Privacy Policy

Last updated 24 October 2026

This policy explains what Rabbitproof (ABN 53 752 373 218) collects, why, and what we do with it. We follow the Australian Privacy Principles. Rabbitproof is not available in the European Union, Norway, Iceland, Liechtenstein, the United Kingdom or Switzerland.

Two kinds of people

Our customers are the website owners who have an account. Visitors are the people who visit websites that use Rabbitproof. We collect different things about each.

What we collect about customers

• Your email address and password. We never store the password itself. When you choose a password, we check it against a list of passwords exposed in data breaches: only the first 5 characters of a coded form of it are sent, never the password.
• If you turn on two-step sign-in, the information needed for it.
• The websites you add, their settings and products, and information our scanner collects from your website's public pages to set up its protection.
• A record of recent activity on your account, such as sign-ins and changes, and your internet address, the kind of device and browser, and its rough location when you sign in, to keep your account secure and show you where you are signed in. We also keep the time zone you last signed in from, so the dates in our emails are in your own time. When you sign up, we also keep that you confirmed your business is not based in a country we do not serve, and when.
• Billing details, held by our payment provider.
• The messages you send us in Support, and our replies.

If you use our contact page without an account, we get your email address, the topic, your website if you give it, and your message, and use them only to reply to you. A coded form of your internet address is kept for a day, to limit how many messages can be sent.

We use these to provide the service, run your account, bill you and send you emails about your account. We do not send marketing without your permission. Our staff can see account information when they need to, to run the service and help you.

What we collect about visitors

When someone visits a website that uses Rabbitproof, we collect information about their visit to tell real people and bots apart and to protect the website. This includes:

• Their internet address, and the country and network it belongs to. We store a coded form of the address, not the address itself, except in our network check below.
• Technical information our check reads from their browser and device, such as the screen, graphics, time zone, language and browser, and a device fingerprint worked out from it.
• A network check: their browser makes a short connection to our own server in Sydney, Australia, so we can see the internet address their device really connects from. This can show an address behind a proxy or VPN.
• The pages and forms their visit involved, the website they came from, and the kind of browser they use. Never what was typed into a form.

We do not collect names, email addresses, passwords or anything typed into websites that use Rabbitproof, and we do not use any of this for advertising.

We use this information only to protect websites that use Rabbitproof. It links a visitor's visits to the same website, so a returning real visitor is not checked again and a bot is recognised. When a device is identified as a bot, we use what we learned to protect every website that uses Rabbitproof. For the information about visitors to a website, the website's owner decides how it is used and we act for them. For what we learn about bots across all websites, we decide, and we are responsible for it.

We use information about visitors because protecting websites from bots is in the interest of the websites and their visitors.

On websites using our WordPress Plugin, a message the plugin refuses is kept on that website's own server for 30 days, so its owner can read it and unblock the sender. It is never sent to us.

Cookies and browser storage

Rabbitproof uses only the cookies and browser storage the service needs. None are used for advertising or to follow anyone from one website to another.

• On websites that use Rabbitproof: a pass a visitor gets after the check, so they are not checked again on every page. It lasts 1, 7 or 30 days, as the website owner chooses. On WordPress Plugin websites the check also keeps a small note in the browser's storage.
• On WordPress websites using Bot Management: a pass for the website's own administrators, so they are not checked while they work, lasting up to 7 days.
• On rabbitproof.com.au: a cookie that keeps you signed in to your account, for up to 30 days or until 7 days without use, and a note in the browser's storage that carries a website address you typed on our home page into your dashboard.

These are needed for the service to work, so they are set without asking. Website owners must mention them in their own privacy policy.

Where it is kept

Rabbitproof runs on Cloudflare's network, which has data centres around the world, so information may be handled and stored outside the country you are in. Our network check runs on our own server in Sydney, Australia.

Who else sees it

• Cloudflare, which runs our service and sends our emails.
• BinaryLane, which hosts our network check server in Sydney, Australia. It sees the internet address a visitor's device connects from.
• Stripe, which takes payments. Your card details go straight to Stripe and never reach us.
• Microsoft, which hosts our support mailbox: messages from our contact page and emails to support@rabbitproof.com.au are kept there.
• Google, which serves the fonts on our own pages, so your browser contacts Google when you open them.
• Every website that uses Rabbitproof benefits from what we learn about bots, as above. No customer is shown another customer's visitors.

Our Compliance page lists each company, where it is, and our Data Processing Agreement.

We never sell information. Apart from the above, we only give it to anyone else if the law requires it.

How long we keep it

• Your account: until you delete it. Deleting it removes your account, websites, support messages and the records of visitors to your websites straight away. Stripe keeps its own payment records, and emails you sent us stay in our mailbox.
• Your account's activity record: 90 days. Your sign-in: up to 30 days, or 7 days without use.
• A website's list of visitors: 7 days. Visitors blocked: 24 hours. Visitors unblocked: 7 days, or until the website's owner removes them if they choose to keep them. IP addresses a website's owner adds to its allow list: until they remove them. Daily counts of the visitors and bots a website had, by coded address or device: 32 days. Forms sent to a website: 30 days. Request counts for billing: 100 days.
• A record of each decision our check makes, with the coded address, the page, the website the visitor came from, the kind of browser, the country and network, the reason, and the readings our check took from the device: about three months, kept by Cloudflare for us, so we can find out why a real visitor was blocked.
• Our network check's server log: 7 days.
• Devices and connections identified as bots: 90 days after we last see them.
• Every website address that has used its first requests: kept, so the first requests are only given once for each address.
• An account never confirmed: removed after 7 days. A website never verified: removed after 30 days.

Your choices

You can ask to see or correct the information we hold about you, ask us to delete it, ask us to stop using it, or ask for a copy to take elsewhere, by writing to support@rabbitproof.com.au. We answer within one month.

If you visited a website that uses Rabbitproof, we hold your internet address only in coded form, so to find what we hold about you we need the internet address you used, the website and roughly when, or the reference shown on the page that blocked you. Records about visitors are kept only for the times above.

If you are unhappy with how we handled your information, tell us first. If we do not fix it, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au), or to the privacy regulator where you live.

Changes

If we change this policy in a way that matters, we will tell customers by email at least 30 days before it takes effect.

Contact

Write to support@rabbitproof.com.au.