Effective 2026-08-21 · England
Privacy Policy
Applies to the webuyany.click website, marketplace, direct links, traffic rotator, accounts and related services.
Nottingham
United Kingdom. Email: support@webuyany.click.
webuyany.click is the controller of personal data described in this Privacy Policy. This Policy explains what we collect, why, how long we keep it, who receives it, international transfers and your rights under the UK GDPR and Data Protection Act 2018. It applies to visitors, account holders, staff contacts, support correspondents and people whose devices reach our traffic rotator.
1. Contact and scope
Controller: webuyany.click, Business operating in England. Address: WeBuyAny.click
Nottingham
United Kingdom. Privacy email: support@webuyany.click. We have not appointed a data protection officer because the current processing described here does not require one; privacy enquiries go to the stated address.
2. Personal data we collect
- Identity and account data: name, email, business name, country, public account ID, role, status, referral relationship and account preferences.
- Compliance data: profile type, legal name, company registration number, first and last name, date of birth, address, country, verification status, review notes and information reasonably needed for payment, sanctions, fraud, Travel Rule, tax or legal checks. Do not send identity documents through ordinary support unless we give a secure approved method.
- Authentication and security data: password hash, email-verification and reset-token hashes, login time, pseudonymous IP and user-agent hashes, rate-limit records, consent state and audit records. We do not store readable passwords.
- Traffic data: direct-link and campaign IDs, accepted and rejected aggregate counts, dates, spend, estimated earnings, last-win times, and short-lived stable keyed fingerprints derived from IP address, user agent and link with a rolling expiry. The application does not retain a raw event row for every click. Web host, DNS, security and network providers may separately receive and retain ordinary request logs, including IP addresses.
- Campaign and Seller data: destination URLs, bids, budgets, link names, caps, moderation decisions, traffic evidence and investigation material.
- Financial and crypto data: token and earning balances, ledger entries, deposit provider, amount, status and references, withdrawal amount, speed, asset, network, public wallet address, blockchain transaction ID and provider response. Payment processors collect payment credentials; we do not store full card numbers, card security codes or private wallet keys.
- Communications: support tickets, email delivery logs, notices, complaints, choices and administrative notes.
- Technical data: browser and device information, requested route, security events, error references and any analytics or marketing data allowed by your cookie choice.
3. Sources
We obtain data from you; your authorised organisation; browsers and devices using the website or a direct link; referrers; Buyers and Sellers involved in an investigation; payment, payout, email and infrastructure providers; blockchains and screening or fraud sources; and public or official records where checks are necessary. Referral relationships may come from a referral URL or consented referral cookie.
4. Purposes and lawful bases
| Purpose | Typical data | UK GDPR basis |
|---|---|---|
| Create and operate accounts; provide buyer, seller, referral and support features | Identity, account, campaign, link, balance and communications data | Contract; steps requested before contract |
| Run the auction, redirect traffic, count delivery and calculate charges and estimates | Traffic aggregates, campaign, link and financial data | Contract; legitimate interests in operating and measuring the marketplace |
| Process deposits and crypto withdrawals | Identity, compliance, financial, wallet and provider data | Contract; legal obligations; legitimate interests in secure payment |
| Prevent fraud, bots, duplicate traffic, account takeover, abuse and circumvention | Security, pseudonymous network fingerprints, account relationships, traffic and audit data | Legitimate interests in protecting users and the Service; legal obligations where applicable |
| Moderate destinations, investigate complaints and enforce policies | Campaigns, links, traffic evidence, communications and audit data | Contract; legitimate interests in a lawful, safe and commercially viable marketplace |
| Keep accounting, tax, legal and corporate records; respond to authorities and claims | Identity, transaction, ledger, tax, communication and audit data | Legal obligation; legitimate interests in establishing, exercising or defending legal claims |
| Send security, payment, support and legal messages | Email, account and event data | Contract; legal obligation; legitimate interests |
| Send optional product, referral or marketing messages | Email, preferences and account segment | Consent where required; otherwise legitimate interests subject to PECR and your right to object |
| Use optional analytics or marketing storage and scripts | Cookie identifiers and provider-defined browsing data | Consent |
Where we rely on legitimate interests, our interests include operating a reliable marketplace, measuring contractual delivery, detecting abuse, protecting funds and systems, improving service, resolving disputes and communicating with business users. We consider necessity and impact, use aggregation and keyed hashes where practical, limit retention and provide rights and choices.
