Privacy policy

When a customer's page calls the LR Defender SDK, we collect browser, hardware and runtime signals (such as GPU, canvas, audio, fonts, screen and time zone), the IP address and user-agent string of each request, and what the customer's server sends with it.

The SDK also sends the IP address that the browser's own WebRTC connection reveals. Behind a proxy it can differ from the address of the request, so we look up its network and country to detect a proxy, and the answer can give that country as the visitor's true country.

Once per session, the SDK opens a connection to our edge check, a Worker we run on Cloudflare, using a short-lived ticket from our API. The Worker times a few messages that the browser echoes back, then returns a signed reading of the connection, which the SDK sends to us with the identify call. The reading holds the IP address Cloudflare saw; the network, country, region, city, coordinates and time zone that Cloudflare associates with that address; the Cloudflare data center that took the connection; the round-trip times; the protocol; and the site that opened the connection. We use it to detect connections relayed through a proxy. Cloudflare processes the connection to run our Worker, and our Worker's code writes no logs and stores nothing.

The SDK does not collect names, email addresses, phone numbers, payment data or government IDs. It does process IP addresses and user-agent strings. Some laws treat IP addresses and device signals as personal data, and we treat them that way too.

Contact and demo request forms on this website collect the name, email address, company and message you choose to send. For account holders, we also keep account details (email address and company name) and records of API use.

Device signals are used to derive a device ID for fraud prevention, to detect automated bots and suspicious behavior, to give our customers analytics and risk verdicts, and to improve our matching.

Account information is used to manage your subscription, provide support and tell you about changes to the service.

Our website sets two strictly necessary cookies, and only when you sign in: lr_session keeps you signed in, and lr_login_challenge holds the five-minute sign-in code step.

It keeps a few values in your browser's local storage: lr_notice_v2, to remember that you dismissed the privacy notice; lr_role and lr_tenant, for signed-in users, so the dashboard shows the right account, along with the dashboard's own settings, such as the theme, the sidebar layout and your recent lookups; and, only when you use one of the live demos, that demo's own values, such as a demo device ID and the date of your last run.

No third-party tracking cookies are set.

The device ID the SDK returns is derived on our servers from the signals above, so clearing cookies or site storage does not reset it.

Retention of device data is set per contract on Enterprise. Ask us for the current schedule on other plans. Account information is kept for the life of the account and for 30 days after it is deleted. You can ask us to delete your data at any time.

We do not sell, rent or trade device data or personal information. We share data only with the providers we need to run the service, listed as subprocessors on our security page, and when the law requires it.

Data travels between browsers, your servers and ours over TLS 1.2 or 1.3. API keys are stored only as hashes and are shown once, when you create them. Each customer's data is kept apart by the application on every query, and device IDs are scoped to each customer account. Every control, and whether it is in place, in progress or not yet started, is listed on our security and privacy page.

LR Defender is hosted on Amazon Web Services in the United States. The edge check described above runs on Cloudflare, at the Cloudflare data center that takes the browser's connection. If you are outside the United States, your data is transferred to and processed in the United States. For transfers from the EU and EEA we rely on the Standard Contractual Clauses.

Our services are not directed to children under 16, and we do not knowingly collect their data. If you believe we have collected such data by mistake, contact us and we will delete it.

If you are in the EU or EEA, you have the right to access your data, correct it, erase it, restrict or object to its processing, and take it with you. California residents have the right to know, to delete and to opt out under the CCPA. To use any of these rights, write to privacy@lightningresearch.ai.

We may update this policy. We tell account holders about material changes by email and post them on this page with a new date. Using the service after a change takes effect means you accept it.

Privacy questions and requests: privacy@lightningresearch.ai. Lightning Research, Inc., Paris, France.