StackAdapt Cookie Notice

Last Updated and Effective: September 22, 2023

Go to our Quebec Privacy Statement to learn about our privacy practices.

To learn more about how we process cookies, please go to our Cookie Policy.

Our Commitment

StackAdapt Inc. ("StackAdapt", "us", "our", or "we") strongly believes that all information deserves protection. We've written this Privacy Policy to inform you of our privacy practices with respect to the personal data we process via our platform, which we will refer to as our "Platform". If you do not agree to the terms of this Privacy Policy, please click here to opt out of inclusion in our Platform. If you do not understand, or if you have questions about this Privacy Policy please contact us using one of the methods we've identified below.

We may update this Privacy Policy from time to time and will post the updates here. If we amend this Privacy Policy, we will revise the Last Updated date based on when we posted the updated version. If we make significant updates to this Privacy Policy, we may also provide you with notice by prominently posting on our website, via email or both. We may also highlight those updates at the top of this Privacy Policy and provide a prominent link to it for a reasonable length of time following the update. We encourage you to review this page on a regular basis.

Our Platform

StackAdapt is a programmatic advertising platform. We provide advertising services to our clients, who are typically advertisers or advertising agencies who use these services to buy, track, and manage their digital media to deliver advertisements, including but not limited to, native, display, video, connected tv, audio, and digital out-of-home advertisements. Through our Platform we distribute and promote advertising content, also referred to as creative, using real-time, data-driven audience targeting on behalf of our clients. As a programmatic platform, we also help our clients curate the audiences that are most likely to respond to an interest-based advertising campaign. When requested, we assist our clients in developing creative and when their campaign is ready to launch, we engage in real-time bidding on their behalf. Real-time bidding is a process in which advertisers bid on ad placements across publisher websites in a real-time auction environment. When bids are won, we are able to place our clients' ads across a range of websites, thereby delivering ads that are relevant and timely to you. After you've seen the ad, we enable our clients to use certain information related to the delivery of the ad to measure its effectiveness, whether you clicked on the ad, purchased the product, or scrolled past. Ultimately, we and our clients collect and use information within the Platform in various manners, relative to interest-based advertising, as described herein.

Types of Personal Information We Collect

In this Privacy Policy, we use the term "personal information" to represent various types of identifiable information we collect about you. The terminology of the applicable data protection law in your jurisdiction may use an equivalent term, like personal data, and we use personal information to mean the same thing.

Personal information includes information that directly identifies you, like your name, email address or physical address. You may provide this type of personal information to us in connection with a request to learn more about our company or our Platform. If you request to get in touch with us, this information is never used within our Platform. You may also provide this type of personal information directly to a third-party, who subsequently uses it in our Platform for their own advertising purposes, in accordance with the privacy policy under which it was collected.

In many jurisdictions, personal information can also include information that indirectly identifies you. In other words, a piece of information that could identify you, if it were combined with other information. Indirectly identifiable personal information is often referred to as "pseudonymous personal information" and examples of pseudonymous identifiers include cookie IDs, IP addresses, and device IDs. We collect certain pseudonymous identifiers while delivering advertisements via our Platform, as further described below.

Specific Pieces of Personal Information Collected. We collect the following pieces of personal information related to users, households, devices, and ads for use and processing within our Platform:

  • Advertising identifiers (e.g., mobile advertising identifiers)
  • Cookie identifiers
  • Device identifiers
  • IP addresses
  • User agent
  • Referral page URL and title
  • Geolocation information (e.g., latitude/longitude at varying levels of specificity)
  • Pseudonymous identifiers we receive or derive internally (e.g., RampID; household or consumer level identifiers)
  • Email address
  • Demographic data that may be associated with one of the above identifiers

Categories of Personal Information Collected. The above-described personal information collected can be categorically described as follows:

  • Online identifiers
  • Offline identifiers
  • Geolocation data
  • Pseudonymous identifiers
  • Audience data

Legal Basis for Processing. For personal information subject to the General Data Protection Regulation "GDPR", we process personal information on the basis of consent provided either directly to us or obtained directly by an advertiser or publisher that uses our Platform or services. If you have provided consent to the processing of your personal information, you can withdraw it at any time by following the opt-out instructions referenced herein. When we process your personal information in the Platform, generally we do so as a controller.

