This Privacy Policy explains what information Fraud Warden ("we", "us") collects when you use fraudwarden.net and the Fraud Warden dashboard, and how we use it.
1. Who we are
Fraud Warden is operated as a registered seller with Paddle.com Market Ltd. For any privacy question, contact [email protected].
2. Information we collect directly from you
- Account information: the email address and password you sign up with. Your password is stored as a one-way cryptographic hash — we cannot read it.
- Google Ads connection: when you connect your Google Ads account, we store an encrypted OAuth refresh token that lets our relay apply IP exclusions on your behalf. We never see or store your Google password.
- Your own IP addresses: the IP addresses you add in the dashboard, and the address you download the client file from (added automatically), so that we never block your own visits. You can remove them at any time in the dashboard.
- Billing information: handled entirely by Paddle.com Market Ltd, our payment provider and Merchant of Record. We never receive or store your card details — see Section 5.
3. Information generated by using the service
- Block requests: each time our detection engine on your own server confirms a threat, it sends us the IP address (or IP range), the Google Ads campaign ID, and your domain name — nothing else — so we can apply the exclusion and enforce your plan's domain limit.
- Activity log: we keep a record of block attempts (success or failure) tied to your account, shown on your dashboard and used for support.
4. Information we do NOT collect
We do not collect your website's visitor logs, click history, device fingerprints, or any other traffic data our client file analyzes. That data is generated and stored entirely on your own server, under your own control, and is never transmitted to us.
5. Third parties we share data with
- Paddle.com Market Ltd — our payment processor and Merchant of Record. Paddle collects and processes your billing details directly; see Paddle's Privacy Policy.
- Google LLC — used only to authenticate your Google Ads connection (OAuth) and to apply IP exclusions via the Google Ads API (see Section 6).
- Brevo (Sendinblue SA) — our transactional email provider, used to send account and billing emails (e.g. password setup links).
We do not sell your personal data to anyone, for any reason.
6. Google user data (Google Ads connection)
This section describes exactly how Fraud Warden handles information we receive from Google when you connect your Google Ads account.
What we access. When you approve the connection, we ask for one permission: managing your Google Ads account (https://www.googleapis.com/auth/adwords). We also read the email address of the Google account you connected, so you can see which account is linked. Through the Google Ads API we read the list of Google Ads accounts and campaigns that your login can reach (account IDs, account names, and campaign IDs), and we create and remove IP exclusions on your campaigns.
How we use it. We use this data only to provide the single feature you asked for: applying IP exclusions to your own campaigns when your own server reports a confirmed invalid-click source, and removing the oldest exclusion we created when a campaign reaches Google's limit. We only act on the Google Ads accounts you select in the dashboard. For a manager (MCC) account, you also choose which individual accounts under it we may act on, and we only read campaigns from the accounts you select. We do not change budgets, bids, keywords, ads, billing, or user access, and we do not read or store your performance, spend, or audience data.
What we store. We store an encrypted refresh token, the email address of the connected Google account, the IDs and names of the Google Ads accounts reachable with that login (including the accounts under any manager account), and a cache of which selected account each campaign ID belongs to, which we need to route a block to the right campaign. We keep a log of the exclusions we applied for you.
What we never do. We do not sell Google user data. We do not use it for advertising, profiling, or marketing, and we do not use it to train machine-learning or AI models. We do not share it with third parties except as required to operate the service or by law. No person at Fraud Warden reads your Google Ads data, except where you ask us for support, where it is needed to investigate abuse or a security problem, or where the law requires it.
Limited Use. Fraud Warden's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting and deleting. You can revoke Fraud Warden's access at any time from your Google Account permissions page, or by clicking Disconnect next to the connected account in your Fraud Warden dashboard. Disconnecting revokes our access at Google and immediately deletes the stored refresh token, the connected account IDs, and the campaign-routing cache for that connection. To delete the rest of your data, use Delete account in your dashboard, or email [email protected]. IP exclusions already applied in your Google Ads account stay there until you remove them in Google Ads.
7. Data retention
We keep your account data for as long as your account is active. When you delete your account from the dashboard, your email, login, Google connection and access tokens, domains, protected accounts, activity log and payment references are deleted from our systems immediately. We keep one anonymised record (plan, billing period, subscription status, number of payments and the Paddle customer ID, with no email, name, IP address or domain) for accounting and fraud prevention. Encrypted database backups are overwritten within 7 days. Paddle.com Market Ltd, as Merchant of Record, retains payment and tax records under its own policy. You can delete your account at any time from the dashboard or by emailing [email protected] — see Section 9.
8. Security
Passwords are hashed, Google OAuth tokens are encrypted at rest, and all traffic to our dashboard and API runs over HTTPS. No online service can guarantee absolute security, but we take reasonable, industry-standard measures to protect your data.
9. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data. To exercise any of these rights, email [email protected]. We will respond within a reasonable timeframe.
10. Cookies
Our dashboard uses a single session cookie required to keep you logged in. We do not use tracking or advertising cookies on fraudwarden.net. Paddle's checkout may set its own cookies during payment — see Paddle's policy above.
11. Children's privacy
Fraud Warden is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.
12. Changes to this policy
We may update this policy from time to time. Material changes will be posted on this page with an updated date above.
13. Contact
Questions about this policy: [email protected]