This policy describes what the Guard bot-protection service processes
about visitors when g.js runs on a site that embeds it or when
a request is evaluated by Guard. It explains what is collected, why it is
collected, who it is shared with, and the choices and rights that may apply
to you.
The Guard service — including the client script, the request- evaluation backend, and the operator control panel — is operated as a centrally hosted service by PRISM.GG Limited (“PRISM.GG”). The site you were visiting uses that central instance under contract with PRISM.GG; it does not self-host the service.
The script exists to distinguish automated traffic (bots, scrapers, abuse tooling, credential-stuffing systems, spam, fraud, and other misuse) from human visitors. Guard is used for network and information security, fraud prevention, service integrity, abuse investigation, and security tuning. It does not serve advertising, marketing analytics, A/B testing, or behavioural advertising.
To make a reliable human-versus-automation decision, Guard processes technical and security signals exposed by your browser or transmitted with the protected request. These signals are generally pseudonymous technical identifiers. They are not intended to identify you by name, but they can be personal data where privacy law treats device, network, cookie, or online identifiers as personal data. The categories are:
For security and integrity reasons the exact scoring rules, thresholds, and relative weighting of these signals are not published.
g.js. A site operator should not include those values
in Guard tokens or forwarded request bodies unless needed for its own
security use case and disclosed in its own privacy notice.g.js.Where the GDPR or UK GDPR applies, visitor processing is performed under legitimate interests (Art. 6(1)(f)) for network and information security, fraud prevention, service integrity, and abuse prevention, as recognised in Recital 49. Where Guard processes data on behalf of the site operator, the site operator determines the applicable legal basis for its own use of Guard.
Where local law requires prior consent or another condition for device fingerprinting, cookies, local terminal equipment access, or similar technologies — including the ePrivacy Directive as implemented in the EU/EEA, PECR in the United Kingdom, or equivalent laws elsewhere — the site operator embedding Guard is responsible for satisfying that requirement before Guard runs.
Guard requests may include cookies scoped to the site or Guard endpoint
where browser rules allow. Guard may also set a site-scoped security cookie
to recognise repeated visits and detect account or session misuse. That cookie is
HttpOnly, Secure, SameSite=None, and
may remain for up to one year unless deleted earlier by the browser, the
site operator, or PRISM.GG.
The visitor script does not use browser local storage for Guard visitor data. Temporary in-memory values may exist while the page is open to complete security checks.
Guard retains visitor records only as long as necessary for security decisions, abuse investigation, fraud prevention, debugging, service integrity, legal compliance, and detection tuning. Some short-lived security data expires automatically. Other request, cookie, risk, and operational records may be retained for a longer operational period because they are used to detect repeat abuse and cross-request patterns.
Unless a site operator's contract, an active security investigation, legal obligation, backup lifecycle, or service-integrity need requires a different period, Guard visitor request records are retained for no longer than 90 days. Site-scoped Guard cookie records may be retained for the life of the cookie and a reasonable period after last use where needed to detect misuse. Aggregated, de-identified, or statistical security data may be kept longer where it no longer identifies a visitor.
For the data processed through this script:
Data processed through Guard is not sold, is not shared for cross-context behavioural advertising or targeted advertising, is not used to build advertising or marketing profiles, and is not shared with advertising networks or data brokers.
PRISM.GG Limited is established in the United Kingdom. Data processed through the Guard service, and through hCaptcha, may be processed in the United Kingdom, the European Economic Area, the United States, and other jurisdictions where the relevant sub-processors operate. Transfers out of the UK/EEA rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or equivalent safeguards under Article 46 GDPR, together with any supplementary measures assessed as appropriate.
Depending on the law that applies to you, including California and other US state privacy laws, the categories of personal information processed by Guard may include identifiers, internet or other electronic network activity information, approximate location inferred from IP address, and inferences used only for security, fraud-prevention, and abuse-prevention purposes. Guard does not intentionally process sensitive personal information for the purpose of inferring characteristics about you.
PRISM.GG does not sell Guard visitor data and does not share it for cross-context behavioural advertising. Guard visitor data is disclosed only to the site operator, PRISM.GG service providers and sub-processors, and where required for security, legal compliance, or protection of rights.
Depending on your jurisdiction you may have rights of access, rectification, erasure, restriction, portability, and objection, and the right not to be discriminated against for exercising privacy rights. You may also have the right to opt out of sale, sharing, or targeted advertising; Guard does not sell visitor data or share it for targeted advertising. You may have the right to lodge a complaint with a supervisory authority (in the United Kingdom, the Information Commissioner's Office). As the controller, the site operator is the primary point of contact for exercising rights about its use of Guard. PRISM.GG Limited will support the site operator in responding, and will handle requests directed to it in its own controller capacity (see Section 6).
To request erasure of data held about you in the Guard service, email [email protected]. Because the service does not hold direct identifiers such as your name or email address, your request must include an identifier that allows your records to be located, for example:
Requests without a sufficient identifier cannot be actioned, because PRISM.GG cannot otherwise link records to you without disproportionate effort (Article 11 GDPR). PRISM.GG may ask for reasonable additional information to verify the request before acting on it.
The script is not directed at children and does not knowingly collect data from children for advertising or profiling. Guard may still process technical security data from a request if a child visits a site protected by Guard, because the processing is tied to site security rather than to the visitor's age.
Material changes to this policy will be reflected in the “Last updated” date above. Continued operation of the script after a change constitutes notice of the updated terms.
For requests concerning your personal data in the first instance, contact the operator of the site you were visiting when this script ran; they are the controller for their use of Guard (Section 6).
For matters concerning the Guard service itself, contact:
PRISM.GG Limited
Privacy enquiries: [email protected]
Data access / erasure requests: [email protected]