Sensitive and Special Categories of Personal Information. Under the GDPR and the UK GDPR, special categories of personal information include personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. We do not knowingly collect or process special categories of data related to individuals residing in the EEA or UK. Our clients are permitted to upload their own personal information to our Platform; however, they are prohibited from uploading special categories of personal information and are contractually obligated to comply with applicable data protection law when doing so.

Under applicable United States data protection law, sensitive personal data may include racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, and genetic or biometric data for the purpose of uniquely identifying a natural person. We do not knowingly collect or process these categories of sensitive data related to individuals residing in the United States where an applicable data protection law applies. In some cases, sensitive personal data may also include precise geolocation. We collect and process precise geolocation for reporting, measurement, and to place more relevant advertisements on behalf of our clients. To exercise your rights with respect to this information, click here. Subject to certain restrictions, our clients are permitted to upload their own personal information to our Platform and in some cases are permitted to serve advertisements based on predetermined geolocations they have provided. In all cases, clients are contractually obligated to comply with applicable data protection law when uploading data and using the Platform.

How We Collect Personal Information

We seek to minimize the amount of personal information we collect from you, and we do so only for the purposes described in this Privacy Policy. We collect personal information from the following sources:

Client-Owned Properties. We often use pixel tags and cookies to collect information about the ads you respond to or the purchases you make when you visit a website of one of our advertiser clients. We only use pixel tags and cookies at the direction of our clients and in each case, indirectly identifiable personal information is shared with us as further described below.

  • A pixel is a tiny snippet of code that allows the owner of a website to gather information about visitors to their website. Clients who choose to implement one of our pixels will automatically collect and transfer indirectly identifiable personal information to our Platform that includes IP address, Cookie ID, and contents of cookie, user agent, and referral page URL.
  • Our clients can customize their pixels to pass back additional indirectly identifiable personal data to our platform. While clients can use this information to make informed and strategic advertising decisions, they are contractually obligated to comply with applicable data protection laws when customizing their pixels.
  • Cookies are small text files that are stored on the browser of a computer that uniquely identify the browser and provide information to the cookie sender.

Our Platform. When we deliver advertisements through our Platform, we collect certain indirectly identifiable pieces of personal information related to the campaigns we serve on behalf of our advertiser clients. This is referred to as "impression data". Impression data includes, for example, advertising identifiers, identifiers tied to your device, your IP address, imprecise location (e.g., the postal/ZIP code you were located in when you saw the ad), user agent, as well as information related to the context of the web page you were viewing when you saw the ad. We may use impression data to group and categorize consumers based on their interests or preferences. This helps us identify which products and services may be most appealing to consumers and subsequently, which advertisements are most likely to be relevant to a particular group of consumers. Impression data is collected in accordance with the data protection requirements of the jurisdiction in which the campaign was served, and privacy policies of the websites and advertising networks we work with.

Third Parties. We may also collect personal data from third parties with whom you've shared your information, in accordance with their privacy policy. Third-party segments are combined pieces of data that are collected by external parties and acquired by StackAdapt for use in advertiser campaigns. Third-party segments do not contain directly identifiable personal data, rather third-party segments are resolved to pseudonymous identifiers that are used to track and manage digital media in an advertising campaign. Often, advertisers will request specific third-party segments so that they can more effectively reach a desired audience. This ensures you receive advertisements that are more relevant to you and your interests.

We may also collect identifiers assigned by third parties to your browser or device, including Google advertising identifiers, that we use as part of our internal processing operations and to serve ads. Please see Google's Privacy Policy for information about Google's use of your personal data that it receives from partner sites, and your ability to control the information collected on these sites.

