Privacy Policy

Last updated: September 25, 2026

Who we are

Whitelist-Warden (whitelistwarden.com) is operated by BOT-HOLDINGS, LLC, doing business as codedatda.casa (“BOT-HOLDINGS”, “we”, “us”), based in Las Vegas, Nevada, United States. We are the data controller for the personal data described here. Questions and requests go to info@whitelistwarden.com.

This policy covers the whitelistwarden.com website, its support chat, the Whitelist-Warden Pro checkout and the license server that the Whitelist-Warden plugin and toolkit contact. The Whitelist-Warden software itself runs on your own server: what it processes there (your visitors’ IP addresses, your server logs, your allow and ban lists and your Cloudflare settings) stays on your server and in your own accounts. The only thing the software sends to us is the license check described below.

What we collect, and why

• Server and security logs. Like every website, when you visit we and the services in front of us receive your IP address, browser type, the pages you request, timestamps and referring page. Our host keeps standard access logs and our content delivery network (Cloudflare) filters traffic for attacks. We use this to run the site, keep it secure and investigate abuse.
• Contact form. When you use it we collect what you type: the topic you pick, your name, email address, message, and, only if you fill them in, your company, website or LinkedIn, number of sites, subject, site address, license key, order or subscription reference, software version, server environment and severity, plus, recorded automatically, your IP address and browser type. We use it to answer your message; we also email you an acknowledgment that quotes your message. The submission is emailed to our team mailbox and kept in the site’s database. We keep it for as long as we need it to deal with your message and any follow-up; nothing is deleted automatically yet, so ask us and we will delete it.
• Ambassador application form. When you use it we collect what you type: your name, email address, and, only if you fill them in, the PayPal email address for commission payments, where you plan to share your code, your rough audience size, the code you would like and any notes. We use it to review your application and, if we approve it, send you your code, a private dashboard link and your commission payments. The submission is emailed to our team mailbox and kept in the site’s database. We keep it for as long as you take part in the ambassador program; if we do not approve your application, until you ask us to delete it (nothing is deleted automatically yet). Records of commission we paid you are kept for as long as tax and accounting law requires.
• Support chat. The chat button on this site opens a support assistant that is an AI: its answers are generated by an AI model run by OpenAI, using this site’s own pages and help articles. To start a chat you give your name and your email address and, if you choose, the address of the site you protect with Whitelist-Warden. Before your first message a Cloudflare Turnstile check runs to keep out bots; it sends browser signals and your IP address to Cloudflare. Each message you send, the details you entered, and the title and address of the page you are on are sent to OpenAI to produce the reply. A member of our team can read the conversation and may join it. Once a team member has joined, you may be able to send each other photos, videos and files. Files go only to our team, never to the AI (the AI sees only the file’s name). They are stored on our server with the conversation and can be opened by anyone who has the file’s private link. Photos keep the details your camera embedded in them, such as location and time, so remove those before sending if you prefer. We email our team when a chat starts (your details, the page and your first question), when it needs a person, and a full transcript when it ends, and we email a copy of the conversation to the address you gave. On the site we keep the conversation, the details you entered, the pages you chatted from, a random chat ID, a shortened IP address (for IPv4 the last number is removed; for IPv6 only the network prefix is kept) and any thumbs-up or thumbs-down rating you give (with any comment you add to it); your browser keeps the open chat in session storage until you close the tab. Once a week, conversations our team handled are sent to OpenAI with email addresses, phone numbers and order or ZIP numbers masked, so it can suggest answers for the assistant’s knowledge base; a person reviews every suggestion before the assistant uses it. Conversations, files and the details you entered are deleted from the site 90 days after the chat started; records of which team member handled a chat, and our team’s own internal chat about it, are kept for up to 12 months; emailed copies stay in the mailboxes they were sent to. Our team’s phones are alerted through Google Firebase Cloud Messaging (and Apple’s push service on iPhone); the alert contains only a chat reference, not what you wrote. Please do not send payment card numbers, passwords, government ID or health information in the chat.
• Pro subscriptions. When you start a Pro trial you approve a subscription in PayPal. PayPal handles the payment and sends us the email address and name on your PayPal account, the subscription ID, the plan and its status. We use them to create your license key, email it to you with your download links, and keep your license in step with your subscription. We never receive your card or bank details. We keep subscription and license records for as long as the license exists and then for as long as tax and accounting law requires.
• License checks from the software. When the Whitelist-Warden plugin or toolkit activates, checks or releases a license, it sends us the license key, your site’s address and the name and version of the client. We also record the IP address the request came from (IPv6 addresses shortened to their /64 network) and the time. We use this to enforce the number of sites each license covers and to stop license abuse. We keep it for as long as the license record exists; we do not yet delete license records automatically.
• Discount codes and rate limits. When you check a discount code, start a checkout, send the contact or ambassador form, download Pro, or the software activates or checks a license, we record the IP address and time of the request so we can enforce rate limits against abuse. Discount-code checks are deleted after about a day; the other rate-limit records are not yet deleted on a schedule.
• Page-load measurement. Our content delivery network (Cloudflare Web Analytics) records page loads and timing without cookies and without identifying you across sites.

We do not collect more than we list here, we do not buy data about you from data brokers, and we do not sell your personal data.

