Legal
Privacy policy
This policy states which personal data AntiClone processes, for what purpose, on which legal basis and for how long. It covers this website, the free first check, the Shopify app, the Clone Radar with AntiCloneBot and the operator's work on reported sites.
1. Controller
AntiClone, owner Dominik Prein, c/o NORDINITY #99913, Norderkamp 1, 24803 Erfde, Germany. Email: support@anticlone.de
For all questions about data protection and for your rights (section 10), an email to this address is enough.
2. Visiting this website
No cookies, no tracking. This website sets no cookies and uses no analytics or advertising services. Fonts and images come from our own server, not from third parties. Links to sources of other providers only open when you click them.
Server logs. With every request the server stores your IP address, the time, the address requested, the status code, the size of the response and the information your browser sends on its own, such as the browser identifier and the previously visited page. Cookies and credentials are not logged. The purposes are error analysis, defense against attacks and the handling of complaints. The logs are deleted after 14 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). The sign-up form for the first check and the links from the confirmation email are not logged.
Cloudflare. The website and the app are delivered through Cloudflare, which protects them against overload attacks. For this, Cloudflare processes your IP address and technical connection data. If an automated attack is suspected, Cloudflare may show a security check and set a technically necessary cookie for it. The legal basis is Art. 6(1)(f) GDPR. For the transfer to the USA, see section 8.
Live figures. Your browser loads the radar figures on this website from our own server. They are pure counts without personal data.
Email to us. If you write to us, we use your details only to reply (Art. 6(1)(b) and (f) GDPR). The email stays in the mailbox for as long as is necessary for handling it and for statutory retention obligations.
3. Free first check and pre-launch sign-up
What is stored. If you sign up on this website, we store your email address, the address of your shop, your shop platform, the language and the times of sign-up, confirmation email, confirmation and report. Your IP address is only used briefly in working memory to limit repeated sign-ups within a short time, and it is not stored.
Confirmation. You get an email with a confirmation link (double opt-in). The sign-up only counts once you confirm. Without confirmation we delete the details after 30 days.
The first check. After confirmation, AntiCloneBot reads your shop once, the way any visitor sees it, and AntiClone compares it with the shops in the radar index. What is read from your shop in the process is added to the radar index like any other online shop (section 5). The result is turned into a report. A person reads it, adds to it if needed and sends it to you by email. If you reply, your reply arrives in our mailbox.
The report sent. We keep every report sent, with recipient, shop address, subject, text and findings, so that it remains traceable what we sent you, and to improve the reports. Storage period: 12 months after sending. If you unsubscribe, we delete your reports immediately as well.
Message at launch. As soon as AntiClone launches for your shop platform, we write to you once more. We do not use your address for advertising, a newsletter or other offers.
Legal basis and withdrawal. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, through the unsubscribe link in the confirmation email or with an email to us. We then delete your sign-up immediately. The withdrawal applies for the future.
4. The AntiClone app
This section applies to merchants who install AntiClone in their Shopify shop.
Merchant data. Shop domain, shop name, contact email of the shop, Shopify shop ID and the access token for the Shopify interface (stored encrypted). From the product catalog: titles, handles, vendors, article numbers, barcodes, prices and image addresses. Product descriptions are not stored in full, but as a text fingerprint and a few distinctive sentences. Added to this are the company details the merchant enters for the legal notice (Impressum) comparison and as the sender of their reports (company name, address, email, phone, VAT ID), their settings, notifications, usage counters and an audit log.
No customer or order data. The app only requests read access to products from Shopify, and no access to orders or customers. We confirm deletion requests from Shopify regarding customer data and record them in the audit log. We do not hold any customer data of the shop.
Content of other websites. During checks, AntiClone retrieves publicly accessible pages of suspicious domains and stores screenshots, page source and server responses as evidence. These may contain personal data of third parties, for example names and addresses in the legal notice of a copy. Product images of a checked site that match products of the merchant are stored as reduced preview images. To determine which site existed first, we consult public registers (section 5).
Clone early warning. On the merchant's own shop the script sends nothing and sets no cookies. If the shop code runs on someone else's domain, the browser of a visitor to that copy sends that domain, the page path without parameters and the domain of the previous page. IP addresses are not stored in the process. So that a copy does not report again with every page view, the script notes in that visitor's browser, for the duration of the session, that a report has already been sent.
Reports and authorization. So that reports may be sent in the name of their company, the merchant grants an authorization once, which they can revoke at any time. We record the granting and the revocation with wording, version and the company details in the audit log until the shop's data is deleted. Reports only go out after a click by the merchant, and AntiClone first checks any case the merchant confirms as a copy. A report contains the merchant's company details as the sender and the check report, and it goes to the abuse contacts of the hosting provider, registrar or payment provider, with a copy to the merchant.
