Privacy policy

Last updated 2026-10-29

Who we are

Postbackly is operated by HQK ADVERTISING - INTERIOR COMPANY LIMITED (CÔNG TY TNHH QUẢNG CÁO - NỘI THẤT HQK), tax ID 0318791829, 44/3G Hau Lan 1, Ba Diem Commune, Hoc Mon District, Ho Chi Minh City, Vietnam.

For click and conversion data, we process personal data on behalf of the customer who uses our service (an advertiser, network or publisher): the customer is the controller and we are its processor, under the data processing terms in our terms of service. For our website, customer accounts, contact messages and security logs, we are the controller.

Click data

When someone opens a Postbackly tracking link, their browser sends a request to go.postbackly.click, and we record:

• date and time;
• IP address;
• user agent (browser and operating system) and accept-language header;
• referrer, when the browser sends one;
• the link key, the sub IDs sub1 to sub5 and any other parameters on the tracking URL, such as a Google click ID (gclid) or campaign ID;
• the destination URL, the click ID (pbclid) we generate, and whether the request came from a known bot or automated tool.

The tracker sets no cookies, runs no scripts and does not fingerprint browsers. We do not record what visitors do on the destination website. Sub IDs are chosen by publishers; our terms forbid putting personal data such as names, phone numbers or email addresses in them.

Conversion data

When a customer’s server sends us a postback, we record a conversion: the click ID it refers to, the transaction ID the customer sends (for example an order number), payout, currency, status (pending, approved or rejected) and the time. A conversion is linked to the click, offer and publisher it belongs to. We do not ask for, and customers must not send, the buyer’s name, contact details or order contents.

Customers also enter details about their offers and publishers, such as names and landing page addresses. These belong to the customer’s account and are processed on its behalf.

Website, accounts and contact messages

• Account: your name, email address, company (optional) and password. We store the password only as a salted scrypt hash, never in readable form. We also store the IP address you sign up from, to investigate abuse.
• Contact form: the details you submit (name, email, company, website, plan of interest, monthly click range and message) and the IP address the message was sent from, which we use against spam.
• Login protection: to stop password guessing, we count failed login attempts per IP address and per email address, and remember the IP addresses of your recent successful logins so that someone else cannot lock you out. This is kept in server memory only, never written to disk, and discarded after at most 14 days or when the server restarts.
• Password reset: if you ask to reset your password, we email a link to the address of your account. The link works once and expires after 30 minutes; we store only a hash of it and the time it was issued. The email shows the IP address the request came from, so you can recognise a request you did not make.
• Emails we send: only what the service needs: password reset links and a notice when your password has been changed. We send no marketing emails. So that our staff can respond quickly, a copy of each contact message and a notice of each new account (name, email address and company) are also emailed to our own staff mailbox.
• Administration area: sign-in attempts to our staff administration area are recorded with IP address, time and result, to detect intrusion attempts.
• Server logs: our web server logs each request: IP address, time, requested URL (for the tracker and postbacks, this includes the full URL with its parameters), status code, referrer and user agent.

Our pages load no third-party scripts, fonts, analytics or advertising tags. Fonts are served from our own server.

Cookies

We use no advertising or analytics cookies. The tracker on go.postbackly.click sets no cookies. Our staff administration area uses its own session cookie, set only for our staff.

Purposes and legal basis

• Click and conversion data: processed only on the customer’s instructions, to credit clicks and conversions to offers, publishers and sub IDs, show reports and support commission reconciliation. The customer decides why this data is collected, is responsible for having a legal basis for it and must tell visitors about it.
• Account data: to create and run your account and provide the service you signed up for (performance of our contract with you).
• Contact messages: to reply to your request (steps you asked us to take before a contract, and your consent when you send the message).
• Login protection, IP addresses at sign-up and on contact messages, and server logs: to keep the service secure and prevent fraud and abuse (our legitimate interest under the GDPR; under Vietnamese law, the protection of the service and of our users).

Where Vietnamese law requires your consent, we rely on the consent you give when you create an account or send us a message. You can withdraw it at any time by writing to us; this does not affect processing already carried out.

We never sell personal data, never use click or conversion data for our own advertising or profiling, and never combine one customer’s data with another customer’s.

Service providers and other recipients

• Hostinger International Ltd. provides the virtual server that stores all our data. The server is located in the United States.
• Cloudflare, Inc. provides DNS, TLS encryption and network protection for postbackly.click and go.postbackly.click. All requests, including tracker clicks and postbacks, pass through Cloudflare’s network, which processes IP addresses and request data in transit. Cloudflare may also ask browsers to report network errors to it.
• Our email provider processes the messages you send to our email addresses and delivers the emails we send: password reset links, account notices and the internal notifications to our staff described above.
• The customer who owns an offer sees the clicks and conversions recorded for it, and nobody else’s.
• Authorities, only when the law requires us to disclose data.

Our staff access personal data only for support, security and abuse handling.

International transfers

Because our server is in the United States and Cloudflare operates worldwide, personal data is transferred outside Vietnam and, for visitors from the European Economic Area, outside the EEA. We rely on our providers’ data processing terms, which include the EU Standard Contractual Clauses where the GDPR applies, and we follow the requirements of Vietnamese law on transferring personal data abroad.

Retention

Security

All traffic uses HTTPS. Passwords are stored as salted scrypt hashes and login sessions only as hashes of their tokens. Each offer has its own postback key, compared in constant time. The application runs in an isolated container with a read-only file system, and administrative access is limited to our staff, requires two-factor authentication and is protected against password guessing.

Your rights

Under Vietnam’s Law on Personal Data Protection No. 91/2025/QH15 (in force since 1 January 2026) and its implementing Decree 356/2025/ND-CP, which replaced Decree 13/2023/ND-CP, and, where it applies to you, the EU General Data Protection Regulation (GDPR), you have the right to be informed about the processing of your personal data, to access it, to have it corrected or deleted, to restrict or object to its processing, to withdraw consent, to receive your data in a portable format where the GDPR provides for it, and to complain.

Write to privacy@postbackly.click. We reply without undue delay, within the time limits set by the law that applies, and in any case within 30 days. You can also delete your account yourself at any time in Settings.

If you opened a tracking link and want your click data accessed or removed, contact the company whose offer or link you clicked, which controls that data, or contact us and we will pass the request on and help them handle it.

You can lodge a complaint with the competent data protection authority: in Vietnam, the Ministry of Public Security; in the EEA, the supervisory authority of the country where you live or work.

Children

Postbackly is a service for businesses. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.

Changes to this policy

When we change this policy, we update the date at the top. If a change materially affects how we use your personal data, we tell account holders by email before it takes effect.

Contact

Privacy requests: privacy@postbackly.click. Abuse reports: abuse@postbackly.click. Postal address: HQK ADVERTISING - INTERIOR COMPANY LIMITED, 44/3G Hau Lan 1, Ba Diem Commune, Hoc Mon District, Ho Chi Minh City, Vietnam.