If you are a California resident, you may request details on how your data is obtained and used. You may opt out of data sharing or request deletion through our privacy settings or third-party opt-out mechanisms. For more information on your rights, please visit Your Rights & Consent Options. 

We process personal data exclusively for advertising and audience segmentation. This includes: 
Advertising identifiers (e.g., Mobile Advertising IDs). 
Geolocation data (latitude/longitude with timestamps). 
Campaign interaction data (ad impressions, clicks, engagement metrics). 

These data points help optimize targeted advertising and measure campaign performance. 
We do not sell raw personal data, such as precise location coordinates or directly identifiable user information. Instead, we generate aggregated audience segments, which are shared with Demand-Side Platforms (DSPs) to enable programmatic advertising. These segments consist of groups of users with similar behaviors or interests but do not contain personally identifiable details. 

To ensure privacy and compliance, we: 
Limit the processing of sensitive data by enforcing contractual restrictions on third-party providers. 
Restrict data collection in sensitive locations (e.g., healthcare facilities, religious institutions) to reduce geolocation tracking risks. 
Do not process biometric data, data of minors, or special category data under GDPR. 

When data is processed based on your consent, you have the right to withdraw your consent at any time. Both we and our clients share responsibility for ensuring transparency in data collection and processing. 
Our role depends on how data is collected and processed. The tables below outline when Drako acts as a Data Controller, making decisions about audience segmentation, and when we act as a Data Processor, handling data on behalf of our clients. 

We specialize in interest-based advertising, using legally acquired audience data to build targeted segments. Instead of cookies, we rely on Advertising IDs, geolocation data, and other digital identifiers to deliver ads accurately across devices and platforms. 

• Audience Segmentation & Targeting – We use geolocation insights, behavioural patterns, and demographic data to build audience profiles for advertisers. 
• Ad Delivery & Performance Tracking – We work with advertisers to measure engagement, optimize campaigns, and refine targeting based on real-time data.
• Cross-Device & Cross-Platform Recognition – We use Advertising IDs (e.g., Mobile Ad IDs) to track ad relevance across devices without relying on browser cookies. 

We use Advertising IDs, geolocation data, and other digital identifiers to enable targeted advertising. Since we do not use cookies, you can manage your preferences by adjusting your device settings: 

• Mobile Advertising ID (MAID) Control:
  On iOS: Go to Settings → Privacy & Security → Apple Advertising → Disable Personalized Ads. 
  On Android: Go to Settings → Google → Ads → Enable Opt out of Ads Personalization.
• Limit Location-Based Targeting:
  On iOS: Settings → Privacy & Security → Location Services → Disable for specific apps. 
  On Android: Settings → Location → Adjust permissions for ad-related apps. 
• Industry Opt-Out Tools:
  ~ DAA’s WebChoices (https://optout.aboutads.info/) – Manage online interest-based advertising preferences. 
  ~ AppChoices (DAA Mobile Opt-Out) (https://youradchoices.com/appchoices) – Control interest-based advertising on mobile devices. 
  ~ Network Advertising Initiative (NAI) Opt-Out (https://optout.networkadvertising.org/) – Additional opt-out options for data-based targeting. 
• State-Specific Opt-Out Rights
  ~ Residents of California, Colorado, Virginia, Connecticut, and Utah have additional rights under state privacy laws to:
  -Opt out of targeted advertising and the sale or sharing of personal data. 
  -Use Global Privacy Control (GPC) to signal opt-out preferences across websites and services. 

Do we share your personal data with third parties?

We share personal data only as necessary to provide our advertising intelligence and geolocation-based marketing services, ensuring compliance with GDPR and industry regulations.

• Service providers that process personal data on our behalf operate under contractual agreements that restrict the use of data to approved purposes only.
• All other disclosures of personal data require consent, and we will name third parties where applicable.
• We do not resell personal data. Any shared insights that cannot be reidentified (e.g., aggregated, anonymized, or derivative data) are not considered personal data under applicable privacy laws.

We may share personal data in the following limited circumstances:

• As part of a commercial transaction (e.g., to a potential acquirer in a business transfer, subject to due diligence and compliance review).
• In response to legal requests (e.g., if required by court order or regulatory authorities).
• To prevent harm or fraud (e.g., if disclosure is necessary to protect an inpidual or comply with legal obligations).

Cross-Site Tracking Disclosure

We and our advertising partners may engage in cross-site tracking to improve ad targeting and measure campaign effectiveness. This means that when you visit a website or use an online service, third-party providers may collect data about your online activities over time and across different websites or services.

