to Google). Legal basis: our client's and our legitimate interest in preventing fraud (UK/EU GDPR Art. 6(1)(f)); where required, consent collected by the client's website.
To give clients reports and alerts (dashboards, weekly emails, notifications, lead quality, conversion files for their own Google Ads account). Legal basis: performing our contract with the client, and legitimate interest.
To run our business and answer enquiries. Legal basis: contract and legitimate interest.
To keep the service secure (login protection, error logs, backups). Legal basis: legitimate interest and legal obligations.

Conversion data we help clients send to Google contains no personal data other than Google's own click ID, and conversions from the UK, EU, EEA and Switzerland are only included where the visitor gave ad consent.

5. Who we share data with

We do not sell personal data. We share it only with service providers that help us run Cinderblock, under contract:

Web hosting: Verpex (servers where the Portal and its database run).
IP location lookup: ip-api.com (receives IP addresses to return country, city and network).
Google (Google Ads; Google Analytics, only where a client links it; and push notifications through the browser maker's push service, for example Google, Mozilla, Apple or Microsoft; notification content is encrypted).
Optional, only if the client or we switch them on: Cloudflare (IP blocking rules), Telegram (admin alerts), our email provider, and a client's own CRM (fake-lead notices, which contain no typed form data).
Authorities, when the law requires it.

We are based in the United States and serve clients mainly in the UAE and the UK, so data may be handled outside your country. Where UK or EU data is transferred abroad we rely on adequacy decisions or standard contractual clauses.

6. How long we keep data

Visit, click and form-check records: 90 days by default (a client can choose a shorter period, for example 30 days).
IP location results: 7 days.
Daily totals without IP addresses (for monthly history): while the client relationship lasts.
Portal activity log: up to 12 months. Backups: 14 days.
Client account data: for the length of the contract and up to 6 years after, where the law requires it for accounting.

7. Security

We use encrypted connections (HTTPS), hashed passwords, optional 2-step login, access limited so each client sees only their own data, login attempt limits, and backups stored outside the public web folder.

8. Your rights

Depending on where you live (for example under the UK GDPR, the EU GDPR, the UAE Personal Data Protection Law or a US state privacy law), you can ask to access, correct or delete your personal data, object to or restrict its use, and ask for a copy. If you visited one of our clients' websites, you can contact that business, or us, and we will help them answer. Write to info@clickyfyre.com. In the UK you can also complain to the Information Commissioner's Office (ico.org.uk).

9. Children

Our services are for businesses and are not directed at children under 16.

10. Changes

We may update this policy. The date at the top shows the latest version. Important changes will be announced on this page or by email to our clients.

11. Terms

The use of our services is also governed by our Terms of Service and, for client data, our Data Processing Agreement.

12. Contact

Clicky Fyre LLC, 7901 4th St N #23581, St. Petersburg, FL 33702, United States. Email: info@clickyfyre.com. Phone: +1 321 868 9162 · WhatsApp: +44 7474 701817.