Privacy policy

RealBots (aibots.kaderagha.com, the RealBots API and the Verified AI Bot Analytics WordPress plugin) is operated by Kamil Kader Agha, a sole trader registered in the Czech Republic, company ID (IČO) 04672488, Na Šedivé 743/5, 180 00 Prague 8, Czech Republic ("we", "us"), the data controller. Contact: [email protected] or our contact page. Because we are established in the EU, we handle all users' data under the EU General Data Protection Regulation (GDPR), wherever you live.

The log checker, robots.txt generator and Web Bot Auth validator run entirely in your browser. Logs you choose or paste, and the IP addresses and URLs in them, are analyzed locally by JavaScript on the page and are never uploaded to our servers.

• API account: your email address, a one-way hash of your API key (we cannot read the key itself), your plan and monthly call count.
• API requests: the IP address, user-agent and signature headers you ask us to check. These are processed to answer the request and are not stored by the API; standard server logs (below) may record the request.
• Payment data: for API Pro, the Stripe customer and subscription IDs and payment status. Card details are entered at Stripe; we never see or store your card number. If you subscribe through RapidAPI, we receive only your RapidAPI username.
• Contact data: your name, email and message if you contact us.
• Technical data: IP address, browser, pages or files requested and time, recorded in server logs — including when the WordPress plugin downloads our bot list.
• Analytics data: usage statistics collected through cookies, only if you accept analytics cookies.

• API account and requests: to issue your key, answer API calls and enforce quotas. Basis: performance of our contract with you (GDPR Art. 6(1)(b)).
• Payment data: to provide and bill API Pro and keep accounting records. Basis: contract and legal obligation (Art. 6(1)(c)).
• Email: to send your key, receipts and important service or Terms notices. We do not send marketing email without your consent. Basis: contract.
• Contact data: to answer you. Basis: our legitimate interest in replying (Art. 6(1)(f)).
• Technical data: security, abuse prevention and debugging. Basis: our legitimate interest in a secure, working service.
• Analytics data: to understand which pages are useful. Basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.

The Verified AI Bot Analytics plugin records crawler visits and AI-assistant referrals in your own WordPress database; that data is never sent to us, and you (the site owner) are its controller. Only if you opt in, the plugin downloads our public bot list once a day and fetches public signing keys from crawler operators, so our server and those operators see your server's IP address and the standard WordPress request header, which includes your site's address and WordPress version. Deleting the plugin removes its settings.

We share personal data only with providers who process it for us under contract, and only as needed for the purposes above:

• Payment processors: Stripe; RapidAPI if you buy through it.
• Hosting, network, storage and email providers (for example Hetzner, Cloudflare and our email provider).
• Analytics providers: Google Analytics and PostHog (EU servers), only if you accept analytics cookies; Google reCAPTCHA when we switch it on to protect the contact form from spam.
• Authorities, courts or advisers: only where required by law or needed to establish or defend legal claims.

Some providers process data in the United States. We rely on the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses for those transfers.

We do not sell or rent personal data or share it for cross-context behavioral advertising.

• API account: until you ask us to delete it (we may delete Free accounts unused for 24 months).
• Payment records: as long as Czech tax and accounting law requires (up to 10 years).
• Contact messages: as long as needed to deal with them.
• Server logs: deleted within 30 days.
• Analytics data: no more than 14 months.

• Use the free tools without giving us any personal data.
• Decline analytics cookies in the cookie banner, or withdraw consent at any time with the "Cookie settings" link at the bottom of every page.
• Email [email protected] to access, correct, delete or receive a copy of your data, to restrict or object to processing, or to withdraw consent. We respond within 30 days and may need to verify that the account is yours.

EU, EEA and UK residents have the rights of access, rectification, erasure, restriction, data portability and objection under the GDPR, and the right to lodge a complaint with a supervisory authority — in the Czech Republic the Office for Personal Data Protection (uoou.gov.cz), or the authority where you live.

U.S. residents (including California and other states with privacy laws) may request to know, access, correct or delete personal data. We do not sell or share personal data for targeted advertising, so there is nothing to opt out of. We will not discriminate against you for exercising any right.

We set one strictly necessary security cookie (csrftoken, which protects form submissions) and store your cookie choice in your browser's local storage. Google Analytics and PostHog cookies (such as _ga and ph_*) are set only after you accept analytics cookies. You can change your choice at any time with the "Cookie settings" link at the bottom of every page.

Data is transmitted over HTTPS, API keys are stored only as hashes, and access to stored data is limited to what is needed to run the Service. No online service is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

The Service is intended for website owners and developers and is not directed to children. We do not knowingly collect data from anyone under 16.

We may update this policy and will change the date above when we do. For material changes we will give notice on the site.