Legal bases. Providing the app: Art. 6(1)(b) GDPR (contract). Detecting, documenting and reporting infringements, including the content of other websites and the early warning: Art. 6(1)(f) GDPR (legitimate interest of the merchant in protecting their rights and their customers against deception).
5. Clone Radar and AntiCloneBot
Purpose. So that AntiClone can find copies even at unknown addresses, AntiCloneBot retrieves publicly accessible websites, the way any visitor sees them, and adds online shops to a shared index.
What is stored. Only websites that are recognized as an online shop, and of these only features for the comparison: domain, shop platform, page title, public shop IDs, and fingerprints of texts and product photos. We store product titles and contact details from the legal notice (email, phone, VAT ID) only as an irreversible hash. Every merchant sees only matches for their own shop.
Sources. Publicly accessible websites and public directories of new domains. For checks we also query public registers: registration data of domains and IP addresses, DNS, the Internet Archive and certificate directories. Only domain names and IP addresses of checked sites are transmitted in the process. From these registers we store only the registrar, the abuse contact and dates, and no data about the holder.
How long. Entries in the index are stored permanently: copies often reappear only after months or under new domains, and only the oldest entry proves which shop was there first. Operators of a website can demand that we delete the entries for their website. Evidence photos that the operator has taken of suspicious sites are deleted after 30 days. Evidence in a merchant's cases is kept for as long as their plan provides (section 9).
Legal basis and objection. Art. 6(1)(f) GDPR: the legitimate interest of merchants in detecting copies of their shops and the deception of their customers. Anyone who does not want the radar to read their website can exclude AntiCloneBot in the robots.txt (here is how) or write to us.
6. Suspect lists
The operator receives lists of domains of suspected fake shops from third parties, such as partners or consumer protection bodies. These lists contain only domain names. AntiClone checks these domains like sites from the radar and looks for the original that was copied. The domain, the name of the list, the check results and the original found are stored. The legal basis is Art. 6(1)(f) GDPR (protection of the copied shops and their customers). Storage period: 12 months after a check last found the domain online.
7. Reports and emails by the operator
Reports to registrars and hosting providers. When the operator himself reports sites that present themselves as a fake shop, the reports only go out after his review and his click. They contain the reported domains, public register data about them, the operator's observations and his name and contact address. We keep reports sent and later takedowns permanently as a record.
Emails about domains. So that the operator can see whom he wrote to about which domain and who replied, AntiClone stores only metadata about his emails: time, direction, the address of the other party, the subject and the domains concerned. AntiClone never stores the text of an email. The legal basis is Art. 6(1)(f) GDPR (traceable handling of abuse cases). Storage period: 24 months after the email.
8. Recipients
- Hosting of the website, app, radar and evidence files: one.com, servers in the Netherlands
- Email delivery and mailbox: mailbox.org (Heinlein Hosting GmbH, Berlin)
- Cloudflare, Inc., USA: delivery and protection of the website and app. The transfer to the USA is based on the EU-US Data Privacy Framework and the standard contractual clauses of the EU Commission.
- Shopify: installation of the app and billing of the plans
- public registers (registries, regional internet registries, DENIC eG, DNS), the Internet Archive and certificate directories: only domain names and IP addresses of checked sites
- registrars, hosting providers, payment providers and other recipients a report goes to: only after confirmation by the merchant or when the operator approves the report himself
- Google Web Risk (Google LLC, USA): addresses of sites from the radar, to check whether Google warns about them. No data of merchants or visitors
- only when switched on: Brave Search API (search queries with sentences from product texts and with the VAT ID and phone number the merchant entered for the legal notice comparison)
Beyond this, we do not pass any data on to third parties and do not sell any data.
9. Storage periods at a glance
| Server logs | 14 days |
|---|---|
| Unconfirmed sign-up for the first check | 30 days |
| Confirmed sign-up | until you unsubscribe |
| First check reports sent | 12 months after sending, immediately if you unsubscribe |
| Checks and evidence files in the app | depending on the plan 90 days (First check), 1 year (Basis), 2 years (Pro) or 3 years (Enterprise). The latest state of each case is kept until uninstallation |
| Data of a shop after uninstallation | deleted as soon as Shopify sends the deletion request (as a rule around 48 hours after uninstallation). Sessions immediately |
| Radar index | permanent. Deletion at the request of the website operator |
| The operator's evidence photos of suspicious sites | 30 days |
| Suspect lists | 12 months after a check last found the domain online |
| Metadata of emails about domains | 24 months after the email |
| Reports sent and takedowns | permanent, as a record |
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).
Objection. Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). An email to support@anticlone.de is enough.
Complaint. You can lodge a complaint with a data protection supervisory authority, for example the supervisory authority in your country.
11. Security
All connections are encrypted. We store Shopify credentials encrypted, and the data of the shops is strictly separated from each other. Evidence files are only available through short-lived, signed download links.
Last updated: November 2026