What ClickReport stores, why, and who can touch it

ClickReport records each visit to your instrumented landing pages: timestamp, visitor identifier, IP address, user agent, referrer, and the campaign context carried by your ad URLs (campaign tag, GCLID). That is the evidence chain — it is what lets a suspicious pattern be tied to the campaign and keyword that paid for it.

Raw IP addresses are stored because Google Ads IP exclusions require exact addresses. Deployments that do not need exclusion workflows can run in hashed or dropped IP modes instead.

Tracking data is purged automatically after 395 days by default (a daily job; the floor is 30 days, and the window is configurable per deployment). Deleting your account erases its tracking records — visitor rows, click events, conversions, and rollups — through database-enforced cascades, not a best-effort script.

Evidence exports you generate expire and are removed from storage on a schedule. Visitor-erasure requests from the public privacy request form are reviewed by a human before action — an unauthenticated “erase this IP” endpoint would let an attacker destroy someone else's evidence, so we deliberately do not offer one.

Detection is explainable, not a black box: every flagged click carries reason codes (repeat visitor, IP spike, no engagement, tracking-parameter anomalies) and a risk score you can inspect. Recommendations in the review queue use consistent grading so operators can compare candidates before deciding whether to apply an exclusion.

• Multiple server-side signals determine which sources deserve review; a raw click counter alone is not an exclusion decision.
• Network, visitor, and engagement context is shown before the operator acts.
• Shared and safelisted IP context helps keep ambiguous sources out of exclusion decisions.
• ClickReport does not apply Google Ads exclusions automatically at launch; the operator approves each change.
• Every applied exclusion is recorded with its campaign scope and result and can be reversed from the same screen.
• The workflow explains why a source was surfaced without claiming certainty or guaranteed savings.

Google Ads enforces its own platform limits (up to 500 IP exclusions per campaign); the workflow surfaces those limits where you make the decision.

Google Ads is connected through OAuth with the Google Ads API scope only — ClickReport never sees your Google password. Refresh tokens are encrypted at rest with a dedicated key, and you can disconnect the integration at any time, which removes the stored token.

Support access to a customer account requires a signed, time-limited grant tied to a named support actor, and is logged. Sessions can be revoked account-wide on password change. Login history is recorded and visible to the account owner.

• Amazon Web Services — Application hosting, database, report storage, and transactional email (US regions).
• Stripe — Subscription billing and invoices. Card details never touch ClickReport servers.
• Google — Google Ads API access for cost import and IP exclusions you authorize.

A public status page and health endpoint report availability. Operational incidents are captured by an internal incident reporter, and the database runs on a managed service with automated backups. Landing-page uptime monitoring (five-minute cadence on monitored pages) alerts you when paid traffic is being sent to a broken page.

No tool stops all click fraud, and we do not claim to. Google detects and credits much invalid traffic on its own; ClickReport's job is the layer Google does not give you — first-party evidence on your landing pages, a documented decision workflow, and safe, reversible exclusions for the repeat offenders Google's filters miss. Cost figures are always labeled with their source: imported Google Ads cost where connected, clearly-marked estimates where not.

A formal data-processing addendum is being prepared; contact us for data-processing questions in the meantime.