Privacy Policy
Last updated 16 October 2026.
This Privacy Policy explains what personal data CaptchaNo ("we", "us") collects when you use captchano.com, the dashboard and the API (the "Service"), why we collect it, and the choices you have. We do not sell your personal data and we do not use it for advertising.
1. Data we collect
- Account data — your email address, a salted hash of your password (we never store the password itself), and whether and when your email was verified.
- API keys — a one-way hash of each key, the first characters of the key so you can recognise it, an optional label you give it, and when it was created, last used or revoked. We cannot recover a lost key.
- Usage data — for each solve request: an id, the challenge type, the status, any error code, the price charged, the solve duration and timestamps, and which of your keys made it.
- Request content — the page URL, sitekey, proxy details, user agent, image and other fields you send with a request are used to perform that solve. We do not keep them in our database after the solve completes. A returned solution is kept for up to ten minutes so you can retrieve it, then deleted.
- Billing data — top-up amounts, dates, payment provider and the provider's transaction reference. Card details are collected and stored by our card processor, not by us. Crypto payments are processed by our crypto payment processor.
- Security and anti-abuse data — IP address, approximate country, browser user agent and a device signal derived from request headers, recorded at signup, sign-in and session creation, and records of failed sign-in attempts. We use these to protect accounts and to stop people claiming trial credit more than once.
- Communications — emails you send us and the replies.
2. How we use it
- To provide the Service: authenticate you, perform solves, keep your balance and show you usage.
- To process payments and keep accurate financial records.
- To prevent fraud and abuse, including duplicate accounts, trial abuse, stolen payment methods and breaches of our Acceptable Use Policy.
- To send transactional email such as address verification, receipts and security notices. We do not send marketing email without your consent.
- To answer support requests and comply with legal obligations.
Where the GDPR or UK GDPR applies, our legal bases are performance of our contract with you, our legitimate interests in securing the Service and preventing abuse, compliance with legal obligations, and your consent where we ask for it.
3. Who we share it with
- Service providers who host and operate the Service for us — cloud hosting, database and email delivery providers, and the infrastructure that performs solves — each limited to what they need to do that work.
- Payment processors — our card processor and our crypto payment processor receive what they need to take your payment and prevent payment fraud.
- Authorities — when the law requires it, or where necessary to protect the rights, property or safety of CaptchaNo, our users or others.
- A successor — if CaptchaNo is involved in a merger, acquisition or sale of assets, subject to this policy.
Some of these providers process data outside your country. Where required, we rely on appropriate safeguards such as standard contractual clauses.
4. Retention
- Returned solutions: up to ten minutes after the solve completes.
- Sign-in sessions: until they expire or you sign out.
- Failed sign-in and rate-limit records: a short rolling window.
- Account, key and usage data: for the life of the account and up to 90 days after it is closed.
- Billing records: as long as tax and accounting law requires, typically up to seven years.
- Records needed to prevent repeat trial abuse may be kept after an account is closed, for as long as they are needed for that purpose.
5. Cookies
We use one essential cookie, cn_session, to keep you signed in. It is HTTP-only and secure. We do not use advertising or cross-site tracking cookies.
6. Security
Data is encrypted in transit with TLS. Passwords and API keys are stored only as one-way hashes, and session tokens are hashed before storage. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant regulator where the law requires.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. California residents have the rights described on our Do Not Sell or Share page. To exercise any right, email privacy@captchano.com from the address on your account. We respond within 30 days. You may also complain to your local data-protection authority.
8. Children
The Service is not intended for anyone under 18 and we do not knowingly collect their data. If you believe a minor has created an account, contact us and we will delete it.
9. Changes
We will update the "Last updated" date when this policy changes and notify account holders by email for material changes.