Kordon Checkpoint is run by Kordon Labs (“Kordon”, “we”) for the owners of websites who add it to their pages, for example to sign-up, sign-in or payment forms. How a site handles the rest of your data is described in that site's own privacy policy; this page covers only the check. Anything it does not cover is governed by the Kordon Privacy Policy.
How the check works
When you tick the box, Kordon checks that the site was opened by a person and looks at the connection you came through. The widget shows the result: passed, or not passed with the reason.
After that the widget gives the site a one-time token. The site's server exchanges it with Kordon for the result of the check. The token works once and expires after 5 minutes. What happens next, for example whether a form is accepted, is decided by the site.
What data is processed
2.1Your IP address
From the IP address we determine the country, the network (AS) and the internet provider, and whether the address belongs to a VPN, proxy, Tor, hosting or another anonymiser. For this we use IP reputation data from third-party sources and Kordon's own data. The country is determined approximately; we do not determine your precise location.
2.2Signals of your browser
At the moment of the click the widget reads technical data about the browser and about how the click was made. They tell a person from a program.
The signals are evaluated during the check. Their values are not saved: only the result of the check is recorded.
2.3The page and the language
The domain of the page with the widget, the name of the form if the site set one, and the language of your browser, to show the widget in it.
The check does not ask for and does not receive your name, email address, passwords or anything you type into the site's forms.
Why
- To tell people from bots and protect the site from automated sign-ups, spam, password guessing and attacks.
- To let the site's owner restrict access through VPNs, proxies and other anonymisers, as set in the owner's settings.
- To protect Kordon itself from abuse.
The ground is the legitimate interest of the site's owner and of Kordon in the security of the site (GDPR Art. 6(1)(f)). For the checks on a site, the site's owner is the controller of your data, and Kordon processes it on the owner's behalf.
We do not sell data, do not use it for advertising and do not build profiles for any purpose other than protection.
Who sees the data
- The site's owner sees the journal of checks on their site: the time, the domain of the page, the IP address, the country, the network and the result with the reason. The owner can also add your address to the site's own allow or deny list.
- Kordon staff, when it is needed for support, security and investigating abuse.
- IP reputation providers receive the IP address being checked.
- Hosting providers in the EU store the data.
We may disclose data to authorities when the law requires it.
How long data is kept
- Record of a check
- 90 days, then it is deleted automatically.
- Result of an address check
- up to 90 days.
- Daily numbers of checks
- 60 days. They contain no addresses.
- Data about networks
- a mark that an address belongs to a VPN, proxy, hosting or Tor network describes the network, not you. It is kept while it is needed for protection, at the latest 2 years after the address was last detected.
Your rights
You can ask for access to your data, its correction or deletion, and object to its processing, as far as the law of your country allows. The site's owner is the controller, so contact them first: they see your checks and can let your address through. You can also write to us at contact@matix.gg; we will help or pass your request to the site's owner.
If the check does not let you through, see Checkpoint help.