Privacy Policy

1. Introduction

AdPriva Technologies Unipessoal Lda ("AdPriva", "we", "us", "our") operates a privacy-preserving traffic validation infrastructure designed to produce verifiable, fraud-scored proof of whether website traffic is human, an authorised agent, or a bot — without behavioural tracking or cross-site profiling.

We are committed to privacy by design, data minimisation, and cryptographic integrity. This Privacy Policy explains:

• What information we process
• The purposes and legal bases for processing
• How we safeguard data
• Your rights under the General Data Protection Regulation ("GDPR") and other applicable laws

2. Our Role Under Data Protection Law

Depending on the context, AdPriva may act in the following capacities:

2.1 Independent Data Controller

AdPriva acts as an independent Data Controller for:

• Publisher and client account data processed through the AdPriva Console
• Platform security and fraud integrity processing
• Compliance, legal, and financial operations

2.2 Processor or Independent Technical Service Provider

Where publishers integrate the AdPriva Tag on their websites, AdPriva acts as an independent technical service provider processing cryptographic event integrity data on its own technical infrastructure. AdPriva does not act as a joint controller with publishers in respect of this processing.

AdPriva does not operate as a behavioural profiling network and does not build cross-site identity profiles of any individual.

3. Information We Process

3.1 Traffic Event Integrity Data (AdPriva Tag)

When integrated on a publisher website, the AdPriva Tag transmits limited event data necessary to generate a cryptographic proof of a traffic Verdict. This may include:

• Event type (page view, interaction, conversion)
• Timestamp
• Site identifier (domain-level, not user-level)
• Behavioural signal summary (dwell time, scroll cadence, input entropy)
• Random nonce (for replay protection)
• Integrity-related metadata (cryptographically transformed)

AdPriva is architected to avoid collecting directly identifiable personal data (such as names, email addresses, or raw device identifiers). Where technical metadata is required for fraud prevention or system integrity, it is:

• Minimised to what is strictly necessary
• Pseudonymised or cryptographically hashed (SHA-256 or equivalent)
• Not used for cross-site tracking or behavioural profiling
• Not retained beyond its operational purpose

Where a publisher operates a consent form, the AdPriva Tag also captures the data needed to seal a Consent Certificate — a hash of the consent statement, the consent checkbox state, the form URL, the form field labels, and a behavioural summary at the moment of consent. The raw consent-form contents and any values you enter are never transmitted to or stored by AdPriva.

3.2 Publisher & Client Account Data

When organisations create an account in the AdPriva Console, we process:

• Name and business email address
• Company name and billing details
• API keys and authentication credentials
• Support and correspondence communications

This data is processed solely for account administration, contract performance, platform access, invoicing, and compliance.

3.3 Technical Session Data

3.4 Blockchain Anchoring Data (Paused)

Public blockchain anchoring is paused since November 4, 2026 (see Section 12). Until then, AdPriva anchored cryptographic commitments (Merkle roots and proof hashes) to public blockchain networks for auditability, and records anchored before the pause keep their anchor reference. Important clarifications:

• Only cryptographic proofs or commitments were anchored, never raw event logs
• No personal data was intentionally placed on-chain
• Blockchain entries are immutable once recorded
• Public blockchain data is not controlled by AdPriva once recorded

3.5 Information We Do Not Collect

4. Purposes of Processing

We process data strictly for the following purposes:

• Generating cryptographic proofs of a traffic Verdict
• Fraud detection and platform security
• Batch construction (Merkle tree aggregation)
• Zero-knowledge proof verification of earlier batches (zkVerify is not used for new batches)
• Batch receipts for independent auditability (public anchoring is paused)
• Platform analytics for publishers and clients (aggregated)
• Contract performance and billing
• Legal compliance

5. Legal Basis for Processing (GDPR)

Where GDPR applies, all processing is based on one of the following legal bases under Article 6:

5.1 Legitimate Interest Assessment

Where we rely on legitimate interests under Article 6(1)(f), we maintain a documented Legitimate Interest Assessment (LIA) which concludes that:

• Processing is necessary for fraud-resistant traffic validation
• Data is minimised and pseudonymised at the point of collection
• The impact on individuals is limited due to non-linkability and no profiling
• Technical safeguards (hashing, nonces, non-persistence) are implemented
• Individuals can reasonably expect this type of integrity processing in a traffic-validation context

A copy of our LIA is available to supervisory authorities on request.

6. Our Privacy Architecture (Technical)

AdPriva's privacy guarantees are enforced at the technical level through a four-layer cryptographic stack:

6.1 The APSID System

The AdPriva Session Identifier (APSID) is a cryptographically signed, time-limited token used to correlate events within a single browsing session. Key privacy properties:

• Contains no personally identifiable information
• Signed using HMAC-SHA256 with a server-held secret — cannot be forged
• Valid for maximum 30 minutes (session) or 30 days (persistent, opt-in)
• Stored in sessionStorage by default — deleted when the browser tab closes
• Site-bound — an APSID issued for one publisher cannot be used on another
• Includes nonce-based replay protection

7. How Traffic Validation Works

7.1 What the Public Explorer Exposes

Anyone can verify a single proof by its ID in the public Explorer. The Explorer returns only:

• The proof ID
• The Verdict (human, auth_agent, abusive_bot, or uncertain)
• The validity score (0–100)
• The sealed hash
• The Merkle batch receipt
• The anchored block and timestamp (only for records anchored before the pause)

7.2 What Publishers and Clients Receive

Publishers and clients receive aggregated validity reporting through the Console — traffic breakdowns, validity segments, and bot-rate by source. They never receive raw visitor identifiers or per-individual behavioural data. Validation happens entirely inside AdPriva's trusted server boundary; the Verdict and its evidence are then sealed and grouped into a Merkle batch with a verifiable receipt.