How we use AI

Some of what this service does is generated by machine-learning models run by a third-party provider. Specifically:

• the Warden support chat answers your questions with an OpenAI model, drawing on this site’s pages and our product notes, and uses the page you are on when you ask as context

We use OpenAI (OpenAI, L.L.C.) for this. We send them only what is needed to answer the request. Under their API terms they do not use the content we send to train their models, and we do not use your content to train models either. Generated text can be wrong, incomplete or out of date; treat it as a draft, not as professional, legal, medical or financial advice. A person on our team may read a conversation or output to help you or to check quality.

Legal bases (EU, UK and similar laws)

• Contract: to provide what you asked for, such as answering a message, fulfilling an order or running your account.
• Legitimate interests: keeping the site secure, preventing fraud and abuse, understanding aggregate use of the site, and running our business, balanced against your rights.
• Consent: any optional field you choose to fill in, and any optional feature you switch on. You can withdraw consent at any time; it does not affect processing that already happened.
• Legal obligation: tax, accounting and responding to lawful requests.

Cookies and similar technologies

This site sets no tracking cookies. It may set strictly necessary cookies (for example a Cloudflare security cookie such as cf_clearance or __cf_bm, or a cookie that remembers your cookie choice) that do not track you across sites and need no consent.

Our site does not currently respond to Do Not Track or Global Privacy Control browser signals; use your browser settings instead.

Who we share it with

We share personal data only with the service providers that help us run this site and deliver what you asked for. Each is a separate company that processes it under its own terms, which include data-protection commitments:

We also disclose data when the law requires it (for example a valid court order), to protect our rights, safety or property or those of others, and, if our business is sold or reorganized, to the successor under this same policy. We do not sell personal data and we do not share it for cross-context behavioral advertising.

International transfers

We are based in the United States and our providers are mostly US companies, so your data is processed mainly in the United States. Our team also administers our sites and services from Hong Kong, and working copies of some production data are kept on our administrators’ workstations there. If you are in the EU, UK or Switzerland, transfers rely on the providers’ EU Standard Contractual Clauses or Data Privacy Framework certification, plus the security measures below. You can ask us for details of the safeguard that applies.

How long we keep it

• Server and security logs: our host keeps raw access logs in monthly archives and Cloudflare keeps request logs only briefly; our security plugin keeps its log of administrator activity for 12 months. Host log archives are not yet deleted on a fixed schedule.
• Contact form: as long as we need it to deal with your message and any follow-up; nothing is deleted automatically yet, so ask us and we will delete it.
• Ambassador application form: as long as you take part in the ambassador program; if we do not approve your application, until you ask us to delete it (nothing is deleted automatically yet). Records of commission we paid you are kept for as long as tax and accounting law requires.
• Support chat: conversations, files, and the details you entered, 90 days from the start of the chat; records of which team member handled a chat and our team’s internal team chat about it, 12 months; suggested knowledge-base answers (with contact details and numbers masked), until we delete them; emailed copies stay in the receiving mailboxes while we may need them to help you.
• Pro subscription and license records: for as long as the license exists, then as long as tax and accounting law requires
• License activation records (site address, IP address, client version): for as long as the license record exists (no automatic deletion yet)

Security, and what happens if something goes wrong

We protect personal data with encryption in transit (HTTPS), with every plain-HTTP request redirected to HTTPS, Cloudflare’s edge network in front of the site, which blocks known attack traffic and automated bots, login protection with automatic blocking of repeated failed logins, and uptime and health monitoring of our servers. No system is perfectly secure, so we also plan for failure: if we learn of a security incident that affects your personal data, we will investigate, contain it, and notify you and any regulator we are required to notify without undue delay and within the time the applicable law sets (72 hours to the supervisory authority under the GDPR).

If you believe you have found a security problem in this site or any of our services, please tell us at info@whitelistwarden.com before you tell anyone else. We will not pursue good-faith researchers who report responsibly and do not access, change or destroy other people’s data.

Your rights

Wherever you live, you can ask us what personal data we hold about you, ask us to correct or delete it, ask for a copy in a portable format, object to or restrict how we use it, and withdraw any consent you gave. If you are in the EU, UK or Switzerland these are your rights under the GDPR and UK GDPR, and you may also complain to your data protection authority. If you are a California resident, the CCPA/CPRA gives you the rights to know, delete, correct, and to opt out of sale or sharing (we do not sell personal data and we do not share it for cross-context behavioral advertising), and we will not treat you differently for exercising them; residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other US states with privacy laws have similar rights, including the right to appeal a decision we make about your request.

To exercise any of these, email info@whitelistwarden.com from the address you used with us, or tell us enough for us to find and verify your record. An authorized agent may act for you if they show us your written permission. We answer within 30 days (45 for California requests, extendable once) and we do not charge for this unless a request is clearly excessive.

Children

This site is not directed to children and we do not knowingly collect personal data from anyone under 13 (or under 16 in the EU). If you believe a child has given us data, contact us and we will delete it.

Links to other sites

Links to sites we do not run (including app stores, GitHub, payment processors and social networks) are covered by those sites’ own policies.

Changes

When we change this policy we update the date at the top and, for material changes, post a notice on the site or email registered users. Earlier versions are available on request.

Contact

BOT-HOLDINGS, LLC, doing business as codedatda.casa
Las Vegas, Nevada, United States
info@whitelistwarden.com