Privacy policy

AESHA Technology Services Limited · Last revised 7 October 2026 · All legal documents

Who holds this data

AESHA Technology Services Limited, registered in Seychelles under CRN 210193, at 1032 Office House of Francis Ilu de Port, Mahe, Seychelles (SC). Privacy questions and data subject requests go to [email protected].

Publishers who need a processor agreement should read the data processing addendum, which covers end-user data specifically, and the subprocessor list. Cookies have their own policy.

Two kinds of person

Account holders — publishers, advertisers and our own staff — have an account with us. End users are a publisher's users, who see an offerwall but have no account here. We hold very different data about each.

Account holders

We store a username, an email address, a password hash, and the company details you enter. We log sign-ins with an IP address and a browser string so you and we can spot an account being used by somebody else.

End users

We store only what is needed to attribute a reward:

• the identifier the publisher chose for them — we never ask for a name or an email
• a one-way hash of that identifier, used as the database index
• an opaque token derived from it, which is what advertising networks see
• the IP address, user agent, country and device of each click
• which offers were opened and which were completed

The identifier is a publisher's own. If it happens to be personal data, that is the publisher's choice and their responsibility — we ask publishers not to send one.

Who we share it with

Advertising networks receive the opaque per-user token, the user's IP address and their user agent, because an advertiser has to be able to detect their own fraud. They do not receive the publisher's identifier. Publishers receive conversions for their own users only.

Advertisers who pay by card or PayPal first verify their identity with Didit, which receives a photo of their identity document and a selfie. We receive Didit's decision, not the images. Card payments are taken on Payzink's checkout; we never see the card number.

A Traffic Task opens the advertiser's website in a new tab. That site gets what any site gets from a visitor — the IP address, the browser, and offerwall.gg as the page the visit came from — and may set its own cookies. It never gets the publisher's user id. The task page itself sets no cookies.

Fraud screening

The first time an end user opens a publisher's offerwall, we may check their IP address with IPQualityScore, which answers with a fraud score and whether the address belongs to a VPN, a proxy, Tor or a bot. We keep that answer on the user's record. If the score is too high, or the address is one of those, the user is blocked from earning on that publisher's wall: offers do not open and completions are not credited. Each user is checked once per publisher, not on every visit. The check is currently switched off; scores taken while it was on are still kept.

That block is an automated decision with a real effect, so a person will look at it on request. Ask through the Help page inside the offerwall, or through the contact form with the publisher's name. Staff can see the score and the reason, and can lift the block.

Cookies

The site uses a session cookie for signed-in accounts and a signed "remember me" cookie if you ask for one. The offerwall itself sets no cookies — it is identified entirely by the URL, which is why it works inside an iframe with third-party cookies blocked. The ZerAds display ad at the bottom of the wall and on the blog is a frame served by ZerAds, which may set its own cookies inside it; see the subprocessors.

How long we keep it

Clicks and conversions are kept as long as they might be disputed or audited. Accounts are kept until deleted on request.

Your rights

Ask us for a copy of what we hold about you, or ask us to delete it, through the contact form. If you are an end user of a publisher's app, ask that publisher first — they hold the identifier that connects you to anything we store.