Privacy Policy

This statement explains how ClickPatrol B.V. ("ClickPatrol", "we") handles personal data. It covers clickpatrol.com, the ClickPatrol dashboard, and the click fraud protection service.

ClickPatrol B.V. is the controller for personal data about website visitors, account holders, billing and our own marketing. When a customer uses ClickPatrol to classify ad clicks, that customer is the controller and ClickPatrol is the processor. A data processing agreement is available on request at hello@clickpatrol.com.

Who we are

ClickPatrol B.V.
Goeman Borgesiuslaan 77
3515 ET Utrecht
The Netherlands

• Chamber of Commerce: 71448519
• VAT: NL858719423B01
• Email: hello@clickpatrol.com

We also use clckptrl.com. That domain belongs to ClickPatrol and is used for our own measurement.

Website visitors

When you visit clickpatrol.com we process technical data such as your IP address, browser and device details, the pages you view, the referring URL and cookie identifiers. We use this to run the site, keep it secure and see which pages are used.

If you submit a form, we also process what you send us, such as your name, email address, company, phone number and message.

The legal basis is our legitimate interest in running, securing and understanding the website. A newsletter is sent only if you subscribe. You can unsubscribe in the email.

Accounts and subscriptions

To open an account and provide the service we process your name, business email address, company details, the advertising accounts you connect, and billing details. If you give us a phone number, we store that too.

Card payments are processed by Mollie. We do not store your full card number on our own systems.

We process this data to perform the contract: create the account, provide click fraud protection, invoice you and give support. We keep account data for the life of the subscription and afterwards for as long as we need it for invoices, disputes and statutory retention. In the Netherlands, the tax retention period for records is generally seven years.

Click fraud protection

When you connect an advertising account, ClickPatrol analyses clicks to detect invalid traffic, bots and click fraud. For that analysis we process data such as IP addresses, browser and device information, and the technical and behavioural signals needed to classify a click. We do not use this data to follow people across the web for behavioural advertising.

On the advertiser's own site, the measurement tag can set these first-party cookies. Each one has a local storage copy under the same name, used only when the cookie is missing:

• cp_visitor_id, kept for 400 days, to recognise the same visitor across sessions
• cp_session_id, kept for 24 hours and refreshed during the visit, to recognise the same visit
• cp_class, kept for 24 hours, storing the last classification for that visit
• cp_audience, kept for 24 hours, storing the audience object from that classification. If the object is too large for a cookie, it stays in local storage only

Anything older than 24 hours, or tied to another session, is discarded. A visit that never receives a ClickPatrol event does not get cp_class or cp_audience. After a visit is classified, later pages in that session are not sent to ClickPatrol again with the page URL or IP address.

In this role we follow the customer's instructions. How long click data is kept is set in the customer agreement and the data processing agreement. A sample line customers can add to their own privacy policy is in the help docs.

Newsletters and service messages

Messages about your account, trial, invoice or support request are part of the contract. If you register for a session, we email you the joining link, a reminder and the recording. If you request a guide, we use your name and email address for that request. After those session emails, or after a guide request, we may send at most one further email about a similar session or guide. That follow-up relies on our legitimate interest in telling you about material close to what you requested. If you subscribe to a newsletter, we use your name and email address to send it, and only because you subscribed. Every marketing email contains an unsubscribe link. After you unsubscribe we keep a suppression record so that we do not email you again.

Cookies on this website

clickpatrol.com uses cookies and similar technologies. Our own measurement also runs on clckptrl.com.

• Essential cookies keep the site secure and store the choice recorded in the cookie banner.
• ClickPatrol measurement on clckptrl.com, so we can see how the site and the service are used.
• Google Tag Manager loads Google Analytics 4 and Google Ads, for site statistics and our own ads.
• Meta, for our own ads.
• Microsoft Clarity, to see how pages are used.
• Leadinfo, to recognise the company behind a visit from the IP address.
• OpenAI, to measure our ads on ChatGPT.
• LinkedIn, Reddit and Gartner Digital Markets, when a conversion event happens.

