Keitaro's new Terms of Use, published on September 29, take effect on October 13. Keitaro is a self-hosted tracker, and people install it on their own servers precisely to keep control of their infrastructure. Under the new terms, though, the tracker sends the developer data about your installation, including domains and campaign names, and you can't turn it off.
What Keitaro collects
The terms call it "Operational Telemetry" (clauses 2.c and 9.d). It includes:
- the installation identifier (machine_id);
- IP addresses of your server infrastructure;
- domain names configured in the tracker;
- the names you give to campaigns, offers and flows;
- license activation and validation signals, plus technical configuration metadata.
According to the company, telemetry does not include creatives, traffic data, targeting parameters or any end-user data.
You can't opt out
Under clause 4.j, users may not block, filter, falsify or otherwise circumvent telemetry transmission. Deliberate blocking is a material breach of the agreement. If data stops flowing because of a technical failure, the company has to notify you and give you 7 to 14 days to restore it. The same applies to tampering with license key validation.
Who the data can be shared with
- Government, courts and law enforcement. Under clause 9.e, the company reserves the right to comply with legitimate requests from authorities, which may include disclosing user data.
- Cross-installation matching. Telemetry may be correlated with data from other installations to detect policy violations and sanctions circumvention (clause 9.d).
- Retention is up to 2 years, or up to 3 years in cases of suspected violations, fraud or sanctions issues.
KYC, source of funds and suspension on suspicion
Keitaro can request KYC/KYB checks at any time, along with documents on your source of funds and the ultimate beneficial owners of the ad campaigns you track (clauses 6.b, 6.c, 10.g). You get 7 days to respond, with one possible 7-day extension. If verification isn't completed within 14 days, the license can be terminated.
The license can be suspended immediately and without notice if the company has a "reasonable suspicion" (clause 15.b). It doesn't have to prove a breach or explain its reasons (clause 15.e), and the contract gives you no right to appeal (clause 15.f). If the license is terminated for a breach, fees are non-refundable (clause 15.h). The terms do say that suspicion alone is enough for suspension but not for permanent forfeiture (clause 15.i), and under GDPR you can request human review of an automated decision.
What it means for affiliates
Your traffic and user data stay with you, which is good news. But metadata is sensitive in affiliate marketing too: domain lists, server IPs and campaign names, which often encode offers, GEOs and traffic sources. That data is stored by the company for years and can be handed over at the request of authorities.
- Read the full terms before October 13: continuing to use the tracker means you accept them. The governing law is Estonian (Apliteni OÜ, Tallinn).
- Don't try to block telemetry with a firewall or patches: that's a direct breach and risks losing your license with no refund.
- Name campaigns and offers neutrally, using codes or internal IDs without brands, GEOs or sources in the name, and keep the key on your side.
- If privacy of your domains and setup is critical, compare other trackers' terms before renewing your license.
For white-hat businesses these changes may mean little. But for anyone who chose a self-hosted tracker to keep their infrastructure fully private, the rules of the game have changed.