Privacy Policy

Last updated 16 October 2026

MB „Skydis“ is the controller of personal data processed by TrafficPaywall. This policy explains what we collect and why.

Account holders (publishers and buyers)

• Email address, used to sign you in by magic link and to send service messages.
• Sites you connect, their settings, and earnings and payout records.
• For payouts: your Stripe connected-account ID or the USDC wallet address you provide.
• For card top-ups: payment is processed by Stripe; we receive the payment status and amount, not your card details.

Visitors to sites that use TrafficPaywall

• The WordPress plugin and Cloudflare Worker classify each request on the publisher's own server or edge. For ordinary visits nothing is sent to us.
• We receive aggregated daily counts (for example "42 requests from GPTBot were refused"), without IP addresses or other identifiers.
• When an automated client presents a TrafficPaywall credential, we receive the credential, the requested URL and the site key to charge the request.
• When a person completes the "I'm human" check, Cloudflare Turnstile processes their browser signals and IP address to verify them.

Feedback and optional failure reports

When you send feedback, we store your message, optional reply email and site address privately and email our support team. Website forms use Cloudflare Turnstile and short-lived hashed network identifiers to limit abuse. We remove common pasted credential formats, but please do not include passwords or payment details.

WordPress automatic failure reporting is off by default and requires administrator opt-in. Reports contain only sampled operation/error codes, HTTP statuses/counts and WordPress/PHP/plugin versions. They exclude visitor data, page URLs, credentials and raw exception text. You can disable reports in the plugin; support can also disable collection or notifications per site. We separately group unexpected service API failures without request bodies or exception text.

Feedback is kept for up to one year and failure aggregates for up to 90 days, with scheduled cleanup. Abuse-limit and replay identifiers expire after two days. Email copies follow the support mailbox retention policy. Contact us to request deletion.

Optional advertising measurement

With your consent, Meta receives signup and completed card or authenticated USDC credit purchase events, purchase value and currency, an event identifier, advertising cookie identifiers and browser/network information. This helps us measure advertising results. Our server can report verified payments and signups after you leave the site, using a hashed account identifier and your recorded advertising consent. Failed event deliveries retry for up to seven days and stop if you withdraw consent. We do not send your account email, connected site details, magic-link tokens or card information in these events. Use the Ad privacy control to decline or withdraw consent; the service works without advertising cookies. Global Privacy Control and Do Not Track signals disable this measurement.

Meta describes its processing in its Privacy Policy.

Legal bases

Performing our contract with account holders; our legitimate interest in operating, securing and improving the Service and in contacting businesses about it; and legal obligations (accounting and tax records).

Processors

Google Cloud / Firebase (hosting and database, EU and US regions), Stripe (payments and payouts), Amazon Web Services SES (email), Cloudflare (Turnstile), Microsoft Clarity (website usage analytics on trafficpaywall.com). Transfers outside the EEA rely on the European Commission's standard contractual clauses or adequacy decisions.

Retention

Account data for as long as your account exists; financial records for 10 years as required by Lithuanian law; per-request charge records for 45 days; aggregated statistics indefinitely.

Your rights

You can request access, correction, deletion, restriction, portability, or object to processing by emailing [email protected]. You may also complain to the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt). If we contacted you by email, every message includes a way to opt out.

Contact

MB „Skydis“, company code 303087006, Perkūnkiemio g. 53, LT-12144 Vilnius, Lithuania. Email [email protected] or [email protected].