Privacy — What ClickSheriff Stores and Where

Scope of this document. It describes how the software behaves, accurately and in detail, so that you can write or complete your own privacy notice. It is a factual product description, not legal advice, and it has not been reviewed by a lawyer. If you process personal data of people in the EU, the UK or another regulated market, have your own counsel review your notice before you rely on it.

Part 1 — The plugin, on your website

Who controls this data

The plugin runs entirely inside your own WordPress installation and writes to your own database. No visitor data is transmitted to ClickSheriff or to SeoPort at any point, and we have no ability to read it. For the data described below, you are the controller. We are not a processor of it, because it never reaches us.

What it records, and only for visits that arrive from an ad

The plugin records nothing for ordinary organic or direct visits. A record is created only when a visit arrives carrying a Google Ads click identifier (or a utm_medium=cpc tag). For those visits it stores:

Network identifiers — the IP address, a derived subnet (/24 or /64), and the network operator and autonomous-system number that address belongs to.
The ad click identifier — the Google click ID (gclid, gbraid or wbraid), the campaign and keyword parameters present in the URL, and the landing URL.
Browser information — the user-agent string, and a short non-reversible hash derived from screen size, timezone, language and similar properties. This hash is not unique to a person; identical devices in the same locale produce the same value.
On-page behaviour — seconds on the page, scroll depth, counts of clicks and pointer or touch movement, and a small set of flags the browser reports about itself (for example whether it declares that it is driven by automation software).
Outcome — whether the visit resulted in a WooCommerce order or a form submission, if those integrations are active.
The assessment — a score, the signals that fired, and the resulting state.

It does not record page content, form field values, names, email addresses, passwords, payment details, or anything typed into the page.

Cookies it sets

Two first-party cookies, both lasting 24 hours, both set only in a session that arrived from an ad:

cfs_sid — a random identifier that lets the server-side record and the browser-side measurement refer to the same visit.
cfs_ad — a flag marking the session as having come from an ad.

Neither is used for advertising, profiling across sites, or any purpose other than the measurement described above. Whether they require consent in your jurisdiction is a question for you and your counsel; we do not make that determination for you.

How long it is kept

Records are deleted automatically after the retention window you configure in Settings, which defaults to 90 days. Setting it to 0 keeps records indefinitely — a choice you should make deliberately. Deleting the plugin removes its database tables and settings entirely.

Where it goes

Nowhere, by default. The plugin makes no outbound network requests: the datasets it uses to recognise hosting networks, crawlers and privacy relays are bundled with it and read from disk. There are exactly two optional exceptions, both of which you switch on yourself:

Telegram alerts (Pro). If you enable them, a message is sent to Telegram's API containing the address and the reasons behind a strong finding.
Google Ads reconciliation (Pro). If you install the supplied script in your own Google Ads account, that script sends your billed-click identifiers and campaign spend from your ad account to your own website. It travels between two systems you control; no third party is involved.

Rights requests

Because the data lives in your database, you can serve access and erasure requests directly. A record can be located by IP address and deleted from the plugin's table; deleting the whole table is a single action from the WordPress plugin screen. We cannot action such a request on your behalf, as we hold none of the data.

Part 2 — This website, clicksheriff.com

This site is a set of static pages. It sets no cookies, runs no analytics, embeds no tracking pixels, no advertising tags, no chat widget and no third-party fonts — the fonts are served from this domain.

As with any website, the hosting server and the content-delivery network in front of it keep standard access logs, which include IP addresses, requested URLs, timestamps and user-agent strings, for security and troubleshooting. The site is hosted in Europe and fronted by Cloudflare.

Downloading the plugin requires no account and no form. If you email us, we hold that email in a normal mailbox for as long as needed to answer you and keep a record of the exchange.

Contact

For anything on this page, including a data request relating to this website: [email protected]. ClickSheriff is a product of SeoPort, Ukraine.

Describes ClickSheriff 4.2.0.