TupleAds Inc. (“Company”, “we”, “our”, or “us”) understands that privacy is important to our users. This Privacy Policy describes our practices regarding the collection, use, sharing, and protection of your personal data for the website located at https://tupleads.com (the “Website”), our TupleAds mobile application (the “App”), and the TupleAds Demand-Side Platform (“DSP”) available through both self-service and managed service interfaces (the “Platform” or “Services”). This Privacy Policy also tells you about the rights and choices you have with respect to your personal data, how you can assert those rights, and how you can contact us to get answers to your questions. For the purposes of this Privacy Policy, the terms “you,” “user,” “consumer,” “individual,” and “data subject” are used as appropriate for the relevant legal framework and all refer to the person whose personal data is processed.

We may provide different or additional privacy notices in connection with certain activities, programs, and offerings. Additionally, we may provide additional “just-in-time” notices or notices at collection that may supplement or clarify our privacy practices or provide you with additional choices regarding your personal data.

With respect to the personal data that our advertiser clients and their vendors collect from end users outside of our Platform and provide to us via use of the Platform (“Service Data”), where permitted by law, we process such information only as a “service provider” or “data processor” (as those terms are defined under applicable data protection laws) on behalf of our advertiser clients, who act as the “business” or “data controller” (as those terms are defined under applicable data protection laws). Our advertiser clients – namely, the advertisers and agency partners who use the TupleAds DSP to programmatically purchase digital advertising inventory and execute advertising campaigns – are the parties that control the use of the Service Data and determine the purposes for which we process such information. While this Privacy Policy describes how we process Service Data on behalf of our clients, our clients are responsible for their own practices in collecting, using, and disclosing information they collect from you. To learn more about such clients’ use of your information and your rights that you may have over such information, please consult the privacy policy of the applicable company or publisher.

Please note that our privacy practices are subject to the applicable laws of the regions in which we operate. Accordingly, some additional region-specific terms will only apply to individuals in those locations, or as required by applicable laws.

For more information about how users with disabilities can access this Privacy Policy in an alternative format, please contact us at Privacy@TupleAds.com.

BY USING OR ACCESSING THE PLATFORM, YOU AGREE TO THIS PRIVACY POLICY. IF YOU DO NOT AGREE WITH OUR POLICIES OR PRACTICES, YOU SHOULD NOT USE OR ACCESS THE PLATFORM OR PROVIDE US WITH ANY PERSONAL DATA.

This Privacy Policy applies to the personal data that we obtain in various contexts. We use the term “personal data” – also called “personal information” or “personally identifiable information” in the laws of some jurisdictions – to refer to information that reasonably identifies, relates to, describes, or can be associated with you. Data that has been deidentified or that otherwise cannot reasonably be related back to a specific person is not considered personal data.

We do not intentionally collect personal data that is treated as “sensitive” under certain data protection laws (also known as “sensitive personal information” or “SPI”) directly from platform users. However, in connection with executing advertising campaigns on behalf of our advertiser clients, we may process audience segments that involve sensitive categories (including health, political, and financial segments) where permitted by applicable law. For such campaigns, we require advertisers to confirm an appropriate legal basis for targeting. We apply heightened data handling standards to any such data, do not use sensitive category segments to infer characteristics about consumers beyond the specific campaign scope, and do not retain or repurpose such segments after campaign conclusion.

With respect to Service Data, we use that information solely to provide campaign execution services to our advertiser clients. We do not use advertiser client data or end-user data processed through the bid stream for any purpose other than executing client campaigns and operating the Platform. We reserve the right to supplement your personal data with information we gather from other sources which may include online sources. We may collect information that is not personal data (“non-personal data”), including anonymous or aggregate data. Because non-personal data does not personally identify you, we may collect, use, and disclose such information for any purpose permitted by law. In some instances, we may combine non-personal data with personal data. If we combine any non-personal data with personal data, the combined information will be treated by us as personal data to the extent that it is capable of personally identifying you. We reserve the right to develop and derive aggregate data (meaning information that relates to a group or category of individuals, from which individual identities have been removed) from personal data in order to enhance and maintain the Platform, and such aggregate data will be treated as non-personal data.

Please note that if you specifically consent to additional uses of your personal data, we may use your personal data in a manner consistent with that consent.

With regard to Service Data, our advertiser clients provide us with instructions on what to do with such information. For example, a client may direct us to target specific audience segments, execute campaigns using particular creatives, or generate performance reports. These choices and instructions may result in the access, use, disclosure, modification, or deletion of Service Data. Clients and their affiliates determine their own policies for the sharing and disclosure of Service Data. We may transfer Service Data to third parties on our clients’ behalf (such as to measurement vendors for attribution reporting), and under such circumstances, we do so strictly according to our clients’ instructions.

