# Privacy policy What we collect, why, for how long, and the choices you have — for visitors to this website and for people who see ads we buy. Version 1.0 · Effective 2026-10-31 · Last updated 2026-10-31 ## Status of this policy As of the effective date above, Ailumic’s advertising service is **not yet buying ads**. Part B describes how it will process data once it does. We will update this policy, and its date, before it starts. ## Who we are Ailumic Inc. (“Ailumic”, “we”) operates the website at [www.ailumic.com](https://www.ailumic.com/) and a demand-side platform: software that buys advertising space for advertisers in real-time auctions run by ad exchanges. For the website, we are the controller (the “business”) of the personal information described in Part A. For the advertising service, our role is described in Part B. **Company** : Ailumic Inc. **Privacy contact** : [support@ailumic.com](mailto:support@ailumic.com) ## Part A — this website and business contacts ### What we collect - **Request logs.** When you load a page, our hosting provider’s load balancer records the IP address, the browser’s user agent, the address requested, the referring page and the time. We use these logs to run and secure the site, and keep them for 30 days. - **What you send us.** If you email us, we receive your address and what you write, and keep it for as long as we need to answer you and maintain our business relationship. **This site sets no cookies**, stores nothing in your browser and loads nothing from other companies: no analytics, no advertising tags, no embedded content. See the [cookie policy](https://www.ailumic.com/cookies/). ### Why, and on what legal basis We process request logs because we have a legitimate interest in operating a secure website, and correspondence to answer you and to take steps toward or perform a contract with you or your company. ### Who receives it Google Cloud hosts the site and processes request logs for us as a service provider. Our email provider processes the email you send us. We do not sell this information or share it for advertising. ## Part B — our advertising service ### Our role Advertisers use Ailumic to buy ad space on websites and in apps. When a page or app you use has space to sell, an ad exchange sends a *bid request* to buyers such as Ailumic, and we decide in a fraction of a second whether to bid and how much. We do not run the sites or apps, and we do not know who you are: the data we receive describes a device and a moment, not a named person. ### Where the data comes from - **Ad exchanges**, in bid requests and in the results of auctions — including, once we are approved, Google’s ad exchange. - **Advertisers**, as events from their own sites and apps: a click, a sign-up or a purchase that followed an ad we bought. ### What it contains - The device’s IP address, type, operating system and browser (user agent). - Coarse location derived from the IP address or provided by the exchange (country, region, city or postal code). We do not receive precise location through Google’s exchange, and we do not use precise location for targeting. - Pseudonymous identifiers: cookie IDs, including **Google advertising cookies**, and mobile advertising IDs, as the exchange provides them. - The page or app and the ad space: URL or app ID, format, position. - Privacy signals sent with the request: Global Privacy Control, GPP strings and US state opt-out flags, COPPA flags. - What happened: whether we bid and at what price, whether we won, whether the ad was shown or clicked, and conversion events advertisers send us. Conversion events contain no name, email address or other information that directly identifies a person. ### How we use it - To decide whether and how much to bid on an ad opportunity for an advertiser’s campaign. - To limit how often the same device sees the same ad (frequency capping). - To measure and report campaign results to advertisers, in aggregated form. - To detect and prevent fraud, invalid traffic and abuse. - To train and improve our bidding models, using pseudonymous data. ### What we do not do - We do not link cookie IDs or advertising IDs to names, email addresses or other information that directly identifies you. - We do not build interest categories from the bid requests we receive, and we do not use one publisher’s ad space data to retarget its visitors elsewhere without that publisher’s permission. - We do not target ads based on sensitive information — health, sexual orientation or sex life, religion, political opinions, racial or ethnic origin, citizenship or immigration status, union membership, financial hardship or precise location — and we do not draw boundaries around health-care facilities to target or exclude devices there. - We do not knowingly target or collect personal information from anyone under 18, and we honour the COPPA flag in bid requests. - We do not sell personal information for money, and we never sell data we receive through Google’s programmes. ### Ads we buy and the tags in them The ads we buy may contain tags from the advertiser’s ad server or from measurement and verification vendors. Those companies receive data from your browser when the ad loads and are responsible for it under their own privacy policies, which our terms require them to publish. ### Who receives it - **Advertisers** receive aggregated reports about their campaigns, not log-level data about devices. - **Ad exchanges** receive our bids and the information needed to show and bill the ad. - **Service providers** — our cloud hosting provider — process data for us under contract. - **Authorities**, when the law requires it. ### How long we keep it - Raw logs: 90 days. - Detailed records for reporting, billing and model training: 13 months. - Aggregated statistics are kept in de-identified form only. We keep and use them only in de-identified form and will not try to re-identify them. ### Your choice: opting out You can opt out of interest-based advertising from Ailumic on our [opt-out page](https://www.ailumic.com/opt-out/). The opt-out persists, and when you opt out we stop using the identifiers on that browser or device for interest-based advertising and dissociate the data already linked to them. ## The EEA, the UK and Switzerland Our advertising service does not bid on ad requests from users in the European Economic Area, the United Kingdom or Switzerland. Before it does, we will register with the IAB Europe Transparency & Consent Framework, obtain consent where the law requires it, and update this policy. If you are in those regions and write to us, Part A applies, and you may exercise the rights of access, correction, deletion, restriction, objection and portability, and complain to your data protection authority. ## Your rights in the United States Depending on where you live — including California, Colorado, Connecticut, Virginia and other states with consumer privacy laws — you may have the right to: - know what personal information we have about you and obtain a copy; - correct it, or have it deleted; - **opt out of the sale or sharing of personal information and of targeted advertising**; - use an authorised agent to make a request for you; - appeal if we decline a request; - not be treated differently for exercising these rights. Ailumic does not sell personal information for money, but buying ads based on a device’s activity across other companies’ sites and apps can be “sharing” or “targeted advertising” under these laws, which is why the[opt-out](https://www.ailumic.com/opt-out/) exists. **We treat a Global Privacy Control signal as a valid opt-out**for the browser that sends it. ### Categories we collect (California) | Category | Examples | Disclosed to | | --- | --- | --- | | Identifiers | IP address, cookie IDs, mobile advertising IDs | Service providers, ad exchanges | | Internet activity | Pages and apps where ads were offered, ads shown or clicked | Service providers, ad exchanges; advertisers in aggregate | | Coarse geolocation | Country, region, city, postal code | Service providers | | Inferences | Predicted likelihood of a click or conversion, used for one bid | Not disclosed | | Professional information | Business contacts’ names, titles and emails (Part A) | Service providers | We do not collect sensitive personal information for the purpose of inferring characteristics about you. ### How to make a request Email [support@ailumic.com](mailto:support@ailumic.com). Before our advertising service starts buying advertising, we will add a toll-free telephone number for requests. Because the advertising service holds no names, we may ask for the identifier shown on our opt-out page, or for the advertising ID of your device, to find your data. We acknowledge requests within 10 business days and answer within 45 days. To appeal a decision, reply to our answer with “Appeal” in the subject line; we answer appeals within 45 days. ## Children This website is not directed to children, and our advertising service does not knowingly collect personal information from or target anyone under 18. Contact us if you believe we have. ## Security We protect data with encryption in transit and at rest, access limited to the people and systems that need it, and audit logs of that access. To report a security issue, see our [security.txt](https://www.ailumic.com/.well-known/security.txt). ## Changes to this policy We review this policy at least once a year. When we make a material change, we post the new version here at least 30 days before it takes effect, update the dates at the top, and keep earlier versions available on request. ## How to contact us Ailumic Inc. · [support@ailumic.com](mailto:support@ailumic.com)