OpenBait

Privacy Policy

What personal information OpenBait collects, how it is used and shared, and how to exercise your rights.

Last updated: October 2026

This is an English translation of the Japanese original. If the two differ, the Japanese version governs.

OpenBait ("we") takes your privacy seriously. This policy explains how we collect, use, disclose and protect personal information.

Information we collect

Information you give us

When you use the service, we may collect:

  • Account information: name, email address, company name
  • Contact information: what you give us when you contact support
  • Payment information: the billing details needed to process payment (handled securely by a third-party payment processor)

Information collected automatically

When you use the service, we may automatically collect:

  • Usage data: access times, pages viewed, features used
  • Device information: browser type, operating system, IP address
  • Cookies and similar technologies: used to improve the experience and the quality of the service
  • SDK telemetry: from websites where the JS SDK is installed, the domain name, the referrer, form events (not what was typed), and a browser fingerprint

Data collected by the SDK

The OpenBait JS SDK collects the following to detect phishing attacks:

  • the hostname, URL and title of the page the SDK is on
  • the referrer (the URL the visitor came from)
  • the user agent and load timing
  • a session ID stored in the browser's localStorage (no cookies)
  • form events (only whether a form was submitted and whether it had a password or email field; the values typed are never collected)
  • a device fingerprint (time zone, browser language, platform, CPU core count, device memory, touch points, screen size, color depth, device pixel ratio, connection type, and the GPU renderer and vendor read through WebGL)
  • when a canary token (copy detection) fires: the page and domain it was loaded from, the IP address and the approximate location derived from it, the user agent (browser and OS), and the request headers. It does not fire on domains you have registered as your own

The fingerprint is sent on events that matter for detecting phishing, such as a login form being submitted. It is sent from the legitimate site where you installed the SDK too, not only from phishing sites.

This data is used only to detect phishing. It is not used for advertising and not sold to anyone. Installing the SDK is optional; the report page does not need it.

Public third-party information collected to monitor impersonation

To detect impersonation, we automatically collect information that third parties (not you) have made public, and compare it with your brand:

  • Social media accounts (YouTube, X, TikTok, Instagram): public profile information such as username, display name, profile picture, bio and follower count
  • Websites: the content of lookalike domains and reported URLs, screenshots, and DNS, certificate and registration (WHOIS / RDAP) data
  • Namespaces on business services: whether a workspace using your name exists on external services such as Microsoft 365, Okta and Shopify

This information is used only to detect impersonation and to respond to it (reporting and preserving evidence).

Abuse monitoring

On Free plan accounts, we take these measures against abuse:

  • API rate limits and anomaly detection
  • detecting and limiting automated bulk requests
  • monitoring unusual account-creation patterns

How we use information

We use the information we collect to:

  • Provide the service: run and maintain the OpenBait platform
  • Improve the service: analyze usage and improve the product
  • Keep it secure: detect and prevent fraud and abuse
  • Support you: answer questions and requests
  • Tell you about updates: important service updates and security notices

How we share information

We do not sell your personal information. We share it only:

  • With service providers: third parties that help run the service (hosting, email delivery, payment processing, error monitoring, AI processing for page analysis by Google's Gemini API, and so on). The list of sub-processors is on the Security page
  • For legal reasons: when the law requires it or to respond to lawful legal process
  • In a business transfer: in a merger, acquisition or sale of assets

Data security

We take appropriate technical and organizational measures to protect your information:

  • All traffic is encrypted with HTTPS (TLS 1.2 or higher)
  • Sign-in sessions are held in encrypted tokens (JWE, AES-256-GCM)
  • Access to the production server and admin tools is limited to the operators
  • We carry out internal security reviews and fix what they find

Questions about our controls, including third-party testing, are answered in your security questionnaire on request. The details of how we operate are on the Security page.

Data retention

We keep personal information only as long as needed for the purposes in this policy. When it is no longer needed, we delete or anonymize it securely.

For support and security, we keep console activity records (the pages and features you open, IP address, and browser type) for one year and server access logs (IP address, access time, and browser type) for 180 days, and then delete them automatically. Console activity records are deleted when you delete your account.

Your rights

Depending on the law that applies to you, you may have the right to:

  • Access: ask for access to the personal information we hold about you
  • Correction: ask us to correct inaccurate information
  • Deletion: ask us to delete your personal information
  • Data portability: ask for your data in a machine-readable format
  • Objection: object to certain kinds of processing

To use any of these rights, email contact@openbait.com.

Cookies

We use cookies and similar technologies to:

  • keep you signed in
  • remember your settings
  • analyze how the service is used
  • improve the experience

When you arrive from an ad or a tagged link, a first-party cookie records where you came from (the ad click ID and campaign parameters). If you sign up, we save it with your account to learn which channels work. We do not share it with third parties.

You can manage cookies in your browser settings.

Children's privacy

The service is not intended for anyone under 16. We do not knowingly collect personal information from minors.

International data transfers

Your information may be transferred to and stored on servers outside the country where you live. We make these transfers in line with the data protection laws that apply.

Changes to this policy

We may update this policy from time to time. We will post the updated policy on this page with its last-updated date.

Contact

For questions about this policy, contact:

Thank you for trusting OpenBait.