Privacy

Qlyne sees your visitors’ requests in order to decide on them. Afterwards it keeps two things: totals per hour, so your reports keep working, and a sample of decisions with the details behind them, which is deleted after a set time. No request body is stored, and nothing is sold or used for advertising. The privacy policy is the legal text; this page describes each item and how long it stays.

Who is responsible

For your visitors’ data, you, the site owner, are the controller, and Qlyne processes it on your behalf to run the protection. Visitors ask you about their data, and Qlyne helps you answer. For shared reputation, described below, Qlyne is the controller. For your own account (your e-mail, your members, your settings), Qlyne is the controller; the policy covers that part.

What each layer collects

The connector

The connector reads each request to decide on it: IP address, user agent, path, headers and, with the Qlyne proxy, the TLS fingerprint (JA4). It counts requests per address in short windows, from seconds to a few hours, and forgets them when the window ends. For IPv6, it often counts the /64 network instead of the full address.

With Account Protection:

• The password never leaves the connector and is never stored. The connector computes its SHA-1 and sends Have I Been Pwned only the first 5 characters, shared by hundreds of passwords, to learn whether it appears in a breach.
• The username is kept only as a hash, to count tries per account.

The bot score sensor

With the bot score on, a script on the page sends a summary about the browser: whether it reports automation; how many languages, plugins, processor cores and touch points it has; the screen size; whether it has a time zone. It adds counts of pointer moves, clicks, keys, scrolls and touches, how often the pointer changed direction, how long until the first interaction and how long the page had been open. The summary holds no keys typed, no text and no pointer positions.

The form captcha

The form captcha keeps the visitor’s IP address (the /64 for IPv6), the time and the page’s origin together with its token for 5 minutes. That lets your site check the token once and compare the IP address.

Cookies in the visitor’s browser

Cookie	What it holds	How long
qlyne_bs	The bot score, encrypted, tied to the IP address and the browser	30 minutes
qlyne_clr	Proof that the visitor passed the challenge, tied to the IP address and the browser	The pass length you set
qlyne_pass_ plus the waiting room’s key	The pass of a visitor who left the waiting room	The pass length you set
qlyne_gate_ plus a code for the gate	A signed session for an Access gate	The session length you set
qlyne_consent	The visitor’s choice in the consent banner (the categories accepted and when). Nothing is sent to Qlyne	180 days

The first four make the protection work; qlyne_consent only exists when you use the consent banner. They are set on your site’s domain, are valid only there, and cannot follow the person to other sites.

Decision samples

So you can check your rules on the Events screen, the connector reports examples of what it decided: time, action, rule, method, host and path (without the query string), IP address, user agent and, when the connector has it, the TLS fingerprint (JA4). The country and the network (ASN) come with the Cloudflare connector, or with the Qlyne proxy when it has a GeoIP database. With the Qlyne proxy and the bot score on, a sample also carries the score and the sensor summary behind it. It is a sample: at most 5 of each action every 10 seconds, not every request. Only the members of your account see them.

Totals per hour

The reports count requests per hour by action. They also count by path, user agent and IP address (the /64 for IPv6) and, where the connector knows them, by country and network. That shows where traffic comes from and lets you block an address that abuses the site.

How long each item is kept

Item	Kept for
Per-address counters and tokens	Their time window, from seconds to a few hours
A place in the waiting room	At most 2 hours
Form captcha token, with IP address and origin	5 minutes
Addresses banned by the scanner trap	Up to 24 hours
Shared reputation (IP address and the reporting account)	24 hours
Counts per IP address	7 days
Counts per country, network, path and user agent	8 days
Waiting room snapshots	30 days
Decision samples	7 days in the Qlyne server (the latest 1,000 per account), and a copy for 120 days in the dashboard’s history
Totals per hour by action	With no end date, since they do not identify anyone

Shared reputation

While a site reports attacks (on by default; you can turn it off), Qlyne keeps for 24 hours the IP address of visitors caught there by the scanner trap or the managed rules, with a high bot score, driving an automated browser or refused by the form captcha. It keeps them with the id of the reporting account. An address reported by at least two accounts goes on a list sent to the connectors that use it, without the site, the account or what happened. See shared reputation on the Bot Management page.

Legal basis

• Your visitors’ data: Qlyne processes it on your behalf, under your legal basis as controller. For the bot score sensor, that basis is your legitimate interest in protecting the service, telling visitors from bots (LGPD, articles 7, IX and 10; GDPR, article 6(1)(f)).
• Shared reputation: Qlyne’s legitimate interest in preventing fraud and keeping networks secure (LGPD, articles 7, IX and 10; GDPR, article 6(1)(f) and recital 49).
• Your account: the contract with you, and Qlyne’s legitimate interest in keeping the service secure.

To object, to ask about an address, or to exercise any right under LGPD or GDPR, use the contact in the privacy policy.