Privacy Policy

Who we are

VisitMirror is operated at https://visitmirror.com. Product support and privacy requests: info@visitmirror.com.

Data we process

Depending on how you use VisitMirror, we may process:

• Account data: email, name, authentication identifiers, organization and site settings.
• Billing and plan status (via our payment provider when enabled).
• Website traffic signals sent by the VisitMirror tracker on customer sites: IP address, user agent, timestamps, referrer/UTM/click IDs when present, coarse geo/ISP metadata, device or fingerprint hashes, and derived risk scores/reasons.
• Integration tokens: OAuth access/refresh tokens for ad platforms you connect (for example Google Ads), plus the selected ads customer IDs.
• Operational logs needed to run, secure, and debug the service.

Why we process data

We use this data to:

• Provide the dashboard, alerts, block lists, and review queue.
• Score visits for bot / fraud risk and help customers protect paid traffic.
• Sync IP exclusions (or removals) to ad platforms the customer explicitly connects.
• Authenticate users, prevent abuse, meet legal obligations, and improve reliability.

Google OAuth and Google Ads API

If you connect Google, VisitMirror requests Google account identity (openid / email / profile) and the Google Ads scope needed to manage IP exclusions on accounts you select. We use that access only to list accessible Ads accounts and to create or remove IP exclusion criteria you trigger in VisitMirror. We do not sell Google data, read Gmail, or use Ads access for unrelated advertising. You can disconnect Google in the VisitMirror integrations panel; you should also revoke access in your Google Account permissions.

Legal bases (where applicable)

Where GDPR/KVKK-style rules apply, we rely on contract performance (providing the service you signed up for), legitimate interests (securing the product, fraud prevention for customers), consent where required for optional integrations, and legal obligation when we must retain or disclose information.

Sharing

We share data with processors that help us run the product (hosting, database, email/auth, payments) under agreements that limit use to providing their service. We share data with Google or other ad platforms only when you connect them and ask us to sync exclusions. We may disclose information if required by law or to protect rights, safety, and security.

Retention

Account data is kept while your organization is active and for a reasonable period afterward for backups, disputes, and legal requirements. Visit and block records follow product retention settings and operational limits. OAuth tokens are stored until you disconnect or they expire/are rotated.

Security

We use HTTPS, access controls, and industry-standard cloud infrastructure. No method of transmission or storage is 100% secure; please use a strong password and protect your login.

Your rights

Subject to local law, you may request access, correction, deletion, restriction, or export of personal data we hold about you, and object to certain processing. Customers control tracker installation on their own sites. Contact info@visitmirror.com; we may need to verify the request.

Children

VisitMirror is a business product and is not directed at children under 16.

International transfers

Infrastructure may process data in the EU, US, or other regions where our providers operate. Where required, we use appropriate safeguards for cross-border transfers.

Changes

We may update this policy. The “Last updated” date above will change when we do. Continued use after an update means you accept the revised policy, unless local law requires otherwise.