Privacy Policy.

01 Introduction

This Privacy Policy describes how PPCTrace Ltd ("PPCTrace", "we", "us", or "our") collects, uses, and shares information when you use our website (ppctrace.com), our affiliate fraud detection platform, and any related services (collectively, the "Services").

By using PPCTrace, you agree to the practices described in this policy. If you do not agree, please do not use the Services.

02 Information we collect

We collect information in three main ways:

Information you give us directly

• Account details Name, work email, company, role, and password when you sign up or book a demo.
• Billing information Payment details handled securely by our payment processor — we never store full card numbers.
• Affiliate program data Read-only access to your affiliate network APIs (e.g. AWIN, CJ, Impact) so we can detect fraud.
• Communications Anything you write to us via email, support chat, or contact forms.

Information collected automatically

• Device and browser metadata (IP address, OS, browser type, language)
• Usage logs (pages visited, features used, timestamps)
• Click and journey data on your website if you install our tracking pixel — used solely to detect click injection on your behalf

Information from third parties

We receive data from affiliate networks you authorise us to connect to, payment processors (limited to confirmation of payment), and analytics providers like Google Analytics for aggregated usage statistics.

03 How we use your information

We use the data we collect to:

• Provide the Services — detect affiliate fraud, generate reports, and automate complaint filings on your behalf
• Maintain and improve — debug issues, develop new features, and improve detection accuracy
• Communicate — send service updates, billing notices, and support responses
• Send marketing — only with your explicit opt-in; you can unsubscribe at any time
• Comply with law — meet our legal obligations and respond to lawful requests

We never sell your personal data, and we never use your affiliate program data for any purpose other than providing fraud detection for your account.

04 Sharing & disclosure

We share information only in these limited cases:

• Service providers — cloud hosting (AWS), payment processing (Stripe), email delivery (Postmark), analytics (Google Analytics) — all bound by data processing agreements
• Affiliate networks — we share complaint data and commission cancellation requests with the networks you authorise, on your behalf
• Legal compliance — when required by law, court order, or to protect our rights, users, or the public
• Business transfers — in connection with any merger, acquisition, or asset sale, with continued protection of your data

05 Cookies & tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Services are used. You can control cookies through your browser settings.

Our website uses three categories of cookies:

• Essential — required for the site to function (login sessions, security)
• Analytics — Google Analytics, Hotjar (anonymised usage)
• Marketing — only set with your consent via the cookie banner

06 Data retention

We keep your information only as long as we need to provide the Services and comply with legal obligations:

• Account data — retained while your account is active, deleted within 30 days of account closure
• Affiliate fraud detection logs — retained for 24 months for trend analysis and dispute resolution
• Billing records — retained for 7 years to comply with tax and accounting law
• Marketing preferences — retained until you unsubscribe

You can request immediate deletion at any time by contacting our privacy team.

07 Security

We take security seriously. Our infrastructure uses:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption at rest for all customer data
• SOC 2 Type II certified hosting providers
• Multi-factor authentication for all employee access
• Regular penetration testing and bug bounty programmes

While we work hard to protect your information, no system is 100% secure. If you believe your account has been compromised, contact us immediately at security@ppctrace.com.

08 Your rights

Depending on where you live, you may have the following rights:

• Access — request a copy of the data we hold about you
• Correction — fix anything that's wrong or incomplete
• Deletion — ask us to erase your data (subject to legal retention rules)
• Portability — receive your data in a machine-readable format
• Objection — object to certain processing, including marketing
• Restriction — limit how we use your data while a request is being reviewed

To exercise any of these rights, email privacy@ppctrace.com. We respond within 30 days.

09 International transfers

PPCTrace is headquartered in the US, but our infrastructure and team operate globally. Your data may be transferred to, stored, or processed in countries outside your own. When we do this, we use:

• EU Standard Contractual Clauses for transfers from the EU/EEA
• US International Data Transfer Agreements
• Equivalent legal safeguards for all other jurisdictions

10 Children's privacy

PPCTrace is a B2B service intended for use by businesses and adult professionals. We do not knowingly collect information from anyone under 16. If we discover such data has been collected, we delete it immediately.

11 Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices, technology, legal requirements, or business operations. Material changes will be communicated by email and through a prominent notice on our website at least 30 days before they take effect.

The version date at the top of this page indicates when it was last updated. By continuing to use the Services after a change takes effect, you agree to the updated policy.

12 Contact us

For questions about this Privacy Policy or our data practices, get in touch with our privacy team. We aim to respond to all enquiries within 48 hours.