1. Introduction
NinjaCTR ("we", "us", or "our") operates the website ninjactr.com and the NinjaCTR SaaS platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.
By accessing or using NinjaCTR, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use immediately.
Our Data Protection Officer (DPO) can be reached at: privacy@ninjactr.com
2. Information We Collect
We collect several types of information for various purposes:
Account Information
When you register, we collect your name, email address, agency name, and password (stored as a bcrypt hash — never in plain text).
Billing Information
Payment card details are processed directly by Stripe, Inc. We store only your Stripe Customer ID and subscription status — never your full card number or CVV.
Usage Data
We automatically collect information about how you interact with the platform: pages visited, features used, campaign configurations, session duration, and error logs.
Technical Data
IP address, browser type and version, operating system, device identifiers, time zone, and referring URLs are collected automatically via server logs and analytics.
Communications
If you contact our support team, we retain records of those communications to improve our service and resolve future issues.
Google Business Profile URLs
URLs and business identifiers you enter for campaign targeting are stored and processed to deliver the service.
3. How We Use Your Information
We use the collected data for the following purposes:
Service Delivery — To create and manage your account, process campaigns, and provide the core CTR manipulation service you have subscribed to.
Billing & Payments — To process subscription payments, send invoices, and manage your plan via Stripe.
Communications — To send transactional emails (receipts, password resets, campaign alerts), service announcements, and, with your consent, marketing updates.
Analytics & Improvement — To understand how users interact with NinjaCTR, identify bugs, and improve features and performance.
Security — To detect and prevent fraud, abuse, and unauthorized access to accounts.
Legal Compliance — To comply with applicable laws, respond to legal process, and enforce our Terms of Service.
We do not sell your personal data to third parties. We do not use your data for ad targeting on third-party platforms.
4. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA) or United Kingdom, our legal basis for collecting and using your personal data depends on the context:
Contract Performance — Processing necessary to provide the service you have subscribed to (account management, campaign execution, billing).
Legitimate Interests — Processing for fraud prevention, security monitoring, product analytics, and improving service quality, where these interests are not overridden by your rights.
Legal Obligation — Processing required to comply with applicable laws, such as retaining financial records for tax purposes.
Consent — Where we rely on your consent (e.g., marketing emails), you may withdraw it at any time without affecting the lawfulness of prior processing.
6. Third-Party Services & Data Sharing
We share your data with trusted third-party service providers only to the extent necessary to operate NinjaCTR:
Stripe, Inc. — Payment processing and subscription management. Stripe's privacy policy applies to data they handle: stripe.com/privacy.
Amazon Web Services (AWS) — Cloud infrastructure hosting our application servers and databases. Data is encrypted at rest and in transit.
Postmark / Resend — Transactional email delivery (receipts, alerts, password resets).
Cloudflare — DDoS protection, DNS, and CDN. Cloudflare may process request metadata per their privacy policy.
Sentry — Error monitoring and performance tracking for engineering diagnostics.
All service providers are bound by Data Processing Agreements (DPAs) requiring them to handle your data securely and only for specified purposes. We do not share your data with advertisers, data brokers, or unrelated third parties.
We may disclose data if required by law, court order, or to protect the rights and safety of NinjaCTR, our users, or the public.
7. Data Retention
We retain your personal data for as long as your account is active or as needed to provide services.
Account Data — Retained for the lifetime of your account plus 90 days after deletion, to allow for recovery and to fulfill legal obligations.
Billing Records — Retained for 7 years to comply with financial and tax regulations.
Campaign & Session Logs — Retained for 24 months (2 years) to provide analytics history, then purged or anonymized.
Support Communications — Retained for 3 years from the date of last interaction.
Server Logs — Retained for 90 days for security and debugging purposes.
When data is no longer needed, it is securely deleted or anonymized so it can no longer be linked to you.
8. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
Right of Access (GDPR Art. 15 / CCPA) — Request a copy of the personal data we hold about you.
Right to Rectification (GDPR Art. 16) — Request correction of inaccurate or incomplete personal data.
Right to Erasure (GDPR Art. 17 / CCPA "Right to Delete") — Request deletion of your personal data, subject to our legal retention obligations.
Right to Restrict Processing (GDPR Art. 18) — Request that we limit how we use your data in certain circumstances.
Right to Data Portability (GDPR Art. 20) — Request your data in a machine-readable format (JSON/CSV) to transfer to another service.
Right to Object (GDPR Art. 21) — Object to processing based on legitimate interests, including for direct marketing.
Right to Opt-Out of Sale (CCPA) — We do not sell personal data, so this right is satisfied by default.
Right to Non-Discrimination (CCPA) — We will not discriminate against you for exercising any of these rights.
To exercise any of these rights, email us at privacy@ninjactr.com. We will respond within 30 days (GDPR) or 45 days (CCPA). We may need to verify your identity before processing certain requests.
9. Data Security
We implement industry-standard security measures to protect your personal data:
Encryption — All data transmitted between your browser and our servers is encrypted using TLS 1.3. Data at rest is encrypted using AES-256.
Password Hashing — Account passwords are hashed using bcrypt with a cost factor of 12 — never stored in plain text.
Access Control — Internal access to production data is restricted to authorized personnel only, with audit logging enabled.
Infrastructure — Our systems run on AWS with VPC isolation, security groups, and automated vulnerability scanning.
Penetration Testing — We conduct annual security assessments.
Breach Response — In the event of a data breach affecting your rights, we will notify you and relevant supervisory authorities within 72 hours as required by GDPR.
No method of internet transmission or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.
10. International Data Transfers
NinjaCTR is operated from Pakistan with infrastructure hosted on AWS (US East region). If you are located in the EEA, UK, or other regions with data protection laws, your data may be transferred to and processed in jurisdictions that may not have equivalent data protection standards.
Where such transfers occur, we rely on:
Standard Contractual Clauses (SCCs) — EU-approved contractual provisions with our data processors.
Adequacy Decisions — Where applicable, transfers to countries recognized by the European Commission as providing adequate protection.
By using NinjaCTR, you acknowledge and agree to this transfer, storage, and processing of your information.
11. Children's Privacy
NinjaCTR is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at privacy@ninjactr.com and we will delete the information promptly.
12. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last Updated" date at the top of this page - Send an email notification to registered users - Display a prominent notice in the platform for 30 days
Your continued use of NinjaCTR after the effective date of any changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.
13. Contact Us & Supervisory Authority
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us:
Email: privacy@ninjactr.com General Support: support@ninjactr.com Website: https://ninjactr.com/contact-support
Data Protection Officer:
privacy@ninjactr.com
If you are in the EEA or UK and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local supervisory authority. For UK residents, this is the Information Commissioner's Office (ICO) at ico.org.uk.
Questions about your data?
Our Data Protection Officer is available to address any privacy concerns. We respond to all privacy requests within 30 days.
Contact Our DPO →Also see our legal documents: