Privacy Policy

1. Who we are and how to reach us

Adferry Inc. ("Adferry", "we", "us") operates an ad server for CTV and video. Registered address: 651 N Broad St, Middletown, Delaware 19709, United States. For any privacy matter, including requests to exercise your rights: our contact page, or by post to the address above, marked "Privacy".

2. Scope: two privacy surfaces

• This website (adferry.co and its pages). Adferry is the controller of personal data collected here.
• The Adferry platform. When a publisher or advertiser (a "Customer") uses our platform to serve ads, we process data about the people who see those ads on the Customer's behalf and instructions. For that data Adferry is a service provider or processor under U.S. state privacy laws (and a processor under other laws where they apply); the Customer is the business or controller and its privacy policy governs. Section 5 explains what that processing involves; Section 13 explains how to opt out; the Data Processing Addendum is the contract that governs it.

3. This website: what we collect and why

We do not collect sensitive or special-category data through this website, and we ask you not to include any in free-text fields.

4. Cookies and similar storage

Our Cookie Policy lists every cookie and local-storage entry, who sets it, and for how long. In short: one necessary local-storage entry remembers your banner choice; analytics cookies are set only after you click "Accept analytics"; the call-booking widget on the Contact page is provided by Calendly; and "Cookie preferences" in the footer lets you change your mind at any time. Fonts are served from our own domain, so visiting this site does not send your IP address to a font provider.

Browser signals. We honour Global Privacy Control (GPC) signals on this website as a request to opt out of any sale or sharing and, where analytics consent has not been given, as a decline. Because there is no common standard for the older "Do Not Track" (DNT) header, this website does not respond to DNT signals.

5. The ad server platform

When a Customer runs inventory or campaigns through the platform, each ad request carries technical data about the device and context. We process it to do the job the Customer hired us for, and nothing else.

5.1 What an ad request may contain

• IP address, used for approximate geolocation (country or region) and invalid-traffic detection, truncated or hashed where the Customer's configuration requires it
• User agent, device type, operating system, app bundle or site domain, player size
• An advertising identifier provided by the device platform, only where the device has not opted out
• Consent and opt-out signals passed by the Customer on the request
• Ad event data: whether the ad was served, rendered, played and for how long, and any error

5.2 What we do with it

• Decide which ad to serve and at what price
• Measure delivery: impressions, quartiles, completions, errors
• Filter invalid traffic before the auction
• Apply frequency caps within a time window
• Keep a per-request record so the Customer can see what happened to each request, and so invoices are computed from measured impressions

5.3 What we do not do

• Build cross-site or cross-app profiles of individuals for our own purposes
• Sell personal data, or "share" it for cross-context behavioural advertising as defined by US state laws
• Operate our own demand or resell a Customer's supply
• Use platform data for any purpose the Customer has not instructed

6. Why we process data

• Because you chose it: analytics cookies on this website are set only after you accept, and you can withdraw at any time from the footer.
• To do what you asked: answering your enquiry, scheduling a call, handling your application, and providing the platform to Customers under their agreement.
• To run and protect the service: security, fraud and invalid-traffic prevention, server logs, and the delivery measurement needed to serve an ad that was requested.
• Because the law requires it: keeping records required by tax, accounting or other law, and responding to lawful requests.
• Where the law of your location requires a specific legal basis for each of these (for example in the EEA or UK), the bases are, respectively, consent, performance of a contract, legitimate interests, and legal obligation; you may object to processing based on legitimate interests as described in Section 11.

7. Automated decision-making

The platform decides automatically, in milliseconds, which ad to serve and at what price. These decisions do not produce legal or similarly significant effects on individuals; they determine which advertisement plays. We do not make automated decisions about people that have such effects. Every decision is logged and can be reviewed by the Customer.

8. Who we share data with

Only with providers who process data for us under contract, only what each needs, and with Customers' own demand partners where a Customer has connected them. Website providers are listed below; the full platform list is on the Subprocessors page.

We may also disclose personal data where the law requires it (including to comply with a court order, subpoena or lawful request by a public authority), to protect rights, safety or property, or to enforce our terms. Business transfers. If Adferry is involved in a merger, acquisition, financing, reorganisation or sale of all or part of its assets, personal data may be transferred as part of that transaction; it remains subject to this policy until a successor publishes a new one, and we will notify you of material changes where the law requires it.

Marketing. We do not send marketing emails to website visitors unless you ask us to. Any marketing email we send will include an unsubscribe link, and you can opt out at any time through our contact page.

9. Where data is processed

Adferry is a United States company and processes data in the United States, using providers that may operate globally (Section 8). The platform is offered to customers in the United States. If you visit this website from outside the United States, your data is transferred to and processed in the United States; where the law of your location requires a specific safeguard for that transfer, we put the required contractual protections in place with our providers, and you can ask us about them through our contact page.

10. How long we keep data

• Website server logs: up to 30 days (provider default), then deleted or aggregated.
• Website analytics: 14 months, then aggregated.
• Enquiries and bookings: for as long as the conversation is live, then up to 24 months.
• Job applications: up to 12 months after the role closes, unless you ask us to delete sooner or we keep them longer with your consent for future roles.
• Platform request-level records: raw event and settlement records for up to 90 days; aggregates for reporting and billing as agreed with each Customer.
• Records required for tax, accounting or legal defence: for the statutory period.

11. Your rights and how to use them

Depending on where you live you may have the right to: know what personal data we hold about you and access it; have inaccurate data corrected; have data deleted; opt out of sale, sharing or targeted advertising (we do none of these); restrict or object to certain processing; receive data you provided in a portable format; withdraw consent; and not be subject to solely automated decisions with legal or similarly significant effects. To use any of these rights use our contact page. We may ask for information to verify your identity, and you may use an authorised agent where your state law allows it. We respond within 45 days under U.S. state laws (extendable once where the law permits), or within the period your local law sets, and we do not charge unless a request is manifestly unfounded or excessive. You will not be treated differently for exercising your rights, and you may appeal a decision by replying to our response.

If your request concerns data we process on behalf of a Customer, we will tell you which Customer it is where we can, refer the request to them, and help them respond.

You may also contact your state Attorney General or, outside the United States, your local data protection authority. We would appreciate the chance to address your concern first, and we will cooperate with any authority that contacts us.

Other jurisdictions

Adferry is a United States company. If you are outside the United States, the EEA or the UK, we will honour the rights available to you under your local privacy law; write to us and tell us where you are.

12. Notice for California and other US states

This section supplements the rest of the policy for residents of California and other states with comprehensive privacy laws.

Categories collected in the preceding 12 months, by activity:

Sources: you, your device, and our Customers. Purposes: as in Sections 3 and 5. Retention: as in Section 10. Sale or sharing: we do not sell personal information and do not share it for cross-context behavioural advertising; we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for inferring characteristics. We do not knowingly sell or share personal information of consumers under 16. We offer no financial incentives in exchange for personal information. California "Shine the Light" (Civil Code §1798.83): we do not disclose personal information to third parties for their own direct marketing purposes. We honour Global Privacy Control signals on this website as a request to opt out; see Section 4 on browser signals, including why we do not respond to Do Not Track. Your rights under these laws (know, delete, correct, opt out, limit, non-discrimination) can be exercised as in Section 11, including through an authorised agent with proof of authority.

13. Opting out of ad measurement

The most effective opt-out is on your device, because it applies to every ad platform at once:

• iOS / tvOS: Settings → Privacy & Security → Tracking (off); Apple Advertising → Personalised Ads (off)
• Android / Android TV / Google TV: Settings → Privacy → Ads → Delete advertising ID, or opt out of ads personalisation
• Roku: Settings → Privacy → Advertising → Limit ad tracking
• Amazon Fire TV: Settings → Preferences → Privacy Settings → Interest-based Ads (off)
• Samsung TV: Settings → General → Terms & Privacy → Interest-based Advertising (off)
• LG TV: Settings → General → Additional Settings → Limit AD Tracking
• Web browsers: enable Global Privacy Control in your browser or a privacy extension, and clear advertising cookies

Opt-out and consent signals carried on the ad request are passed through unchanged to the demand partners the publisher has connected, and the publisher's configuration governs how its inventory is served to opted-out devices.

14. Candidates applying for a role

When you apply through our Careers page we process the details and CV you submit to assess your application and communicate with you about it. The form is relayed to our inbox by FormSubmit. We keep applications for up to 12 months after the role closes, or longer only with your consent for future roles. We do not use automated screening. You can ask us at any time to delete your application or to tell you what we hold.

15. Security

All endpoints use TLS. Access to platform data is role-based and scoped per account. Administrative actions and every platform decision are logged. Details are on the Security page. No system is perfectly secure; if we learn of a breach affecting you we will notify you and any regulator as the law requires.

16. Children

This website is for business audiences and is not directed at children under 16, and we do not knowingly collect their data here. Customers using the platform on child-directed content are responsible for configuring it accordingly and for their own obligations under children's privacy laws; the platform supports passing a child-directed flag on the request, in which case advertising identifiers are not used.

17. Changes to this policy

We review this policy at least once a year and whenever our processing changes. When we change it we update the effective date at the top and note material changes on the Legal page. For material changes we note what changed on the Legal page and, where we have your contact details and the law requires it, notify you directly.