Privacy Policy

Last Updated: August 20, 2026.

Introduction

Welcome to Traffman content traffic exchange network. We value your privacy and aim to be transparent about how we handle your data. Unlike many other websites, we do not use tracking cookies for advertising or third-party analytics.

This policy covers two different groups of people, so it is written for both:

Members – people who register an account and connect their websites to the network.
Visitors of member websites – people who see a Traffman content block on someone's site, or click a recommendation in it.

The rules for using the service itself are in our Terms and Conditions.

Data We Collect From Members

We only process data that is strictly necessary for the core functionality of our service:

Account data: your email address, your name if you choose to provide one, and the plan of your account. Passwords are stored only as a hash, never as text. When you sign in with Google, we receive your email address and your name from Google and create the account from them – nothing else about your Google account is stored.
Client data: for every website you connect, its host, the description you give it, the API key and secret issued to it, and the technical reports the integration sends during verification, including the IP address the requests come from.
Content data: the address, title, language and text of the pages you offer to the exchange, so that they can be validated and recommended.
Authentication data: when you log in, we issue a JSON Web Token (JWT) and store your User ID within a browser cookie. This is used solely to identify your session and keep you logged in as you navigate through the site. Without this, the authentication system cannot function.
Messages: what you send us through the contact form – your name, your message, and your email address if you leave one – so that we can answer.

Data We Collect From Visitors of Member Websites

When a content block is displayed on a member's website and when a visitor clicks a recommendation in it, we record the event: which content was shown or clicked, on which site, at what time, and the visitor's IP address.

The IP address is there for two reasons: to count each visitor once instead of counting the same view repeatedly, and to keep the exchange honest by detecting artificially generated impressions and clicks. It is not used to build a profile, it is not enriched with data from anywhere else, and it is not shared with the member whose site sent it – members see aggregated statistics only: impressions, clicks and click-through rate.

For this data the member who placed the block on their website decides that the processing happens, and we act on their behalf. Members are required by our Terms and Conditions to describe the block in their own privacy notice and to obtain any consent their local law requires.

How Long We Keep Data

Account and client data – for as long as the account exists.
Content data – while the content takes part in the exchange; withdrawing it or removing the client stops it from being offered.
Impression and click events – kept while they are needed to calculate balances and statistics and to detect abuse, and then removed or reduced to aggregated counters that no longer identify anyone.
Server logs – a short period, for security and debugging.
Contact messages – for as long as needed to handle the conversation.

Data Storage & Communication

API Interaction: Our website communicates with our proprietary API to fetch and process your data. This communication is strictly encrypted via HTTPS.
Secure Cookies: We use cookies to store your session token (JWT) and User ID. These cookies are configured with security flags (such as HttpOnly and Secure) to protect your data from unauthorized access and to prevent cross-site scripting (XSS).
Server Logs: For security and debugging purposes, our server may log basic information (such as IP addresses and timestamps) for a short period. This data is used exclusively for maintaining the technical integrity and security of the service.

Under the GDPR and ePrivacy Directive, consent banners are not required for cookies that are strictly necessary to provide a service explicitly requested by the user. Since our cookies are used solely for secure authentication and session management, we prioritize a clean user experience without intrusive pop-ups.

Third-Party Services

We do not sell, trade, or otherwise transfer your data to outside parties.
We do not use:

Third-party analytics (e.g., Google Analytics).
Marketing or tracking pixels.
Social media tracking buttons.

Web fonts are downloaded and served from our own servers, so viewing the site does not send a request anywhere else.

Two third-party services are involved in specific places, and only there:

Google Sign-In – used only if you choose to sign in with Google. Google then tells us your email address and your name, and Google's own privacy policy applies to what happens on their side.
Cloudflare Turnstile – protects the sign-up, sign-in and contact forms from automated abuse. It runs on the pages that carry those forms and receives technical signals from the browser needed to tell a person from a bot. It is not an analytics tool and does not track you across websites.

The API documentation page loads its viewer from a public CDN; that request happens on that page only.

Your Rights

Under the GDPR and other privacy laws, you have the right to access, rectify, or erase your personal data, to object to processing, and to receive a copy of the data you provided.

You can change your account details and remove any of your clients yourself, at any time. To delete the account itself, write to us through the contact form – we remove the account, its clients, their content records and the statistics tied to them.

Contact Us

If you have any questions about this policy, please contact us.