Subprocessors
Every third party that sees data flowing through Offerwall.GG, and what they see.
AESHA Technology Services Limited · Last revised 7 October 2026 · All legal documents
This list is part of the data processing addendum. We give notice before adding to it, and a publisher who objects on reasonable data-protection grounds may terminate without penalty.
| Who | Role | What they see | Where |
|---|---|---|---|
| PayPal | Payments — advertiser funding and publisher payouts | The email address a payment is sent to or received from, the amount, and the reference of the invoice or payout it belongs to. | United States; PayPal (Europe) S.à r.l., Luxembourg for EEA payers |
| ZEN.COM | Payments — SEPA transfers | The beneficiary name, IBAN and BIC of a payout, and the amount and reference of the transfer. | Lithuania (EEA) |
| Payzink | Payments — advertisers funding a balance by card | The amount, the advertiser's email address and country, and the invoice reference. Card numbers are entered on Payzink's checkout and never reach us. | See Payzink's own privacy policy. |
| Didit | Identity verification for advertisers paying by card or PayPal | A photo of an identity document, a selfie for the liveness and face match, and the IP address and device of the person verifying. We receive the decision (approved, declined or under review), not the images. | European Union |
| Stripe | Payments | The billing details and amount of a transaction. Card numbers are entered with the processor and never reach us. | United States; Stripe Payments Europe Ltd, Ireland for EEA payers |
| Google (Analytics) | Website analytics | Page views, IP address, user agent and referrer of visitors to our own marketing pages. Not the offerwall, which carries no analytics. | United States |
| Microsoft Azure | Cloud infrastructure | Whatever is processed by the services hosted there, in transit and at rest. | As configured per region |
| Amazon Web Services | Cloud infrastructure and storage | Whatever is processed by the services hosted there, in transit and at rest. | As configured per region |
| Spaceship, Inc. | Domain registration and DNS | Domain registration records. No publisher, advertiser or end-user data. | United States |
| CPX Research | Advertising network | An opaque per-user token, the click identifier, and the IP address and user agent of the user at the moment they open an offer — and, because this network lists its offers per user, the token and IP address (and, for some networks, the user agent) whenever the offerwall is opened. Never the publisher's own user id, and never an email address. Separately, each offer's artwork is served from the network's own image host, so that host receives the IP address and user agent of anyone who views a page showing the offer — the offerwall itself, and the sample offers on our home page — whether or not they click anything. | See the network's own privacy policy. |
| OGAds | Advertising network | An opaque per-user token, the click identifier, and the IP address and user agent of the user at the moment they open an offer — and, because this network lists its offers per user, the token and IP address (and, for some networks, the user agent) whenever the offerwall is opened. Never the publisher's own user id, and never an email address. Separately, each offer's artwork is served from the network's own image host, so that host receives the IP address and user agent of anyone who views a page showing the offer — the offerwall itself, and the sample offers on our home page — whether or not they click anything. | See the network's own privacy policy. |
| MyLead | Advertising network | An opaque per-user token, the click identifier, and the IP address and user agent of the user at the moment they open an offer. Never the publisher's own user id, and never an email address. Separately, each offer's artwork is served from the network's own image host, so that host receives the IP address and user agent of anyone who views a page showing the offer — the offerwall itself, and the sample offers on our home page — whether or not they click anything. | See the network's own privacy policy. |
| BitcoTasks | Advertising network | An opaque per-user token, the click identifier, and the IP address and user agent of the user at the moment they open an offer — and, because this network lists its offers per user, the token and IP address (and, for some networks, the user agent) whenever the offerwall is opened. Never the publisher's own user id, and never an email address. Separately, each offer's artwork is served from the network's own image host, so that host receives the IP address and user agent of anyone who views a page showing the offer — the offerwall itself, and the sample offers on our home page — whether or not they click anything. | See the network's own privacy policy. |
| Awin | Advertising network | An opaque per-user token, the click identifier, and the IP address and user agent of the user at the moment they open an offer. Never the publisher's own user id, and never an email address. Separately, each offer's artwork is served from the network's own image host, so that host receives the IP address and user agent of anyone who views a page showing the offer — the offerwall itself, and the sample offers on our home page — whether or not they click anything. | See the network's own privacy policy. |
| Lootably | Advertising network | An opaque per-user token, the click identifier, and the IP address and user agent of the user at the moment they open an offer. Never the publisher's own user id, and never an email address. Separately, each offer's artwork is served from the network's own image host, so that host receives the IP address and user agent of anyone who views a page showing the offer — the offerwall itself, and the sample offers on our home page — whether or not they click anything. | See the network's own privacy policy. |
