Keitaro, the self-hosted ad tracking software developed by Apliteni OÜ, will introduce new data collection requirements for its customers effective 13 October. Under the updated user agreement, clients must automatically transmit the IP addresses of the servers where Keitaro is installed, all domains connected to the tracker, and the names of campaigns, offers, and flows configured within the software.
Details of the New Policy
The updated terms stipulate that blocking or interfering with this data transfer will be considered a significant breach of contract. The company states that the collection of this operational telemetry is intended for license verification, fraud detection, and compliance with European Union sanctions. The data will be automatically sent from user installations to Keitaro’s infrastructure.
According to the agreement, Keitaro may retain this information for up to two years, or up to three years if required for investigations. The company also reserves the right to cross-reference data from different installations to identify potential violations.
Disclosure to Authorities
The new terms clarify that Keitaro may disclose user data in response to lawful requests from authorities, law enforcement, or courts. This provision aligns with common industry practices for handling regulatory or legal inquiries, especially for software providers operating in the EU.
Impact on Operators and Affiliates
For operators, affiliates, and other business users of Keitaro, the new requirements introduce additional compliance obligations. Users must ensure that their infrastructure allows for the automatic transmission of the specified data. Those handling sensitive or pseudonymized personal data should review their internal privacy and security policies to align with the new terms. Failure to comply could result in contract violations or loss of service access.
Key takeaways
- Keitaro will require users to transmit server IPs, domains, and campaign data from 13 October.
- Blocking this data transfer is a serious contract violation under the new agreement.
- Data may be disclosed to authorities upon lawful request and stored for up to three years in some cases.
- Operators and affiliates must review compliance and privacy practices to adapt to the new policy.