CDNShark Policies

Privacy Policy

Last updated: Jul 29, 2026

This Privacy Policy explains how Nath Network & Telecom Inc. (“CDNShark”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal information when you use our websites, dashboards, and services (the “Services”). It should be read together with our Terms and Conditions and, where applicable, our GDPR Privacy Statement.

Our role. We act as a controller for information about our own customers and website visitors — for example account, billing, and support data. When we deliver traffic, present bot Challenges, verify CAPTCHA tokens, or carry tunnel traffic for a customer’s website or application, we act as a processor on that customer’s behalf, and the customer is the controller. If you are an end user of a site that uses CDNShark, please refer to that site operator’s own privacy notice.

1. Information We Collect

• Account information — name, email address, username, password (stored in hashed form), and organization details you provide at registration.
• Billing information — billing address and transaction records. Card and payment details are handled by our third-party payment processors; we do not store full card numbers.
• Service usage and technical data — logs relating to your use of the CDN, DNS, storage, hosting, and streaming services, including IP addresses, request metadata, bandwidth and resource usage, timestamps, and error diagnostics.
• End-user data processed on your behalf — when we deliver, cache, or route traffic for your websites and applications, we may process data (such as visitor IP addresses and request details) on your behalf as a processor.
• Bot protection data — where a customer enables a JavaScript Challenge or “Under Attack” mode, we process the visitor’s IP address and browser user-agent string at the edge in order to decide whether to present a Challenge and to issue and validate a clearance cookie. See section 4.
• CAPTCHA data — where SharkCaptcha is used, we process the requesting IP address for rate-limiting and abuse prevention, the site key involved, and the challenge token presented for verification. We also maintain an aggregate count of successful solves per site. See section 4.
• Private Origin Tunnel data — for each connector you enroll we record technical and connection metadata, including hostname, operating system, architecture, connector version, public key, enrollment and last-seen timestamps, and the public IP address the connector connects from, together with session records and aggregated transfer volumes. See section 4.
• Support communications — tickets, chat messages, and correspondence with our support team, including interactions with our AI support assistant.
• Cookies and similar technologies — used to operate the site, keep you signed in, secure traffic, and understand usage.

2. How We Use Information

• To provide, operate, secure, and improve the Services;
• To authenticate you and manage your Account;
• To process payments, invoicing, and renewals;
• To provide support and respond to your requests;
• To distinguish automated traffic from human visitors, apply rate limits, and mitigate denial-of-service and other attacks;
• To establish, maintain, and meter tunnel connections between your infrastructure and our network;
• To monitor for abuse, fraud, security threats, and violations of our Acceptable Use Policy;
• To send service-related and, where permitted, marketing communications;
• To comply with legal obligations and enforce our agreements.

3. Cookies and Similar Technologies

We use strictly necessary cookies to run the Services (for example, session and authentication cookies) and may use analytics cookies to understand and improve usage. You can control cookies through your browser settings; disabling certain cookies may affect functionality.

In addition, where a customer has enabled bot protection on a hostname, our edge sets a security cookie named cdn_clearance in the visitor’s browser, scoped to that customer’s domain. This cookie records that a Challenge was completed successfully so the visitor is not repeatedly challenged. It is cryptographically signed rather than a stored identifier, is bound to a truncated form of the visitor’s IP address and a hash of the user-agent string, and expires after a short period — approximately 30 minutes in JS Challenge mode and 5 minutes in Under Attack mode. It is set for security purposes and is not used for advertising, profiling, or cross-site tracking.

4. Security and Connectivity Features

The following features process data about visitors to our customers’ sites, or about our customers’ own infrastructure. Where they operate on a customer’s traffic, we act as a processor for that customer.

4.1 Bot Protection and JavaScript Challenge

Bot protection is off by default and is enabled by a customer on a per-hostname basis. When enabled, page requests may be served an interstitial that asks the visitor’s browser to complete an automated proof-of-work computation before the request continues. Only page navigations are challenged.

To make that decision and to issue clearance, we process the visitor’s IP address and user-agent string, and we set the cdn_clearance cookie described in section 3. Customers may configure IP addresses that bypass the Challenge, and may optionally exempt verified search-engine crawlers, which are checked against published crawler IP ranges rather than by user-agent alone. We do not use bot protection data to build visitor profiles or to track visitors across unrelated sites.

4.2 SharkCaptcha

SharkCaptcha is a CAPTCHA that customers may embed in their own websites and applications, and that we also use on our own sign-in, registration, and password-reset forms. The widget issues a short-lived, cryptographically signed challenge; the visitor’s browser solves it computationally; and the resulting token is verified server-side. Tokens are valid for a short period, are single-use, and are not linked to a persistent identifier.

SharkCaptcha does not require a cookie, does not track visitors across sites, and does not collect biometric data, mouse-movement recordings, or device fingerprints. We process the requesting IP address to rate-limit challenge issuance and prevent abuse, and we maintain aggregate solve counts for each site for billing and operational purposes.

4.3 Private Origin Tunnel

The Private Origin Tunnel carries traffic between a connector that the customer installs on their own infrastructure and our tunnel gateways over an encrypted connection. Because the tunnel terminates on our network, traffic published through it passes through our gateways and, where applicable, our edge servers, in the same way as other traffic we deliver for that customer.

For each connector we record the technical and connection metadata listed in section 1, including the public IP address the connector connects from, so that we can operate, secure, troubleshoot, and meter the service. We record per-session connection records and hourly aggregated transfer volumes for billing and capacity planning. Enrollment tokens are stored only in hashed form, and access secrets configured on a route are encrypted at rest.

5. How We Share Information

We do not sell your personal information. We may share it with:

• Service providers — payment processors, infrastructure and network providers, and other vendors who process data on our behalf under appropriate confidentiality and data-protection obligations;
• Legal and safety — authorities or third parties when required by law, to respond to legal process, or to protect the rights, property, or safety of CDNShark, our customers, or the public;
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

6. Data Retention

We retain personal information for as long as your Account is active and as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Logs and diagnostic data are retained for a limited period consistent with operational and security needs, after which they are deleted or anonymized.

Security and connectivity data is short-lived by design: clearance cookies and CAPTCHA tokens expire within minutes and are not retained as records; edge request logs are retained for a limited period; and tunnel connection records and aggregated usage are retained for as long as needed to operate the service, support billing, and investigate abuse.

7. Security

We implement technical and organizational measures designed to protect personal information against unauthorized access, loss, or misuse, including encryption in transit and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. International Transfers

We operate a globally distributed network, and your information may be processed in countries other than your own. Traffic is generally handled by the edge, gateway, or tunnel location nearest the visitor or connector, which may be outside your country of residence. Where required, we implement appropriate safeguards for such transfers, as described in our GDPR Privacy Statement.

9. Your Rights

Depending on your location, you may have rights to access, correct, delete, or restrict the processing of your personal information, to object to processing, and to data portability. To exercise these rights, contact us using the details below. Residents of the EEA or UK should also see our GDPR Privacy Statement. Where we process data on behalf of a customer as a processor, we will refer your request to that customer.

10. Children’s Privacy

The Services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us so we can delete it.

11. Third-Party Sites and Content

The Services may link to or interoperate with third-party sites and services. We are not responsible for their privacy practices, and we encourage you to review their policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by additional notice.

13. Contact Us

For privacy questions or to exercise your rights, contact us at legal@cdnshark.com.