Privacy Policy

Gonnaclick Pte. Ltd.
Last updated: 21 August 2026 · Supersedes the version of 27 March 2026

Gonnaclick Pte. Ltd. (“Gonnaclick”, “we”, “us”) is a company registered in Singapore at 112 Robinson Road #03-01, Robinson 112, Singapore 068902. We operate a programmatic advertising system, marketed under the product brand ClickSage, together with the websites and customer portals at gonnaclick.com and clicksage.ai and their subdomains.

Part A — Our websites and customer accounts

A1. What we collect

A2. Why, and on what legal basis

• To provide the service and administer your account — performance of a contract (Art. 6(1)(b) GDPR).
• To invoice, collect payment and keep accounting records — contract and legal obligation (Art. 6(1)(b) and (c)).
• To respond to enquiries and to keep our systems secure — legitimate interest (Art. 6(1)(f)).
• To send marketing e-mail — consent, or legitimate interest in the case of an existing business relationship. Every message carries an unsubscribe link.

A3. Cookies on our websites

Our public websites at gonnaclick.com and clicksage.ai set no cookies and load no third-party analytics or advertising tags. Our authenticated customer portals use strictly necessary cookies and tokens to keep you signed in and to protect against cross-site request forgery. These are exempt from the consent requirement of the ePrivacy Directive.

A4. Retention

Account and contact data is kept for the life of the business relationship and for six years afterwards where required for accounting and limitation purposes. Web server logs are kept for up to 30 days.

Part B — Advertising: people who see ads served through our system

B1. Our role, and how we receive your data

We operate a server-side demand-side bidder and an ad exchange. When an app or website you are using has an advertising slot to fill, the publisher or their supply-side platform sends a bid request to our servers describing that opportunity. We decide whether to bid, and if we win we deliver an advertisement and record the outcome.

We have no direct relationship with you. We operate no consumer product, no browser tag and no mobile SDK. Every item of personal data described in this Part reaches us because a supply partner transmitted it to us in a bid request, or because an attribution provider sent us a conversion postback. We are an independent controller of that data, and our supply partners are independent controllers of the data they send us.

B2. What we receive

• Advertising identifiers (IDFA, Google Advertising ID) and hashed device identifiers
• IP address
• Device and browser characteristics — make, model, operating system and version, user agent, language, mobile carrier, connection type, device type
• Non-precise location — country, region and city
• The app or website and the advertising slot in question
• Impression, click and conversion events, and the click identifier we ourselves issued
• Privacy signals — the TCF consent string, the US Privacy string, GDPR and COPPA flags, and the limit-ad-tracking and do-not-track flags

B3. What we do not receive or hold

We do not process precise geolocation; our systems have no field capable of storing latitude or longitude. We do not process your name, e-mail address, postal address or telephone number. We do not process hashed e-mail addresses or other authentication-derived identifiers. We do not build a cross-device graph and we do not derive probabilistic identifiers by fingerprinting your IP address and user agent. We do not process any special category of data within the meaning of Article 9 GDPR, and our contracts with supply partners prohibit sending it to us.

B4. Purposes and legal bases

We do not personalise editorial content and do not process data for Purposes 5, 6, 8 or 11. Where we rely on legitimate interest, our assessment and your right to object are set out in our Legitimate Interest Claim.

B5. Privacy signals we honour

The following are enforced in our bidding system before a bid is formed, so a suppressed opportunity produces no record at all. Every check fails closed: if a signal is present but cannot be interpreted, we suppress rather than bid.

B6. Who we share advertising data with

We do not sell advertising data to data brokers and we do not license it for any purpose outside the advertising transaction it arose from.

B7. Device storage

In our role as an advertising vendor we set no cookies and use no browser-based storage. We operate no mobile SDK. The only device-derived identifier we use is the advertising identifier that the publisher or supply partner transmits to us. Our full disclosure, in the format required by the IAB Europe Transparency & Consent Framework, is published at /tcf/device-storage.json.

B8. International transfers

We process data in Singapore and in the United States. Personal data originating in the European Economic Area, the United Kingdom or Switzerland is transferred under the European Commission's Standard Contractual Clauses, Module One (controller to controller), as annexed to our agreements with the relevant supply partner, together with the supplementary measures recorded there.

B9. How long we keep it

B10. Your rights, and how to use them

Where the GDPR applies you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time without affecting the lawfulness of processing carried out beforehand. In practice, the following are the effective routes:

• Your device setting is the fastest route. Enabling “Limit Ad Tracking” on iOS, turning off “Ads Personalisation” on Android, or resetting your advertising identifier stops us bidding on your traffic entirely.
• Through a consent management platform. Where a CMP presents us as a vendor, you can withdraw consent or object to our legitimate interests there, and we will honour it.
• Erasure. Write to privacy@gonnaclick.com. We operate a dedicated erasure endpoint that removes an identifier from audience segments and frequency-capping state. We act on requests without undue delay and within one month.

B11. IAB Europe Transparency & Consent Framework

We participate in the IAB Europe Transparency & Consent Framework and abide by its Specifications and Policies. We have applied for registration on the Global Vendor List; our vendor identification number will be published here once assigned. Our device storage disclosure is at /tcf/device-storage.json and our legitimate interest assessment at /legal/legitimate-interest.

Part C — Notice for California residents

This Part is provided under the California Consumer Privacy Act as amended by the CPRA. Terms have the meanings given to them in that Act.

C1. Categories of personal information collected

We collect no sensitive personal information as defined by the CPRA, and therefore offer no right to limit its use. We do not knowingly collect personal information from anyone under 16; we do not bid on traffic flagged as child-directed and we do not sell or share the personal information of minors.

C2. Selling and sharing

Our participation in programmatic advertising may constitute “selling” or “sharing” personal information for cross-context behavioural advertising as those terms are defined by the CPRA, because we forward advertising opportunities to other demand partners. The categories involved are identifiers, internet activity information and non-precise geolocation.

C3. How to opt out

You may opt out of the sale or sharing of your personal information in any of these ways:

• Global Privacy Control. We honour the US Privacy signal transmitted with a bid request. Where it asserts an opt-out of sale or sharing, we do not bid.
• Your device setting. Enabling Limit Ad Tracking on iOS or turning off Ads Personalisation on Android is treated by us as a binding opt-out of sale and sharing, not merely as a data-minimisation signal.
• Directly. Write to privacy@gonnaclick.com, including the advertising identifier concerned.

C4. Your other California rights

You have the right to know what personal information we have collected, to delete it, to correct it, and not to be discriminated against for exercising any of these rights. We do not offer financial incentives for personal information. An authorised agent may submit a request on your behalf with written proof of authorisation. Requests go to privacy@gonnaclick.com and are actioned within 45 days, extendable once where permitted.

Security

We apply access control, encryption in transit, network segmentation and least-privilege administrative access. We hold no independent security certification such as ISO 27001 or SOC 2; our infrastructure runs on Amazon Web Services and relies on the certifications AWS holds for that infrastructure. We state this plainly rather than imply a certification we do not have. We notify affected controllers of a personal data breach without undue delay and, where the applicable agreement or law requires it, within 72 hours.

Changes to this policy

We will post any change on this page and update the date at the top. Where a change materially affects how we process advertising data, we will also update our Global Vendor List registration.

Contact