We do not currently link to other third-party websites or social networking services from our Platform. If we add such links in the future, we will not endorse any other websites, providers, or services by providing such links, and this Privacy Policy will apply only to your use of our Platform. We are not responsible for the privacy policies of any websites or services we may link to on our Platform, and you should read the privacy policies of each site you visit to determine what data that site may collect about you.

Personal data is maintained on our servers or those of our vendors, and is accessible by authorized employees, independent contractors, representatives, and agents as necessary for the purposes described in this Privacy Policy. We use reasonable and appropriate physical, technical, and organizational safeguards designed to promote the security of our systems and protect the confidentiality, integrity, availability, and resilience of personal data. These measures include encryption in transit (TLS) and at rest, access controls, multi-factor authentication, data minimization, pseudonymization, role-based permissions, and automated expiration of data. However, no method of safeguarding information is completely secure, and we cannot guarantee that our safeguards will be effective or sufficient. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us of the problem by using the information in the section below titled Contacting Us.

We will retain your personal data for as long as your account is active or as needed to provide you with the Platform, and for a reasonable time thereafter in accordance with our standard procedures or as necessary to comply with our legal obligations, to resolve disputes, and to enforce our agreements. With respect to specific categories of data processed through our advertising operations: bid request and impression-level data is retained for up to 13 months; conversion tracking data is retained for 90 days; attribution lookback window data is retained for 30 days post-campaign; frequency capping data is retained for the active campaign duration plus 30 days; fraud detection logs are retained for 90 days (with IP/device blocklists maintained on a rolling 12-month basis); campaign report data is retained for the contract term plus 3 years; and platform account data is retained for the account term plus 5 years for legal and tax purposes. Even if we delete some or all of your information, we may continue to retain and use anonymous or aggregate data, or any other data that constitutes non-personal data.

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, or Rhode Island, or another U.S. state that has similar comprehensive privacy legislation (collectively, “Covered States”), you may have specific rights regarding your personal data under: the California Consumer Privacy Act (“CCPA”), Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, Texas Data Privacy and Security Act, Oregon Consumer Privacy Act, Montana Consumer Data Privacy Act, Iowa Consumer Data Protection Act, Delaware Personal Data Privacy Act, Nebraska Data Privacy Act, New Hampshire Data Privacy Act, New Jersey Data Privacy Act, Tennessee Information Protection Act, Minnesota Consumer Data Privacy Act, Maryland Online Data Privacy Act, Indiana Consumer Data Protection Act, Kentucky Consumer Data Protection Act, Rhode Island Data Transparency and Privacy Protection Act, and similar laws in other U.S. states (collectively, "State Privacy Laws"). This section describes the rights that consumers of Covered States have and explains how to exercise those rights. To be clear, these rights are granted only to the extent that you are considered a consumer of a Covered State and we are acting as a “controller” or “business” (as applicable) under State Privacy Laws with respect to your personal data.

The categories of personal data we process, our purposes for processing your personal data, the categories of personal data that we share with third parties, and the categories of third parties with whom we share it are set forth in the terms of the Privacy Policy above.

In order to provide our Services to our advertiser clients, we may process Service Data that we receive from or on behalf of our clients. If you are the resident of a Covered State, you may have certain rights pertaining to such information. Under the State Privacy Laws, when we act as a “processor” or “service provider” over such information, we only process your information through our Services as necessary to provide our services to our clients, at our clients’ direction. If you wish to exercise any of your rights under State Privacy Laws in regards to such information, please contact the relevant business that collected the information from you, who controls and determines how your information is processed.

We do not intentionally collect SPI from platform users within the scope of State Privacy Laws. However, in connection with executing campaigns on behalf of advertiser clients, we may process audience segments that could be considered sensitive under certain state privacy laws (such as health or political segments). We apply heightened data handling standards to such data and do not use it for our own purposes.

With the exception of opt-out or right to limit requests (which do not require verification), after submitting a request, we will take steps to verify your identity in order for us to properly respond and confirm that it is not a fraudulent request. In order to verify your identity, we will ask, at a minimum, that you provide your name, email address, and relationship to us, so that we can seek to match this information with the information existing in our systems. When providing us this information, you represent and affirm that all information provided is true and accurate. If we are unable to verify that the consumer submitting the request is the same individual about whom we have collected personal data, we may contact you for more information, or we may not be able to meet your request.

