Privacy Policy

Effective 21 September 2026.

The short version

BlockClickFraud looks at clicks arriving on our customers' websites and works out which ones came from bots, click farms, or people repeatedly clicking the same paid ad. When we find one, we can add that IP address to the exclusion list in the customer's advertising account so the ad stops being shown to it.

That means we handle two different kinds of data, and it matters which is which:

• Technical information about visits to our customers' websites, including IP addresses.
• Account information belonging to our customers, including access to their Google Ads account when they choose to connect it.

We do not sell either one. We do not use either one to build advertising profiles, serve ads, or train machine learning models for anyone else. We do not share Google account data with third parties except as described below.

Who we are

BlockClickFraud is operated by The Streamer Agency, LLC ("BlockClickFraud", "we", "us"). Our website is https://blockclickfraud.com. You can reach us at [email protected], or by post at 4627 Windward Cove Lane, Wellington, FL 33449.

For the technical data described in the next section, our customer is the data controller and we act as their processor. We are the controller of our own customers' account data.

Information collected from visits to customer websites

When a BlockClickFraud customer installs our plugin or edge worker on their website, we record the following for each visit:

• IP address and the country it resolves to
• Browser user agent string
• The URL requested, the referring URL, and the HTTP status returned
• Advertising click identifiers present in the URL, such as a Google Ads gclid
• Timestamp
• Whether JavaScript executed in the browser, and a small set of technical browser characteristics used to tell an automated client from a person

We do not collect names, email addresses, postal addresses, phone numbers, payment details, form contents, or the text of anything typed on the page. We do not place advertising or tracking cookies on customer websites, and we do not follow visitors across other websites.

An IP address is personal data in many jurisdictions, and we treat it as such. We use it for one purpose: deciding whether a click was genuine, and building the exclusion list that follows from that decision.

If you are a visitor to a website running BlockClickFraud and you want your data removed, contact the operator of that website. They control it. We will act on their instruction promptly, and you may also contact us directly at [email protected] and we will put you in touch or act where we are permitted to.

Information collected from customers

When you open an account we collect your name, email address, password (stored hashed, never in readable form), the domains you register, your subscription tier, and records of your use of the service. If and when paid plans are offered, payment is handled by a third-party payment processor and we do not store full card numbers on our systems.

Google account data and the Google Ads API

Connecting a Google Ads account is optional. The service works without it, though the exclusions then have to be applied by hand.

If you choose to connect one, you are taken to Google's own consent screen and you grant access there. We never see, ask for, or store your Google password.

What we request. A single scope, https://www.googleapis.com/auth/adwords, which permits access to the Google Ads accounts you authorize.

What we read. The list of advertising accounts your login can reach, so you can choose which one applies. Within the account you choose: campaign names, IDs and types, and the IP exclusions already present on those campaigns, so we do not add an address twice.

What we write. Campaign-level IP exclusions, and nothing else. We do not create, pause, or edit campaigns, ads, keywords, budgets, bids, or billing settings. We do not create accounts or manage account users.

What we store. An OAuth refresh token, the customer ID of the account you selected, the login customer ID where a manager account is involved, and a record of which IP addresses we have already added to which campaign. The refresh token is stored on our server and is used only to carry out the actions described above.

Limited Use. BlockClickFraud's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to provide and improve the click fraud protection features you signed up for. We do not transfer it to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with notice to you. We do not use it for serving advertisements. We do not allow humans to read it, except with your explicit consent for specific messages, where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymized.

Revoking access. You can disconnect at any time from inside your BlockClickFraud dashboard, or from your Google Account permissions page. When you disconnect, we delete the stored refresh token. IP exclusions already written to your Google Ads account remain there, because they are yours, and you can remove them inside Google Ads.

How we use information

• To score clicks and identify invalid or fraudulent traffic
• To build and maintain the blocklist and exclusion list for each customer
• To apply exclusions in connected advertising accounts
• To show customers their own reporting
• To operate, secure, and support the service, and to meet legal obligations

Each customer's data is scoped to that customer. One customer cannot see another customer's clicks, IP addresses, blocklists, or advertising accounts.

What we do not do

• We do not sell personal information, and we have not in the preceding twelve months
• We do not share it for cross-context behavioural advertising
• We do not use Google user data to serve advertisements
• We do not combine one customer's data with another's
• We do not read the contents of your advertising campaigns beyond what is listed above

Who we share data with

We use a small number of service providers to run the service, and they may process data on our behalf under contract: our hosting provider, our email provider, and, if paid plans are active, our payment processor. We also send IP exclusions to Google Ads on your instruction, which is the point of the product.

We will disclose information where we are legally required to, and to protect our rights, our users, or the public where the law permits it.

How long we keep it

• Click event records: retained while they are useful for detection and reporting, and deleted or aggregated after 12 months
• Blocklist entries: until they expire or you remove them
• OAuth refresh tokens: until you disconnect or the account is closed
• Account records: for the life of the account, plus any period required for tax, accounting, or legal purposes

When you close your account we delete your click data and tokens. Backups roll off on their own schedule.

Security

Traffic to and from the service runs over TLS. Access to production systems is limited to people who need it. Credentials and tokens are stored outside the web root and are not exposed to client-side code. No system is perfect, and we do not claim ours is.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to object to or restrict processing, and to withdraw consent. California residents have rights of access, deletion, correction, and to opt out of sale or sharing, and we will not discriminate against you for exercising them. Since we do not sell or share personal information, there is nothing to opt out of, but you are welcome to confirm that with us.

Write to [email protected] and we will respond within the period the applicable law allows. For data collected on a customer's website, we will refer you to that customer or act on their instruction, because they control it.

Cookies on this website

This website sets cookies needed to keep you logged in to your account and to keep forms secure. We do not run advertising or cross-site tracking cookies here.

Children

This is a business product. It is not directed at children, and we do not knowingly collect personal information from anyone under 16.

International transfers

Our servers are located in Canada. If you are outside that country, your information will be transferred there and handled under this policy.

Changes

We will post any change on this page and update the effective date. If a change materially affects how we handle your data, we will tell account holders by email before it takes effect.

Contact

The Streamer Agency, LLC, 4627 Windward Cove Lane, Wellington, FL 33449. Email [email protected].