Privacy policy.

Contents

• 1. Who is responsible
• 2. Our platform
• 3. Visiting traffic-bot.com
• 4. Your account
• 5. Cookies and local storage
• 6. Visitor statistics (only with consent)
• 7. Agency workspace and campaigns
• 8. Purchases and payments
• 9. Emails and support
• 10. Service providers and transfers outside the EU
• 11. How long we keep data
• 12. Your rights

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is EasyTrafficBot UG (haftungsbeschränkt), Arrenbergsche Höfe 6, Building 44, 42117 Wuppertal, Germany, represented by its managing director Martin Freiwald. Email: support@traffic-bot.com, phone +84 373 832 085. Further details are in the legal notice.

We have not appointed a data protection officer because the law does not require one for us. Please send any data protection question to the address above, ideally with the subject “DATA PROTECTION REQUEST”.

2. Our platform

Traffic Bot runs on a software platform that EasyTrafficBot UG operates itself and also uses for its other services. Your account, agency workspace, campaigns, balance, purchases and support requests are stored there. This is processing by us, the same company, not a transfer to another company. We use the data you give us for Traffic Bot to provide Traffic Bot. The servers and other service providers we use are listed in section 10.

3. Visiting traffic-bot.com

traffic-bot.com runs on Cloudflare. To deliver and protect the site, Cloudflare processes your IP address and technical request data such as the page requested, time, browser and referring page. To keep out automated abuse, Cloudflare can run a short check in your browser and stores the result in the cf_clearance cookie. Cloudflare Web Analytics counts visits and measures loading times without cookies: the page sends its address, the referring page, your browser type and timing data. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR) and, for storing the bot check in your browser, § 25(2) TDDDG. Fonts are served from our own domain.

Links to other sites, such as Trustpilot, open those sites. No data is sent to them until you click.

4. Your account

When you sign up we process your name, email address, phone number and password (stored only as a one-way hash), and the time and technical data of the sign-up. To confirm the sign-up we send a one-time code by email; if we send codes by phone, the code goes by SMS or WhatsApp through Twilio. We use the phone number for account security and to contact you about your account. When you sign in, we store sign-in times and the IP address used.

The legal basis is the performance of the contract and steps before it (Art. 6(1)(b) GDPR) and our legitimate interest in preventing misuse and fake accounts (Art. 6(1)(f) GDPR). You need to provide these details to use Traffic Bot.

Sign-in with Google

Google’s sign-in script is not loaded until you click “Continue with Google” (or “Sign up with Google”). That click loads it from accounts.google.com, so Google receives your IP address and browser information. If you then sign in with Google, Google sends us a token with your name, email address and Google account ID, which our platform checks to find or create your account (Art. 6(1)(b) GDPR). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. See Google’s privacy policy.

5. Cookies and local storage

traffic-bot.com sets the cookies below. Our own cookies keep the site working. Cloudflare sets one for bot protection, one that stores your choice in the cookie banner and, only if you accept, the cookies for visitor statistics with Google Analytics (section 6). You can change your choice at any time under “Cookie settings” at the bottom of every page.

The traffic-bot.com cookies, cf_clearance and the consent cookie are strictly necessary (§ 25(2) TDDDG). The dashboard also keeps a few things in your browser’s local storage: display choices, the last balance it showed (so changes can animate) and setup steps you skipped. The public pages remember whether your browser has already loaded the number font (tb-mono-font). These entries stay on your device.

A cookie named tb_analytics_result can briefly carry a successful sign-up, sign-in or sign-out result to the next page for the statistics in section 6. It contains no account details, is removed when read and expires after one minute.

6. Visitor statistics (only with consent)

Google Analytics 4

If you agree, we use Google Analytics 4 to see how many people visit traffic-bot.com, which pages they open and where they come from. It runs through Cloudflare Zaraz: your browser reports the visit to Cloudflare, and Cloudflare passes it on to Google from its servers. The report contains the page address and title, the referring page, the time of the visit, your browser and device type, and the random visitor ID from the cfz_google-analytics_v4 cookie.

Google’s advertising features (Google Signals) are switched on. Your browser therefore also contacts Google directly (stats.g.doubleclick.net and www.google.com), so Google receives your IP address and browser information. If you are signed in to a Google account and have allowed personalised ads, Google can link the visit to that account and use it for advertising audiences.

