Privacy

This product exists to tell you who is on your site, so it is worth being exact about what that means. Most of what ClickHelm records never reaches us at all.

Last updated 2026-08-10

Who this is between

ClickHelm is operated by Hany Mahfouz. You can reach us at support@clickhelm.com about anything on this page.

There are two separate relationships here. Your visitors' data is recorded by the plugin into your own database, where you are the controller and we never see it. Your account data — your email, your licence, your billing — is held by us.

What the plugin records, on your server

When somebody visits your site, the plugin records the following into the database on your own hosting. None of it is sent to us.

• A device fingerprint, worked out from browser and hardware characteristics.
• IP address.
• Browser user agent, and the pages visited.
• The referring address and any Google Ads click parameters.
• Behaviour on the page: time spent, how far down they scrolled, whether they interacted.
• Where you have enabled it, the position of clicks on a page, for heatmaps.

Because this sits in your database, you are responsible for disclosing it in your own privacy policy. If you operate in a jurisdiction that requires consent for this kind of processing, that obligation is yours and not ours.

What reaches us

Very little, and none of it is about your visitors. Twice a day each installation asks our licence server whether the key is still valid. That request carries:

• The licence key.
• The site address it is installed on.
• The plugin version.
• The number of visits in the last thirty days, so your plan usage can be shown to you.
• The IP address the request came from, kept for the audit trail.

Other companies involved

Three, each doing one thing:

• Paddle handles payment and is the seller of record. Your card details go to them and never to us.
• proxycheck.io can be used to identify VPNs and data centre addresses. It is off by default. If you switch it on, visitor IP addresses are sent to them, and you should say so in your own policy first.
• Google, if you connect your Google Ads account, so we can check reported clicks against the ones Google recorded.

That is the complete list. There is no analytics on this website, no advertising pixels, and no fonts loaded from anyone else's server.

How long things are kept

Visitor data on your server is cleaned up on a schedule you control in Settings, with one deliberate exception: people you have blocked are kept indefinitely, including their fingerprint. Deleting it would quietly undo the block and let them back in unrecognised. Your account data is kept while you have an account, and account and licence records for seven years afterwards where tax law requires it.

Your rights, and your visitors'

You can ask us for a copy of your account data, ask us to correct it, or ask us to delete it, by writing to support@clickhelm.com. Deleting your account data ends your licence.

Requests from your visitors come to you, not to us, because their data is in your database and we cannot see it. The plugin can export and delete an individual visitor so you can answer them.