| TimeWall | Advertising network | An opaque per-user token, the click identifier, and the IP address and user agent of the user at the moment they open an offer. Never the publisher's own user id, and never an email address. Separately, each offer's artwork is served from the network's own image host, so that host receives the IP address and user agent of anyone who views a page showing the offer — the offerwall itself, and the sample offers on our home page — whether or not they click anything. | See the network's own privacy policy. |
| ZerAds PTC | Advertising network | An opaque per-user token, the click identifier, and the IP address and user agent of the user at the moment they open an offer. Never the publisher's own user id, and never an email address. Separately, each offer's artwork is served from the network's own image host, so that host receives the IP address and user agent of anyone who views a page showing the offer — the offerwall itself, and the sample offers on our home page — whether or not they click anything. | See the network's own privacy policy. |
| TheoremReach | Advertising network | An opaque per-user token, the click identifier, and the IP address and user agent of the user at the moment they open an offer — and, because this network lists its offers per user, the token and IP address (and, for some networks, the user agent) whenever the offerwall is opened. Never the publisher's own user id, and never an email address. Separately, each offer's artwork is served from the network's own image host, so that host receives the IP address and user agent of anyone who views a page showing the offer — the offerwall itself, and the sample offers on our home page — whether or not they click anything. | See the network's own privacy policy. |
| Traffic Tasks advertisers | The website a user visits when they start a Traffic Task | The site is opened on our view page, so it receives what any website does when somebody visits it: the IP address and user agent of the user, and offerwall.gg as the referrer. It may set its own cookies. Never the publisher's user id or our per-user token. | See the advertiser's own privacy policy. |
| Mailgun (Sinch) | Transactional email | The email address and username of an account holder, for verification and password reset. No end-user data is ever sent by email. | United States |
| ZerAds | Display advertising on our blog and the offerwall | The IP address, user agent and referring page of anyone viewing a blog page or an offerwall, because the ad is loaded from ZerAds' own servers in a frame. ZerAds may set its own cookies inside that frame. Nothing from an account, never the publisher's user id or our per-user token, and nothing on any other page. | See ZerAds' own privacy policy. |
| IPQualityScore | Fraud screening of offerwall users | The IP address of an end user, once — the first time they open a given publisher's offerwall while screening is switched on. Nothing else is sent. We keep the fraud score and the flags it answers with (VPN, proxy, Tor, bot) on that user's record. Never the publisher's user id, the user agent or our per-user token. | United States |
| OpenAI | Automated screening of the sites and app listings publishers add as placements | The address of a submitted website or app store listing, and the visible text of its front page or listing. No account details, contact details, payment data or end-user data, and never an image. We keep the verdict and a short summary, not the text. | United States |
| Cloudflare | Network and bot protection | Request metadata in transit: IP address, user agent, and the country header we use for offer targeting. On the sign-in, registration, password-reset, confirmation-resend and contact forms, Cloudflare Turnstile checks the browser is a person; its script is loaded from challenges.cloudflare.com. The domain names of websites submitted to us are looked up on Cloudflare's security and family DNS resolvers when we screen them, and on its public resolver when we check a DNS record that proves who owns them. | Global edge network |
What a network does not get
An advertising network never receives the publisher's own user identifier. Each end user is given a stable opaque token, derived by keyed hash, and that is what leaves us — enough for the network to deduplicate completions by the same person, not enough to identify them or to correlate them across publishers.
Networks also never receive an email address, a name or any contact detail. We do not hold those for end users in the first place.
Hosting
The application and its database are operated by AESHA Technology Services Limited on infrastructure under our control. No end-user data is stored with a third-party analytics, profiling or advertising platform — ZerAds, above, sees a viewer's connection when its ad frame loads, and receives nothing from our database.
What is not on this list, deliberately
- No analytics provider. The dashboards are built from our own database — the clicks and conversions the platform already records in order to pay people.
- No advertising or retargeting pixel anywhere on the site or the wall — the ZerAds display frame listed above is an ad, not a tracking pixel, and is the only one.
- No customer data platform, tag manager or session recorder.
Direct advertisers
Advertisers who book campaigns with us directly are not subprocessors. They receive our click identifier so they can report a conversion back, and nothing else. What a user chooses to give an advertiser on the advertiser's own site is between them, under that advertiser's own privacy policy.