Google Analytics only runs after you agree in the cookie banner (“Accept All”, or tick “Analytics” and “Confirm My Choices”). The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time under “Cookie settings” at the bottom of every page; Google Analytics then no longer runs from the next page on. Withdrawing does not affect what was processed before. The provider is Google Ireland Limited; see Google’s privacy policy.

PostHog product analytics and session replay

When we use PostHog, the cookie banner names it, and it only starts if you accept Analytics there. PostHog then records page visits, selected navigation actions and completed sign-ups and sign-ins. We remove URL query strings and fragments and replace customer identifiers in dashboard paths. We do not send account names, email addresses or form contents.

Session replay reconstructs page layout, clicks, pointer movement and scrolling so we can find confusing or broken interactions. Text and form inputs are masked, and images, hidden fields and embedded content are blocked. We do not record sign-in, sign-up, password recovery, checkout, account settings, team, support or billing pages. Network requests and console logs are not recorded.

Your choice is stored as tb-posthog-consent-v1 in a cookie (one year) and in local storage. If you accept, PostHog stores a random browser identifier in local storage (ph_…_posthog) and session information in session storage; they are cleared when you withdraw consent. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The provider is PostHog, Inc.; see PostHog’s privacy policy.

7. Agency workspace and campaigns

When you use the agency workspace, we store what you enter there with your account:

• workspace and report names, and the agency logo you upload;
• client names and website addresses, keywords, target pages, countries and campaign settings;
• team members’ names, email addresses and roles, and the invitations you send;
• the reports you create and your support tickets.

We use this data to provide the workspace, run your campaigns and create the reports you asked for (Art. 6(1)(b) GDPR). Only members of your agency workspace can see it, according to their role. When you invite a team member, we email them the invitation on your behalf; please tell them about this policy.

To run a campaign, our delivery servers search Google for your keyword and open the target page through a proxy network. They use the keyword, target page and country, not data about you. The target website receives a visit from the proxy network’s address. We keep delivery records (time, campaign, result) to settle your balance and show reports.

8. Purchases and payments

You pay on the payment page of Stripe. Stripe collects your payment details directly; we never see your full card number. We receive and store the Stripe customer and subscription IDs, the plan, amounts, payment status, the card brand and last four digits where Stripe provides them, and invoice data. The agency owner can manage the subscription in Stripe’s billing portal. Stripe also processes data as an independent controller, for example to prevent fraud and meet financial regulations; see Stripe’s privacy policy.

With each purchase we store which terms you accepted and, if you confirmed it, your request for an immediate start (the exact wording and the time), so we can show both later.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR), our legal obligations under commercial and tax law (Art. 6(1)(c) GDPR) and our legitimate interest in being able to prove the contract (Art. 6(1)(f) GDPR).

9. Emails and support

We send emails needed for your account and plan, such as confirmation codes, password resets, invitations and notices about your plan (Art. 6(1)(b) GDPR). They are sent from traffic-bot.com through Resend. We do not send newsletters without your consent.

If you contact us by email, through support in the workspace or on WhatsApp, we process your contact details, your messages and attachments to answer you (Art. 6(1)(b) or (f) GDPR). If you write to us on WhatsApp, WhatsApp (Meta) also processes your phone number and the messages under its own terms.

Our platform reports technical errors to Sentry. An error report contains the technical context of the error, such as the request address, time and browser, and can contain the account ID (Art. 6(1)(f) GDPR: a working, secure service).

10. Service providers and transfers outside the EU

We use the service providers below. Where they process personal data for us, they do so under a data processing agreement (Art. 28 GDPR) and only on our instructions.

Some providers process data in the USA or other countries outside the EU. Transfers to the USA are covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the EU Standard Contractual Clauses (SCCs, Commission Decision (EU) 2021/914). Transfers to Japan are covered by the Commission’s adequacy decision. You can ask us for a copy of the safeguards.

We also pass on data where the law requires it, for example to tax authorities, or where it is needed to enforce our rights.

11. How long we keep data

12. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or its processing restricted (Art. 18), to receive it in a common machine-readable format (Art. 20), and to withdraw any consent at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where we process data based on our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation.

To use these rights, email support@traffic-bot.com. We answer within one month. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

You can also complain to a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

We update this policy when our services or the law change. The date at the top shows the current version.