Only you (or for California residents, an agent legally authorized to act on your behalf) may make a verifiable request to know, delete, correct, or obtain a copy of your personal data. If you are making a request as the authorized agent of a California consumer, we will ask you to also submit reliable proof that you have been authorized in writing by the consumer to act on such consumer’s behalf. If you are making a request as the parent or legal guardian of a known child regarding the processing of that child’s personal data, we may ask you to submit reliable proof of your identity.

We will make every effort to respond to your request within 45 days from when you contacted us. If you have a complex request, State Privacy Laws allow us up to 90 days to respond. We will contact you within 45 days from when you contacted us to inform you of the need for additional time and the reason for such extension. We may charge you a reasonable fee to cover administrative costs if your requests are manifestly unfounded, excessive, or repetitive.

If we decline to take action on a request that you have submitted, we will inform you of our reasons for doing so, and provide instructions for how to appeal the decision. Depending on your state of residence you may have the right to appeal within a reasonable period of time after you have received our decision. If you have this appeal right, within 60 days (45 days for residents of Colorado and Minnesota) of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If we deny your appeal, we will provide you with a method for contacting your state attorney general’s office to submit a complaint.

The chart below provides additional information about how we processed consumer rights requests in the previous year. Between January 1, [CURRENT YEAR] and December 31, [CURRENT YEAR], we processed the requests of California consumers as follows:

* Denials are due to the inability to verify the consumers’ identities for delete, correct, and know requests.** Numbers are rounded to the nearest whole number and do not include requests where we were unable to verify the consumers’ identities for delete, correct, and know requests.

In addition to the above rights, under California Civil Code Section 1798.83 (“Shine the Light”), California residents may have the right to request in writing from businesses with whom they have an established business relationship: (a) a list of the categories of personal data, as defined under Shine the Light, such as name, email address, and mailing address, and the type of services provided to the customer that a business has disclosed to third parties (including affiliates that are separate legal entities) during the immediately preceding calendar year for the third parties’ direct marketing purposes; and (b) the names and addresses of all such third parties. To request the above information, please contact us by email at Privacy@TupleAds.com. If you do not want your personal data shared with any third party who may use such information for direct marketing purposes, then you may opt out of such disclosures by sending an email to us at Privacy@TupleAds.com.

If you are a resident of Nevada, you have the right to opt out of the sale of certain personal data that we have collected (or may collect) from you to data brokers or other third parties. You can exercise this right by emailing us at Privacy@TupleAds.com with the subject line “Nevada Do Not Sell Request.”

THE ENTITY MAINTAINING THIS PLATFORM IS A DATA BROKER UNDER CHAPTER 509 OF THE TEXAS BUSINESS AND COMMERCE CODE. TO CONDUCT BUSINESS IN TEXAS, A DATA BROKER MUST REGISTER WITH THE TEXAS SECRETARY OF STATE (TEXAS SOS). YOU MAY SEARCH THE DATA BROKER REGISTRY ON THE TEXAS SOS WEBSITE TO IDENTIFY A SPECIFIC DATA BROKER AND VIEW ITS REGISTRATION INFORMATION.

TupleAds currently offers its Platform to advertisers operating in the United States. Our data is stored and processed in the United States. If you submit personal data to us from outside the United States, that information will be processed in the United States, where privacy laws may be less stringent than those in your country of residence. By submitting your personal data to us, you agree to the transfer, storage, and processing of such information in the United States.

Our Platform is intended for users ages 18 and over, and we do not knowingly collect personal data from children under the age of 18. TupleAds restricts platform access to users 18 years of age or older. When we become aware that personal data (or other information that is protected under applicable law) from a child under 18 has been collected, we will use all reasonable efforts to delete such information from our databases. If you believe we might have any personal data from or about a child under 18, please contact us by using the information in the section below titled Contacting Us.

We reserve the right, at our discretion, to change, modify, add, or remove portions from this Privacy Policy at any time, provided that any such modifications will only be applied prospectively. We encourage you to periodically review the Website for the latest information on our privacy practices. Your continued use of the Platform following the posting of any changes to this Privacy Policy means you accept such changes. If we make a material change to this Privacy Policy or our privacy practices and believe that such changes will affect your personal data, we will take reasonable electronic measures to notify you of such changes and provide a reasonable opportunity for​ you to opt out of any further materially different collection, processing,​ or transfer of previously collected personal data under the changed policy. The process by which we notify you of material changes may include posting a notice on the Website.

If you have any questions about our privacy or security practices, you can contact us at Privacy@TupleAds.com.