CaptchaLaCaptchaLa

Data collected from site visitors

Last updated: 2026-08-12

This page sets out the data the CaptchaLa widget collects from site visitors, the purpose of each category, the legal basis for processing, and the applicable retention period.

This page covers data collected from the visitors who solve a CAPTCHA. Data about you as an account holder — email, billing, dashboard usage — is covered by the Privacy Policy.

1. What we collect

Device and browser characteristics

  • Basic technical characteristics of the device and browser, such as screen and language settings

Connection characteristics

  • IP address and technical characteristics of the connection

User behaviour

  • Interaction with the challenge and the answers submitted

2. Purpose

  • Assessing the likelihood that a request is automated
  • Determining the type and difficulty of the challenge served

It is not used for content personalisation, marketing measurement, or any purpose other than distinguishing automated traffic from genuine visitors.

3. Legal basis

For visitors in the EU and UK, processing rests on legitimate interest under Article 6(1)(f) GDPR — preventing fraud and abuse against the site operator. Where you are the controller and we are your processor, the terms of that relationship are set out in the Data Processing Agreement.

This page describes our practice. It is not legal advice, and it does not decide what your own consent or notice obligations are. Ask your counsel about those.

4. Where it is processed

CaptchaLa serves from APAC edge nodes in Singapore, Hong Kong and Vietnam, in addition to its US and EU points of presence. Users in mainland China are served from the nearest APAC node.

Edge nodes terminate the connection and compute the connection fingerprint. They are points of presence, not storage locations.

4. Retention

Identifiable data is retained for no longer than 365 days.

Aggregate statistics derived from these records contain no identifier and are retained on an ongoing basis.

A shorter retention period can be arranged on request.

5. Restrictions

  • No profiles are built across different sites
  • No data is supplied to advertising or identity graphs
  • Collected data is not sold, rented or licensed
  • Challenge responses are not sold as training data
  • The contents of the host form are not accessed
  • No biometric data is collected

6. Disclosure

Verification data is not disclosed to third parties for their own purposes. The site operator receives the verification result. Infrastructure providers process data solely on our instructions and are listed in the Data Processing Agreement.

7. Individual requests

For a given verification, the site operator is normally the controller and the appropriate first point of contact. We assist operators in responding to access and deletion requests.

Contact: [email protected]