Privacy
Back to boxes →Who runs this site
ClickABox and StupidBox are operated by Luis Martins, Portugal. For privacy questions or requests, email accounts@clickabox.click.
This notice covers both brands and their domains. Updated: 7 October 2026.
What a referral click records
Opening a referral box sends its ID, the domain you entered through and the referring website’s origin, when available, to our own endpoint. The server adds the time. The origin contains only the scheme, hostname and optional port; paths, query strings and fragments are discarded.
The click database stores no IP address, user agent, account, browser identifier or visitor ID. We use these records to count referral activity and check that links and domains work. We do not build visitor profiles or send this database to partners.
Cookies and browser storage
This site sets no analytics or advertising cookies and loads no third-party analytics. SHUFFLE uses session storage to remember your chosen box order in the current browser session. It is replaced when the daily order changes and is not sent to us. You can clear it using your browser’s controls.
Hosting, email and partner sites
SiteGround hosts the site. Its access and security logs can include IP addresses, requested URLs, timestamps, referrers and browser information, separately from our click database. SiteGround documents access-log archives for the previous 30 days; other security records follow its own retention policies.
If you email us, we receive your email address, message and any information you include. SiteGround, MailBridge and Google handle delivery or storage of that correspondence. Their services can involve processing outside your country under their applicable privacy and transfer arrangements. See SiteGround, MailBridge and Google.
Following a referral opens an independent provider’s website. Its privacy and cookie policies apply there, including any tracking it uses to attribute referrals. We do not control those policies.
Why we process information
Where personal data is involved, we rely on legitimate interests under Article 6(1)(f) GDPR to operate and secure the site, measure limited referral activity and answer messages. These purposes use limited data, no visitor identifiers and no advertising profiles. Information necessary to handle a legal obligation or rights request is processed under Article 6(1)(c), where applicable.
Providing information by email is voluntary. We need a return address if you want a reply. There are no accounts, automated decisions or profiling on this site.
How long we keep it
The click database uses a 30-day retention window. Older entries are deleted on the next successful tracking request or when we run maintenance; cleanup is not a continuously running timer. Session storage lasts only for the browser session and the current daily order.
We keep correspondence for as long as needed to answer and resolve your request. A record needed for a legal obligation or dispute is kept only for that purpose and the applicable period. Hosting and email providers manage their own logs and backup lifecycles under their policies.
Your rights
Email accounts@clickabox.click to request access, correction, deletion, restriction or portability where applicable, or to object to processing based on legitimate interests. We respond within one month; if a lawful extension is needed, we explain it within that month.
Our click records have no visitor identifier, so we may be unable to link a record to you. We do not collect additional tracking identifiers just to identify visitors. Please send only the information necessary for your request, never passwords or payment details.
You can also complain to the Portuguese supervisory authority, CNPD, or your local data-protection authority.