5. Auction and anti-abuse decisions
Software automatically selects a campaign using eligibility, bid weight, budget and bounded delivery factors. Software may also reject an apparent bot or immediate duplicate and can stop an unfunded or completed campaign. These decisions allocate low-value traffic and calculate contractual counters; they are not intended to produce legal or similarly significant effects on an individual. Staff can review campaign, traffic, earning, compliance and account decisions through support. We may keep fraud rules confidential to prevent evasion.
6. Sharing and processors
We share only as reasonably necessary with: hosting, DNS, security, backup and database providers; email delivery providers; payment processors and payout providers; anti-bot, analytics, tag-management and marketing providers that an administrator configures and, where required, you consent to; professional advisers, auditors, insurers and contractors under duties of confidentiality; a buyer of the business or Service subject to appropriate safeguards; and courts, regulators, law enforcement, tax authorities or other parties where required or reasonably necessary to protect rights and safety.
Buyers do not receive Seller identity, link or source-zone information from us, and Sellers do not receive Buyer identity or destination allocation information from us, except where disclosure is required by law, necessary to address abuse, or expressly authorised. A destination server will necessarily receive the visitor's network request after redirect and may collect data under its own policy.
7. Payment processors, payout providers and blockchains
Payment processors and payout providers act under their own privacy notices for information they independently collect, risk-check and process. A crypto payment or payout provider may require customer-profile information for Travel Rule or anti-financial-crime compliance. Public wallet addresses and transaction IDs written to a public blockchain can be permanently visible and may be linked with other information by third parties. We cannot erase or control a public blockchain.
8. International transfers
Some providers, recipients or blockchains may operate outside the United Kingdom. Where UK data-protection transfer rules apply, we use an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard, and assess supplementary measures where required. Contact us for information about safeguards relevant to your data. Public blockchain broadcasts are global and are not conventional transfers we can geographically restrict.
9. Retention
| Record | Normal retention |
|---|---|
| Short-lived click fingerprint | Up to 24 hours |
| Traffic and daily accounting aggregates; ledger, deposits, withdrawals and tax records | Seven years after the relevant transaction or account closure, longer where a dispute, investigation or law requires |
| Account and contract records | While open and seven years after closure |
| Uncompleted verification and password-reset tokens | Until expiry, then normally removed within seven days |
| Support tickets and complaints | Three years after closure, or seven years where tied to a financial record, dispute or legal duty |
| Security and administrator audit logs | Normally two years; longer for an active incident or claim |
| Email queue and delivery logs | Normally two years for service messages; marketing data until opt-out plus a minimal suppression record |
| Cookie consent | Six months on the device, with renewed choice where required |
We may securely delete, aggregate or anonymise records earlier where no longer needed. Backups may persist for a limited rotation period and are isolated from ordinary use. We retain data longer where needed for fraud, sanctions, tax, legal hold, claims or enforcement.
10. Security
Measures include password hashing, prepared database queries, role-based permissions, CSRF protection, secure session cookies, security headers, encryption of configured API secrets, webhook signature verification, idempotency controls, transaction locks, pseudonymous network hashes, audit trails, queue locking and restricted configuration/storage directories. No internet service is perfectly secure. Use a unique password, protect email and wallet access, verify addresses and report suspected compromise promptly.
11. Your data-protection rights
Depending on the processing and exemptions, you may request access, correction, erasure, restriction, portability, or information about safeguards; withdraw consent at any time; and complain to a regulator. Withdrawing consent does not affect earlier lawful processing. Contract, accounting, fraud or legal records may need to be retained despite an erasure request.
To protect accounts, we may verify identity and authority before responding. We normally respond within one month, subject to lawful extensions for complex requests. Requests are normally free, but we may charge or refuse where the law permits for manifestly unfounded or excessive requests.
12. Complaints
Please contact us first at support@webuyany.click. You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or another competent supervisory authority where applicable.
13. Children
The Service is business-only and not directed to anyone under 18. Do not register or send us a child's personal data. If we learn an account belongs to a child, we will close it and handle the data as law requires.
14. Changes
We may update this Policy to reflect law, providers, security or service changes. The effective version appears above. For material changes, we will provide reasonable dashboard or email notice where practicable.