Privacy Policy

1. About This Policy

Astro AdTech LLC ("Astro AdTech," "we," "us," or "our") is a technology company that develops and operates programmatic rich media advertising infrastructure. This Privacy Policy explains how we collect, use, share, and protect information through our ad-serving and measurement infrastructure.

This policy applies to data processed through our ad delivery network. It does not apply to the websites, applications, or services of our clients, publishers, or other third parties.

2. Ad-Serving Infrastructure

Astro AdTech operates secure ad-serving infrastructure delivered exclusively over HTTPS. Our infrastructure handles ad delivery, creative asset hosting, and campaign event measurement. All data transmission occurs over encrypted connections.

3. Information We Collect

When our ad infrastructure is active on a webpage or application, we may automatically collect the following categories of information:

3.1 Ad Event & Measurement Data

• Ad impression events (whether an ad was rendered on screen)
• Viewability data (percentage of ad visible, time in view)
• Click and interaction events (user clicks, taps, or engagements with an ad creative)
• Campaign identifiers, placement identifiers, and creative identifiers
• Timestamp and session-level data for deduplication and analytics

3.2 Technical & Device Data

• IP address (used to infer approximate geographic location at the country/region level; not stored in its complete form)
• Browser type, version, and user-agent string
• Device type and operating system
• Screen resolution and language settings

3.3 Identifiers & Session Data

Our ad infrastructure operates within sandboxed iframes and does not utilize browser cookies, localStorage, or other persistent client-side storage mechanisms. Instead, we rely on:

• Session-level identifiers that exist only for the duration of the ad interaction
• In-memory variables for temporary state management within the iframe
• Server-side event correlation using non-persistent session tokens
• Campaign measurement through aggregated, non-identifiable event data

We do not build individual user profiles for behavioral targeting. Our measurement approach is limited to operational analytics and campaign reporting purposes within the constraints of sandboxed iframe environments.

4. How We Use This Information

We use the information collected for the following purposes:

• Ad delivery and rendering: Serving and displaying rich media ad creatives properly across publisher environments.
• Measurement and analytics: Providing our clients with campaign performance data including impressions, clicks, viewability rates, and engagement metrics.
• Fraud prevention: Detecting and filtering invalid traffic, bot activity, and non-human interactions.
• Infrastructure operations: Monitoring system health, diagnosing technical issues, and ensuring uptime and reliability.

We do not sell, rent, or otherwise transfer the data we collect to third parties for their own marketing purposes.

5. Data Sharing

We may share information in the following limited circumstances:

• With our clients (advertisers and agencies): Aggregated, non-personally-identifiable campaign performance reports.
• With service providers: Trusted third-party vendors that support our infrastructure operations (e.g., cloud hosting, CDN providers, security monitoring), under contractual data protection obligations.
• For legal compliance: When required by applicable law, regulation, court order, or governmental authority.
• Business transfers: In connection with a merger, acquisition, or sale of assets, subject to customary confidentiality obligations.

6. Technical Infrastructure & Iframe Sandbox

Our ad creatives are delivered and executed within sandboxed iframe environments. This architecture provides the following privacy and security characteristics:

• Sandboxed execution: Ad code runs in isolated iframes without access to the parent page's cookies, storage, or DOM.
• No persistent storage: Our creatives cannot access or set cookies, localStorage, or other browser storage mechanisms.
• Secure event collection: Our infrastructure includes endpoints for campaign measurement within the constraints of the sandbox environment.
• Event beacons and impression tags embedded in creatives communicate with our infrastructure solely for campaign analytics purposes.

7. Data Retention

We retain event-level data for a period necessary to provide campaign reporting and to meet our contractual obligations with clients, generally not exceeding 13 months from the date of collection. After this period, data is either deleted or anonymized. Aggregated reporting data may be retained longer for historical benchmarking purposes.

8. Data Security

All data transmitted through our domains is encrypted in transit using TLS/HTTPS. We implement industry-standard technical and organizational security measures to protect data against unauthorized access, alteration, disclosure, or destruction.

9. Your Privacy Rights

9.1 California Residents (CCPA / CPRA)

If you are a California resident, you may have the right to: (i) know what personal information we collect about you; (ii) request deletion of your personal information; (iii) opt out of the sale or sharing of your personal information. Astro AdTech does not sell personal information. To exercise your rights, contact us at the address below.

9.2 EEA / UK Residents (GDPR)

If you are located in the European Economic Area or the United Kingdom, our lawful basis for processing data collected through our ad infrastructure is our and our clients' legitimate interests in measuring and delivering advertising campaigns. You may have rights of access, rectification, erasure, restriction, and objection under applicable law. To exercise these rights, contact us at the address below.

9.3 Residentes en México (LFPDPPP)

Si usted se encuentra en México, Astro AdTech LLC trata sus datos personales de conformidad con la Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) y su Reglamento. Usted tiene derecho a ejercer en cualquier momento sus derechos ARCO:

• Acceso: conocer qué datos personales tenemos sobre usted y cómo los usamos.
• Rectificación: solicitar la corrección de datos inexactos o incompletos.
• Cancelación: pedir la supresión de sus datos cuando considere que no son necesarios para las finalidades que los justificaron.
• Oposición: oponerse al tratamiento de sus datos para finalidades específicas.

Para ejercer sus derechos ARCO, envíenos una solicitud a [email protected]. Responderemos dentro del plazo establecido por la ley (20 días hábiles). El organismo regulador competente es el INAI (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales): inai.org.mx.

10. Children's Privacy

Our ad-serving infrastructure is not directed at children under the age of 13, and we do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will update the "Last Updated" date at the top of this page when changes are made. Continued use of our ad infrastructure after such changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us: