Last updated: 1 October 2026
Privacy at InstantBlock
This notice covers the InstantBlock website, account and browser-verification service. The broader InstantNode Privacy Policy also applies to InstantNode account, billing and support relationships. A customer using InstantBlock on another website must give its visitors its own notice about that deployment.
Who is responsible
Ben Oliver Mallow, trading as InstantNode, Sickinger Strasse 7, 55758 Sien, Germany, contact@instantnode.eu, is responsible for InstantBlock's own website, accounts and service-security processing. A customer that chooses to check visitors to its site generally determines that site's purposes and must identify its own privacy contact. InstantNode may act as a processor for visitor verification where an appropriate Article 28 GDPR agreement applies; the parties' roles and instructions should be confirmed in that agreement.
What a verification may collect
When a protected page starts InstantBlock, the browser may provide a site identifier, request time, browser and device characteristics, and interaction signals. These can include user agent, language, time zone, screen and hardware characteristics, browser capabilities, canvas/WebGL/audio/font signals, storage and media-device availability, automation indicators, and network or connection information. The service may calculate a device fingerprint from these signals. A fingerprint or customer-supplied user ID can identify or single out a device or person over time and is treated as personal data where applicable.
Verification can also use pointer, keyboard, scroll and touch behavior. By default, an additional recorder runs from the start of verification throughout the active protected-page session, including after the verification result, for up to 12 hours. It records bounded samples of pointer positions normalized to the viewport, pointer type and pressure, click and key press/release timing, scroll activity, focus and visibility changes, navigation-event categories, input-method categories, resource loading timings and sizes, long tasks, network changes and error categories. Timing is rounded to 10-millisecond steps. It does not record typed characters, key names, form values, clipboard contents, DOM selectors, page URLs, cookies, browsing history, error messages or stack contents. Password and payment autocomplete fields, and elements marked private by the customer, are excluded from this additional recorder.
Nonempty telemetry batches are encrypted in the browser and uploaded periodically, normally every 15 seconds, and at events such as page hiding or closure. Telemetry files are also encrypted at rest. Interactive challenges can separately record bounded movements, taps or clicks and timing within the challenge area, with positions normalized to that area. Records include the server's verification decision and references that allow related challenge outcomes to be reviewed. The extra telemetry uploads are currently used for diagnostics, pattern analysis and preparation for future classifier development; they do not change the visitor's verification score. The customer can disable or stop the additional page recorder and can optionally send its own user identifier. InstantBlock stores decisions, scores, reasons and relevant signals so that a customer can review the result and the service can recognize repeat activity on that same customer site.
We process the request IP address to receive and secure the connection. Security records may contain an IP-derived hash. For verification and challenge telemetry, a site-specific keyed hash of the request IP lets us count activity from a shared address within that customer's site; the raw IP is not stored in those telemetry files. The hash remains pseudonymous data and may still be personal data. Where WebRTC checks are available, the browser may also discover its public network address through a STUN request and compare it with the request address for aggregate network diagnostics. A difference does not lower the verification score or trigger a challenge. If no usable result is available, the comparison is skipped. The WebRTC request currently uses Google's public STUN endpoint at stun.l.google.com:19302. Google can receive the public source IP and connection metadata for that request.
Why it is used and the legal basis
Verification signals are used to detect automated abuse, decide whether to accept, challenge or reject an attempt, protect customer sites, diagnose errors and let customers review outcomes. Device history is used within each customer's site to distinguish repeated activity; it is not used to recognize a visitor across different customer sites. Records created under an earlier cross-site scheme are no longer consulted for recognition and are removed under the retention schedule below.
For InstantNode's own accounts and contracted service, processing needed to provide the service is based on Article 6(1)(b) GDPR. We rely on Article 6(1)(f) GDPR, subject to a balancing of interests, for our own security and abuse prevention, and Article 6(1)(c) where a legal obligation applies. For checks that a customer deploys on its site, that customer must determine and explain its own GDPR basis. Browser fingerprinting and device access may also require consent under applicable ePrivacy rules unless a narrow necessity exception applies. The site owner must assess that question and obtain consent where required; this notice does not make every deployment exempt.
Automated decisions and review
InstantBlock automatically compares signal consistency, activity patterns and site-scoped history to produce a risk decision. A site may use that decision to let a request through, ask for another check or deny it. The site operator chooses the protected action and should provide a way to contest mistakes or obtain human review where required. If an automated outcome affects you on a customer site, contact that site's operator first; we will assist with a request relating to data we process for that operator.
How long data is kept
Verification records in active storage, including raw checks, challenge interaction and telemetry traces, site-scoped IP grouping, per-user histories and related security statistics, are scheduled for deletion in the daily cleanup once they are more than 90 days old. A site-scoped device profile, including its fingerprint, environment snapshot and limited activity history, is scheduled for deletion once it has not been seen for 90 days; continued activity can extend that profile's lifetime. Older profiles from the previous cross-site scheme are not used for new matching and are removed under the same schedule. Account and site-configuration records remain while needed to operate the account or service, subject to legal and contractual obligations. Separate infrastructure logs and backups follow their own operational or legally required retention and are not part of the 90-day verification-record window.
Who can receive the data
Authorized InstantNode personnel and the customer controlling the protected site can access the verification results relevant to that site. Hosting and network providers process data needed to operate the service. A browser WebRTC check can contact the Google STUN service described above. Information can also be disclosed where law requires it or to establish or defend legal claims. We do not sell device fingerprints or use them for advertising.
Cookies and browser storage
The InstantBlock account uses a 14-day ib_sid session cookie for sign-in. A theme choice is saved in local storage until changed or cleared. Verification may briefly test cookie, local/session storage and IndexedDB availability; test values and the empty IndexedDB probe are removed after use where the browser permits. Some verification or documentation flows keep a token in session storage for the tab. Details are on our Cookie Policy. These technical checks do not remove any consent requirement that may apply to a customer's deployment.
Your rights and contact
Subject to the applicable law, you may ask for access, correction, erasure, restriction or portability of your data; object to processing based on legitimate interests; or withdraw consent where consent is the basis. You can complain to a competent data protection authority. Write to contact@instantnode.eu. If the check happened on another company's site, identify that site and contact its operator as well, because it determines the deployment and can identify the relevant attempt.