If you are a VerifySky customer
We decide how your account data is handled, so we are the data controller for your name, email address, workspace, and billing records.
Privacy Policy
Privacy Policy
This policy explains exactly what VerifySky processes, why each item is needed, how long we keep it, and who else touches it. We have written it in plain language rather than boilerplate.
Last updated
Two different relationships
VerifySky handles two kinds of data, and our responsibility differs between them. Please read the one that applies to you.
If you visited a site we protect
We process your request on that site owner's behalf and under their instructions, so we act as a data processor and they are the controller. Requests about that data are best directed to the site you visited, though we will always help.
What we process for visitors to protected sites
To tell a person apart from an automated script, we examine the technical properties of each request. We do not need to know who you are to do this, and we do not try to find out.
| Data | Why it is needed | Kept for |
|---|---|---|
| IP address | Rate limiting, reputation, and linking repeated abuse from one source | Up to 30 days in security logs |
| Network operator (ASN) and country | Identifying traffic from hosting providers and abusive networks | Up to 30 days |
| User-Agent, TLS and HTTP characteristics | Detecting automated clients that misrepresent themselves as browsers | Up to 30 days |
| Requested path and time of request | Spotting scanning, scraping and probing patterns | Up to 30 days |
| Device fingerprint (a one-way hash) | Recognising a returning verified visitor without storing device details | Duration of the pass |
| Challenge interaction data | Distinguishing human movement from a script during verification | Discarded once the challenge is decided |
We do not read or store the contents of your requests — form fields, passwords, messages, payment details or page content are not inspected or retained. Site owners can clear their security logs at any time, and may do so sooner than the periods above.
Cookies we set
These are strictly necessary for the security service to function. None of them is used for advertising, tracking across sites, or building a profile of you.
| Name | Purpose | Lifetime |
|---|---|---|
| es_session | Records that you already passed verification so you are not asked again on every page. Signed, and tied to the site and connection that issued it. | Short-lived; set by the site owner |
| es_challenge | Ties a verification attempt to the browser that started it, preventing a challenge being solved elsewhere and replayed. | A few minutes |
| es_meter | Distinguishes a returning visitor from a new one for the site owner's usage counts. | Short-lived |
Signing in to the VerifySky dashboard also sets a standard session cookie required to keep you logged in.
What we process for customers
- Account — your name, email address, password (stored only as a secure hash, never in readable form), and workspace name.
- Domains — the hostnames you add, their configuration, and their protection settings.
- Billing — your plan, subscription status, and renewal dates. Card and payment details are handled entirely by PayPal and never reach our servers.
- Support — messages you send us, kept so we can answer and follow up.
- Assistant — if you use the in-dashboard AI assistant, your questions are sent to our AI provider to generate an answer. It is given access only to your own workspace data.
Who else processes data
We keep this list short on purpose. Each provider is used for one clearly defined job.
- Cloudflare — operates the global network where filtering happens, provides the invisible background check used during verification, and hosts the security log database.
- PayPal — processes subscription payments. They handle your payment details directly under their own privacy policy.
- Our AI provider — generates answers for the optional dashboard assistant. Used only when you ask it something.
- Our email provider — delivers account emails such as activation and security notices.
We do not sell personal data, we do not share it for advertising, and we do not pass it to anyone beyond the providers above except where the law genuinely requires it.
Where data is processed
VerifySky is a global service. Filtering happens at the network location closest to each visitor, which is the whole point — a decision made near the visitor is fast, and traffic stopped there never crosses the world to reach your server. In practice this means a request from Cairo is usually evaluated in or near Cairo, and one from São Paulo in or near São Paulo.
It also means personal data may be processed in countries other than your own, including outside your region. Where data is transferred internationally we rely on the safeguards our providers put in place for such transfers, including standard contractual clauses where they apply. Account and billing records are held centrally by VerifySky in Egypt.
Your rights
Wherever you live, you can ask us to do the following, and we will not charge you for it or make you justify the request:
- Access — get a copy of the personal data we hold about you.
- Correct — fix anything inaccurate or incomplete.
- Delete — have your data erased where we have no overriding reason to keep it.
- Port — receive your data in a machine-readable format.
- Object or restrict — tell us to stop or limit a particular use.
Write to [email protected] and we will respond within 30 days.
If you are in the EU, EEA, UK or Switzerland
The rights above are the ones the GDPR and UK GDPR give you. Our lawful basis for processing visitor data is legitimate interest — specifically, keeping websites available and free from abuse — and for customer account and billing data it is performance of our contract with you. You also have the right to lodge a complaint with your local supervisory authority, though we would appreciate the chance to put things right first.
If you are in California or a US state with a privacy law
You have the right to know what is collected, to have it deleted, and not to be discriminated against for exercising either. We do not sell or share personal information, and we never have, so there is no opt-out for you to exercise.
If you are elsewhere
We apply the same standard to everyone rather than offering rights only where a law compels us to. If your country's law gives you something stronger than the above, tell us and we will honour it.
Closing your account removes your account and domain data. Security log entries age out on the schedule above and can be cleared by you at any time from the Logs page.
Children
VerifySky is a service for website operators and is not directed at children. We do not knowingly collect personal data from anyone under 16 as a customer. If you believe a child has created an account, write to [email protected] and we will remove it.
How we protect it
- All traffic to VerifySky and to protected sites is encrypted in transit over HTTPS.
- Passwords are stored only as one-way hashes and cannot be recovered or read by us.
- Each workspace is isolated — customers can only ever reach their own domains, rules and logs.
- Verification passes are cryptographically signed and bound to the connection that earned them, so they cannot be copied to another visitor.
Changes and contact
If we change this policy we will update the date at the top of the page, and for anything significant we will tell account owners by email rather than relying on you to notice.
- Controller VerifySky, Egypt
- Privacy [email protected]
- Support [email protected]