On a first visit, a banner appears at the bottom of the site if your browser's time zone is in the European Economic Area, the United Kingdom or Switzerland. The banner offers Accept all and Essential only. Only essential cookies are set until you accept. Essential only keeps only those essential cookies. Outside those regions the site starts with these cookies on, and it shows no banner. From the footer, Cookie settings opens the banner on any page, so you can switch them off.

Until you accept, Google Analytics 4 and Google Ads get measurement pings that use no cookies. Over that same period, Microsoft Clarity records how pages are used without cookies. Meta, LinkedIn, Reddit, OpenAI, Leadinfo and Gartner Digital Markets are not loaded. Ad click IDs and campaign parameters are not saved in your browser. They remain in the page, in the hidden fields of a form you send, and in our own visit records described below.

Whatever you choose, some of our own scripts still run. A fraud check scores each visit, so bots stay out of our forms and our ad data. Without consent, cp_visitor_id is kept for 24 hours instead of 400 days. cp_session_id and cp_class are kept for 24 hours. cp_audience is not stored. The fraud score is kept for 90 days in the cp_data cookie. A partner referral code, if you arrived through one, is kept in that same cookie for 90 days. Our attribution script counts visits per channel. It records the landing page, including any ad click ID, with cp_attr_visitor_id (365 days) and cp_attr_session_id (30 minutes). Once you have an account, it also uses cp_attr_known_user_id (365 days).

Withdraw consent in Cookie settings by choosing Essential only. We switch these signals off after that, and we delete the cookies that Google, Meta, LinkedIn, Reddit, Microsoft Clarity and Leadinfo set on clickpatrol.com. Your browser can block or delete cookies too. Parts of the site may then work less well.

Companies that set cookies through this site publish their own privacy statements. We do not control what they do with data once it is in their systems.

Ad measurement with form data

We share your contact details in hashed form with Google, Meta and Reddit, along with the ad click ID from your visit, when you send a demo, contact, guide or session sign-up form. The request is reported to LinkedIn and OpenAI too. In that way we see which ads bring in real requests. Sending the form counts as your consent to this, and that consent is the legal basis. Whatever you chose in the cookie banner, this applies. The banner decides on cookies and ad personalisation, not on this sharing.

We record, for each request, the time, the version of this text and where the consent came from. The record lets us show what you agreed to. Email hello@clickpatrol.com to withdraw consent for a request you already sent.

Who receives personal data

We use service providers that process personal data for us:

• Mollie, for card payments
• Google, for Tag Manager, Analytics 4 and Google Ads
• Meta, for our ads
• Microsoft, for Clarity
• Leadinfo, to identify the company behind a visit
• OpenAI, to measure our ads on ChatGPT
• LinkedIn, Reddit and Gartner Digital Markets, for conversion measurement
• Infrastructure providers that host the service
• A delivery provider that sends our email on our instructions

We do not sell personal data. We do not give personal data to other companies so they can market their own products to you.

Some of these providers process data outside the European Economic Area. Where that happens, we rely on an adequacy decision or on safeguards such as the provider's standard contractual clauses.

We also disclose personal data when the law requires it, for example to a competent authority.

Security

We use technical and organisational measures to reduce the risk of unauthorised access, loss and misuse. If you think you have found a vulnerability, report it through our responsible disclosure process.

Your rights

If the GDPR applies to you, you can ask us to:

• give you access to the personal data we process about you
• correct data that is wrong
• erase data, where the law requires it
• restrict processing
• receive data you provided, in a portable format, where the law requires it
• object to processing based on legitimate interest, including direct marketing
• withdraw consent, where we rely on consent

Email hello@clickpatrol.com. We may ask for information to confirm the request is about your data. Do not send a full copy of an identity document unless we ask for it. If we do, hide the photo and your citizen service number (BSN).

We reply within one month. If a request is complex, we may take up to two further months, and we will tell you if we do.

You can also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

California residents can read the CCPA/CPRA notice. People in South Africa can read the POPIA statement.

Changes to this statement

We may update this statement. The date below is the latest version. The terms of use govern the paid service.

Last updated: 31 October 2026