How We Use Personal Information

We primarily process personal information in our Platform to assist our clients in reaching audiences that are most likely to respond to interest-based advertising campaigns. In that regard, we use personal information to do any, or all, of the following business or commercial purposes:

  • Display advertisements that may be relevant to you;
  • Place a bid for advertising space;
  • Marketing automation and email activation;
  • Track how many times an ad was shown and to whom (based on a pseudonymous identifier);
  • Allow clients to measure the success of their advertising campaigns;
  • Develop reports that provide measurement and attribution;
  • Process pseudonymous information to prevent malicious ad traffic (i.e., fraud detection and prevention);
  • To develop machine learning models and algorithms;
  • Create and refine audience segments and profiles; and
  • Develop and refine algorithms to understand better how users' interaction with a website might be of interest to advertisers.

Additionally, we may use personal information on our own behalf to do any, or all, of the following:

  • Respond to your requests, communications, suggestions, comments, inquiries, and requests;
  • Analyze the accuracy and effectiveness of the services we make available within our Platform;
  • Develop new products, features, and services, including analyzing and understanding our clients and their needs;
  • Respond to legally binding requests from law enforcement, supervisory or regulatory authorities, or other third parties;
  • Defend, protect, or enforce our rights or applicable terms of service or to fulfill our legal or contractual obligations;
  • Manage any dispute and accidents, and take legal or other professional advice;
  • Comply with, or meet obligations as required by, applicable law (i.e. fraud detection or the recurrence of fraud);
  • For internal or external audit purposes; or
  • For any other purpose with your consent.

Use of Artificial Intelligence "AI" in the Platform. We use AI technology to align ads with the content users are consuming. This means that, through algorithms, we can match relevant ads to your browsing. You can request to find out what personal information we may have used through our algorithms to send you ads based on your browsing. If you feel the information is inaccurate, you can request to have it corrected.

How We Share Personal Information

We share certain, indirectly identifiable personal information to support our clients' advertising strategies. In each case; however, we only share personal information for the limited circumstances we describe in this Privacy Policy and in accordance with applicable data protection law.

Sales and Sharing of Personal Information. To better operate our Platform, we may disclose your personal information to third parties and our advertiser clients. Under some applicable data protection laws, this disclosure would constitute a sale, or in some cases, a sharing, of personal information. We may sell or share your personal information for the business and commercial purposes described in the How We Use Personal Information section. You have a right to opt out of the sale of your personal information here. We only share personal data for purposes related to our advertising services or where we are legally required. The following categories of personal information we've sold or shared in the last 12 months:

  • Pseudonymous identifiers (internally or externally derived)
  • Online identifiers
  • Geolocation data
  • Audience data

In the last 12 months we've sold or shared the above categories of personal information to the following categories of third parties for the specified advertising related purposes:

  • Clients and their subprocessors (primarily advertising agencies): For the purpose of offering our programmatic advertising services.
  • Onboarding and audience partners: For the purpose of identity resolution and audience creation.
  • Publisher and supply-side partners: To technically enable the delivery of an advertisement and the measurement of its success.
  • Accountants and auditors: In connection with our business operations.
  • StackAdapt entities: For the purpose of offering our programmatic advertising services.
  • StackAdapt subprocessors: For the purpose of offering our programmatic advertising services and in connection with our business operations.

We do not knowingly sell or share personal information related to minors under 16 years of age.

In accordance with applicable law, we may also transfer or assign personal information to third parties as a result of, or in connection with, a sale, merger, consolidation, change in control, transfer of assets, bankruptcy, reorganization, or liquidation. If we are involved in defending a legal claim, we may disclose personal information about you that is relevant to the claim to third parties as a result of, or in connection with, the associated legal proceedings.

Your Choices

Opt-out Preference Signals. We recognize and ingest the Global Privacy Platform ("GPP") string developed by the Interactive Advertising Bureau ("IAB"). The GPP string is an encoded string used to signal user privacy consent and choice down the advertising supply chain. When you visit the webpage of a participating publisher, the publisher or their content management platform will store your user consent information, encode it as a string, and send the string in the GPP field within the bid request that StackAdapt subsequently receives. To learn more about the IAB's GPP, visit their website here.

Do Not Track. We currently do not honor Do Not Track signals.

Targeted Advertising. We enable our advertiser clients to engage in interest-based and targeted advertising via our Platform. To opt out of targeted advertising powered by StackAdapt, click here. If you choose to opt out of targeted advertising, it does not mean you will stop receiving advertisements or that you will receive fewer advertisements. When you choose to opt out of targeted advertising in our Platform, we will add a pseudonymous identifier that represents you to a suppression file that will prevent us from including you in future targeted advertising campaigns. After you opt out, you will still receive the same number of advertisements; they will just be less relevant to your interests.

Additionally, your opt-out with us is only applicable to our Platform. We cannot control how third-party websites or how the online services you visit will process your information or the opt-outs you request from them.

We work with third parties who collect information through the use of cookies and similar methods in order to serve you with relevant advertisements or to determine whether you have seen advertisements. This method of advertising is sometimes called "Interest-Based Advertising." To learn more about Interest-Based Advertising, your choices with respect to it, and to opt out of advertising programs that track your activities across multiple websites to deliver personalized advertising content to you, please visit:

StackAdapt participates in the IAB Canada Transparency & Consent Framework and complies with its Specifications and Policies. StackAdapt's identification number within the framework is 238.

Children's Privacy. Our Website and Platform are not for children or those under the age of 16. We do not knowingly collect personal information from children or other persons who are under 16 years of age. Individuals who are children or those under the age of 16 should not attempt to provide us with any personal information. If you think we have received personal information from children or those under the age of 16, please contact us immediately.

International Transfers of Personal Information

StackAdapt is a global business headquartered in Canada. Within our Platform, our advertiser clients have the capability to serve ads to consumers located in many jurisdictions, all over the world. As such, it is necessary for us to transfer personal information abroad. We also transfer information to a number of companies who provide business applications that enhance our platform features, such as CRM onboarding and marketing applications, as well as marketing service providers. These providers are primarily located in the United States, but may also be located in other jurisdictions. Wherever we transfer personal information, we seek to ensure that it receives a materially similar degree of protection as provided in its country of origin.

Data Originating in the European Economic Area "EEA". Data originating in the EEA is subject to certain protections under the General Data Protection Regulation "GDPR" and individuals in the EEA are afforded additional privacy rights. The European Commission has the power to determine whether a country outside of the European Union "EU" offers an adequate level of data protection. This is referred to as an "adequacy decision". In certain cases, there may not be an adequacy decision by the European Commission and/or United Kingdom authorities with respect to a country to which we transfer your personal information. When transferring personal information from the EEA to a country without an adequacy decision, organizations are required to implement valid transfer mechanisms that may include binding corporate rules, approved codes of conduct, derogations for specific situations, and most commonly, the Standard Contractual Clauses (or any equivalent clauses approved by the authorities in the United Kingdom). You can find a copy of the Standard Contractual Clauses as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 here.

Protection, Storage, and Retention of Personal Information

Protection of Personal Information. We've designed industry-standard technical, organizational, and contractual measures to protect against the unauthorized access, disclosure, modification, or destruction of the personal information we collect and process. While we are committed to ensuring the security of the information we collect and process, no protection measure can provide a 100% guarantee of security. Consequently, we do not warrant or guarantee the security of any information we collect or process. If you suspect an unauthorized use or security breach of your personal information, please contact us immediately at privacy@stackadapt.com.

Storage of Personal Information. StackAdapt may process and store personal information anywhere our servers are located. For more information about our servers and storage of personal information, please contact us using one of the methods we've identified here.

Retention of Personal Information. Except as otherwise permitted or required by applicable law, we only retain your information for as long as necessary or relevant for the listed purposes in this Privacy Policy, including, for legal, regulatory, backup, archival, accounting, and/or audit purposes. Our primary commercial purpose is to assist our clients in tailoring their communications to the most interested audience and to develop rich, online content. Because online content and client campaign life cycles rapidly evolve and deteriorate, most data related to advertising content and communication has a narrow window of relevancy. As a result, personal information collected and used to further this commercial purpose is retained for a relatively short period of time. Additionally, the retention of certain data types is automatically defined at collection. For example, pixel data collected in coordination with our advertiser clients is retained for approximately six months. Similarly, cookies and other related identifiers are retained for approximately one year.

Your Regional Privacy Rights

Depending on the country you are in, you may have rights in relation to the personal information we collect and process about you. If you make a privacy rights request to us, we will ask you a few questions to verify it is really you making the request. This may include asking for your contact information and your location of residence. Because our Platform processes indirectly identifiable information to serve advertisements, we may also collect information related to your browser to verify your identity in connection with a request. We will respond to your request, subject to any applicable exceptions, within 30 days. If we need an extension, we will give you the reasons why.

To exercise your rights, contact us at privacy@stackadapt.com or fill out this web form. Below are a few things to know before you make your request.

  • Only you, or a person who can legally represent you, may make these requests. If you use an authorized agent, you must provide the authorized agent written permission to do so, and we may require that you verify your identity directly with us. You may also make a request on behalf of your minor child.
  • The request must be in writing and include your contact information and describe your request with sufficient detail that allows us to properly understand and respond to it. In addition, you should provide sufficient information that allows us to reasonably verify that you are the person about whom we collected the personal information or an authorized representative.
  • We do not charge a fee to process or respond to individual rights requests unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Your privacy rights will vary depending on the country, province, state, or region in which you reside.

Residents of California, Colorado, Virginia, Connecticut, Utah, and Iowa have specific rights with respect to the personal information we collect and process.

Access Request. You can request a copy of the personal information we may hold about you. Where required, we may ask you to verify your identity. If we are unable to verify your identity, we will not be able to provide you with access to the requested personal information.

Correction Request. You can request that we correct any incomplete or inaccurate personal information we hold about you. Because the data in our Platform is pseudonymous and not directly identifiable, we may not have the technical ability to correct your personal information. In that case, we will delete the incomplete or inaccurate personal information instead.

Right to Request Deletion. You have the right to request that we delete the personal information that we collected from you and retained, subject to certain exceptions. For example, we may deny your deletion request if retaining your information is necessary for us to be able to recover payment, detect security incidents, or protect against illegal activity.

Right to Opt-out. You have the right to direct us to not sell or share your personal information. This includes the right to opt out of the processing of your personal information for interest-based, or targeted, advertising. To learn more and act on your choices, click here.

Right to Data Portability. You have the right to receive personal information that you have provided directly to us, for example, through opening an account, in a commonly-used and machine-readable format. You have this right so that you may transmit your information to another organization without hindrance.

Exercising Your Rights. To exercise these rights, please fill out this web form or email us your request at privacy@stackadapt.com.

Right to Appeal. To appeal a decision we have made about a request you submitted, contact privacy@stackadapt.com using the subject "Appeal." This will lodge a complaint with our Data Protection Officer who will review your case. Depending on where you reside, you may also have the right to contact the applicable data protection authority, attorney general, or similarly situated regulatory body.

Right to Non-discrimination. You will not receive discriminatory treatment by StackAdapt for the exercise of any of the above rights.

Authorized Agents. Some states allow you to use an authorized agent to make requests on your behalf. If you use an authorized agent to exercise a right on your behalf, you must provide the authorized agent written permission to do so, and we may deny the request if the authorized agent does not submit sufficient proof that they have been authorized by you to act on your behalf.

California Privacy Rights

If you reside in California, under the California Consumer Privacy Act "CCPA" you have rights in addition to the above regarding your personal information.

Right to Know. You have the right to request that we disclose the personal information we have collected, used, disclosed, sold and/or shared about you over the past 12 months. To obtain this information, you can complete an access request. If we are able to verify your identity, we will provide the following:

  • The categories of personal information we have collected about you.
  • The categories of sources from which the personal information has been collected.
  • Our business or commercial purpose for collecting, selling, or sharing that personal information.
  • The categories of third parties with whom or to whom we have shared or sold that personal information.
  • The specific pieces of personal information we have collected about you.

Right to Opt-out of Sale and/or Sharing. You have the right to direct us to not sell or share your personal information. For information on how opt out preference signals are processed, please click here.

Right to Non-discrimination. You have the right not to receive discriminatory treatment by StackAdapt for the exercise of your privacy rights under CCPA.

Exercising Your Rights. To exercise these rights, please fill out this web form, contact us toll free at (650) 999-3764 ext. 101, or email us at privacy@stackadapt.com. Depending on the rights you've requested, we may take steps to verify your identity. Most likely, we will be able to complete your request within 45 days; however, if we require an extension, we will inform you of the length and the reasons why.

Annual Data Requests. The table below provides a statistical representation of the California consumer requests we received from January 1, 2023 until December 31, 2023.

Consumer Requests Total Received Total Complied with (in whole or in part) Total Denied Average Number of Days Within which StackAdapt Responded
Requests to Delete 1 0 1 1
Requests to Correct 0 0 0 0
Requests to Know (Access Requests) 0 0 0 0
Opt-Out of Sale or Sharing 52,468 52,466 2 1
Requests to Limit 0 0 0 0

Certain requests may have been denied if we were unable to verify the requestor's identity. We do not currently process directly identifiable information within the Platform; therefore, if the requestor only provided us with directly identifiable information, we may have been unable to process the request. For more information about your privacy rights, contact us at privacy@stackadapt.com.

Under the General Data Protection Regulations "GDPR", if you reside in the European Union "EU" or in the EEA, you have the following specific individual rights.

Right to Access. You can request access to the personal information we may hold about you. Before we provide you with access, we will ask you a few questions to verify it is really you making the request. In giving you access, we will tell you our purposes for processing the information; the categories of personal information we process; the types of organisations we've shared your information with, in particular if they are located internationally; where possible, how long we plan to store your personal information; and if the personal information wasn't collected from you, the source of the information.

Right to Rectification. You can request that we correct any inaccurate personal information we hold about you.

Right to Erasure. You have the right to request that we erase the personal information that we have collected about you and retained.

Right to Restriction of Processing. If your data is inaccurate, or your data is being processed unlawfully, such as without your consent because you had opted out, or where we no longer need your personal data for the purposes of the processing you have the right to request that we restrict the processing of that data.

Right to Data Portability. The right to data portability means you have the right to receive personal information that you have provided directly to us, for example, through opening an account, in a commonly used and machine-readable format. You have this right, so that you may transmit your information to another organization without hindrance.

Right to Object to the Processing of Your Data. You have the right to object at any time of the processing of your personal data for direct marketing purposes and profiling.

Automated Processing Rights. You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Exercising Your Rights. To exercise these rights, please fill out this web form, contact us toll free at 1-844-467-8225 (1-844-GO-STACK), or email us at privacy@stackadapt.com. Depending on the rights you've requested, we may take steps to verify your identity. Most likely, we will be able to complete your request within 30 days; however, if we require an extension, we will inform you of the length and the reasons why.

Right to Lodge a Complaint with a Privacy or Data protection Authority. You can also lodge a complaint with the privacy or data protection authority in the country where you live, work or where an alleged infringement of the applicable data protection law took place. A list of EU data protection authorities and their contact details is available here. Information about how to contact the Irish Data Protection Commission can be found here. To contact the UK Information Commissioner's Office, use the information found here.

Contact Us

To contact us with questions about this Privacy Policy or to make a request:

Email:
privacy@stackadapt.com

Mail:
StackAdapt Inc.
6D - 7398 Yonge St, Unit # 2161
Thornhill, ON L4J 8J2, Canada

Or fill out our Consumer Rights Web Form.