We do not respond to Do Not Track (DNT) signals, but you can opt out of cross-site tracking through industry-standard tools:

• DAA’s WebChoices – Manage cross-site tracking preferences.
• NAI Opt-Out – Control interest-based tracking across devices.
• Global Privacy Control (GPC) – Automatically signal opt-out preferences.

California & Nevada Residents: You may have additional rights regarding cross-site tracking opt-outs.

If our cross-site tracking practices change, we will update this policy and notify you through our website or privacy settings page.

How do we protect personal data?

We implement reasonable technical and organizational measures to protect your personal data, such as policies. Here are a few examples:

• We use AES 256 encryption at rest and AES128 or AES 256 for encryption in transit
• In the event of a security incident, we follow established protocols designed to detect, contain, and mitigate risks in a timely manner.
• We have a strong role-based access system mechanism, and we only provide access to personal data on a need-to-know basis.

Our cloud hosting company complies with many security standards, and is audited by third parties for ISO 9001, ISO 27001, ISO 27017 and ISO 27018. They also have SOC 1/ISAE 3402, SOC 2 and SOC 3 reports.

Where do we store your personal data?

We store and process personal data on Amazon Web Services (AWS) in the United States. Some of our service providers may also be in the United States and other jurisdictions where data is stored or processed. Your personal data is encrypted at rest and in transit, including when stored in AWS environments. If your personal data is stored in a country different from your location, it may be subject to local laws and regulatory access requests from government authorities. In such cases, we will make reasonable efforts to notify you before complying, unless legally prohibited from doing so. We are committed to data protection and regulatory compliance and implement appropriate safeguards to protect your personal data, regardless of where it is processed.

How long do we retain your personal data?

We retain personal data for long as required for the purpose of the collection, unless we are required by law to keep it longer. When we collect personal data to create audience segments, we don’t keep the original data for more than 180 days before anonymization. Our clients may request data deletion directly from us. Upon request, all associated data is securely deleted in accordance with our data retention policy.

When a service agreement with a client expires or is terminated, we delete their personal data in accordance with contractual obligations and applicable data protection regulations. We only retain personal data for as long as necessary to fulfill its intended purpose. However, in certain cases, we may be required to retain data longer to comply with legal, regulatory, or contractual obligations. We follow industry best practices for secure data deletion and ensure compliance with relevant privacy laws.

What are your rights regarding your personal data?

Privacy laws worldwide provide you with different rights over your personal data. The personal data rights granted to you may vary by country, or even by state.

These rights can include the right to deletion, to data portability, to be informed of our processing of your personal data, and to withdraw your consent. Our Privacy Officer will respond to your request with or will inform you of the motives if your request is denied.

In the European Union and United Kingdom, your rights include:

• The right to be informed about how we process your personal data.
• The right to access your personal data.
• The right to rectify personal data, such as if it is inaccurate.
• The right to request the erasure of your personal data.
• The right to request the portability of your personal data.
• The right to object to the processing of your personal data.
• The right to contest automated decision-making.

You can read this guide from the UK’S Information Commissioner Office for more information.

If you decide to exercise your rights, we may need to ask for additional personal data about you so that we can identify you prior to responding to your request. If we can’t comply with your request, we will explain why. We’ll try our best to get back to you in 30 days, or we will let you know if we need more time.

Please let us know if you have any concerns or complaints about how we process personal data by reaching out directly with our Privacy Officer. We will handle your complaint seriously and take the required action.

If you are still not satisfied, you can also contact your local regulator to understand how to make a complaint. If you are in Canada, you can reach out to the Office of the Privacy Commissioner on their website at www.priv.gc.ca.

California residents

This section applies exclusively to residents of California and provides additional disclosures required by the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

We collect and process personal data primarily for advertising and audience segmentation. As part of our services, we share aggregated audience segments with third parties, including Demand-Side Platforms (DSPs), to facilitate cross-context behavioral advertising. We do not sell raw personal data, precise location coordinates, or identifiable user information, nor do we process sensitive data or information of individuals known to be under 16 years old for targeted advertising.

Your Rights Under CCPA & CPRA

California residents have the right to know, access, correct, delete, and opt out of the sale or sharing of their personal data for advertising. We do not process sensitive data for advertising purposes. To exercise these rights, you can manage preferences through Your Privacy Settings or opt out using industry tools such as YourAdChoices (DAA), NAI Opt-Out, and Global Privacy Control (GPC).

For non-California residents, we apply global privacy protections aligned with GDPR and Law 25, ensuring transparency, data protection, and opt-out options even where local laws may not provide identical rights.

Can we modify this privacy policy?

Yes, we can modify this Privacy Policy as necessary, such as to reflect our current processing of personal data or to new legal requirements. When we modify this policy, we will notify you as required under the law. You can see the latest date at which we updated this Privacy Policy at the top of this page.