8. Automated Decision-Making (Art. 22 GDPR)

AdPriva uses automated technical systems for:

• Fraud detection and integrity verification
• Proof validation and validity scoring
• Verdict classification (human / auth_agent / abusive_bot / uncertain)

9. Data Retention

We retain data only for as long as necessary for the purpose for which it was collected:

Upon account deletion, all personal data will be purged within 30 days, except where retention is required by law or where data has been irreversibly anonymised and can no longer be attributed to you.

Blockchain records made before the pause are immutable and cannot be altered or deleted once recorded. See Section 12 for further explanation.

10. Cookies & Tracking Technologies

10.1 What We Use

AdPriva uses only the following strictly necessary technical mechanisms:

10.2 What We Do Not Use

• Tracking or profiling cookies of any kind
• Third-party analytics cookies (e.g., Google Analytics)
• Cross-site tracking identifiers
• Browser fingerprinting
• Social media tracking pixels or widgets

11. Data Security

11.1 Technical Measures

We implement appropriate technical and organisational measures including:

• AES-256-GCM encryption for data at rest (AWS KMS envelope encryption)
• TLS 1.3 for all data in transit (HTTPS enforced)
• Server-side HMAC-SHA256 signing (full 256-bit, no truncation)
• Timing-safe comparison for all cryptographic checks
• Nonce-based replay protection on all tracking endpoints
• IP address hashing with daily-rotating salts
• Content Security Policy (CSP) and strict sandboxing on all first-party surfaces
• Zero-knowledge proofs for verdict verification without identity exposure

11.2 Organisational Measures

• Role-based access control (RBAC) with principle of least privilege
• Multi-factor authentication (MFA) required for all staff with data access
• Incident response plan with defined escalation procedures
• Periodic security assessments (most recent: Hacken security audit, 2025)
• Environment-based secret management (no plaintext secrets in code repositories)

11.3 Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (CNPD, Portugal) within 72 hours of becoming aware, in accordance with Article 33 GDPR. Where the breach poses a high risk to you, we will also notify you directly without undue delay under Article 34 GDPR.

12. Blockchain Anchoring (Paused) & Zero-Knowledge Proofs

12.1 What Was Put On-Chain

Until the pause, AdPriva anchored cryptographic proof hashes on the Horizen blockchain to create tamper-proof, independently auditable records of a verified traffic Verdict. Only the following was written on-chain:

• Proof hash (SHA-256 digest of proof_id, verdict, validity_score, timestamp, site_hash)
• ZK proof attestation (Groth16 — verifiable without revealing private inputs)
• Verdict commitment and block timestamp

12.2 Right to Erasure and Blockchain

Due to the immutable and decentralised nature of blockchain technology, proof hashes that have been anchored on-chain cannot be deleted. However, these hashes contain no personal data and cannot identify you without access to AdPriva's off-chain mapping database. Upon account deletion, AdPriva will delete all off-chain mappings, rendering on-chain records permanently and irreversibly unlinkable to any individual.

13. International Data Transfers

AdPriva operates from Portugal within the European Union. Where infrastructure providers are located outside the EU/EEA, we rely on appropriate safeguards under GDPR Chapter V:

Our architecture is specifically designed to minimise the transfer of identifiable personal data outside the EEA.

14. Your Rights Under GDPR

Where GDPR applies, you have the right to access, rectification, erasure, restriction, data portability, and to object to processing. To exercise any right, contact us at hello@adpriva.com. We will respond within 30 days. Complex requests may take up to 3 months, and we will inform you of any extension.

We may require verification of identity before processing requests. We will not charge a fee unless a request is manifestly unfounded or excessive.

15. Children's Privacy

AdPriva services are not directed at children under 16 years of age. We do not knowingly process personal data from minors. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at hello@adpriva.com and we will delete such data promptly.

Publishers integrating the AdPriva Tag on websites directed at children must notify AdPriva and are contractually required to ensure validation is limited to behavioural-integrity signals only, with no profiling of children.

16. Third-Party Service Providers

AdPriva may integrate with the following categories of technical infrastructure provider. We do not transfer event personal data for profiling or marketing purposes to any third party.

17. Data Protection Officer

Based on our current processing activities, AdPriva has assessed its obligations under Article 37 GDPR and has concluded that appointment of a Data Protection Officer is not currently required. This assessment is based on:

• AdPriva does not carry out large-scale systematic monitoring of individuals
• AdPriva does not process special categories of data on a large scale
• AdPriva's core processing does not involve large-scale processing of personal data as its primary activity

We continuously review this assessment and will update this policy and appoint a DPO if our processing activities change in a manner that triggers the obligation under Article 37 GDPR.

For all data protection queries, please contact us directly at hello@adpriva.com.

18. Changes to This Policy

We may update this Privacy Policy to reflect legal, technical, or operational changes. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify registered users via in-app notification or email at least 30 days before the change takes effect
• For material changes that affect your rights, request fresh consent where required under applicable law
• Maintain an archive of previous versions accessible at adpriva.com/privacy/history

The latest version will always be available at: https://adpriva.com/privacy

Continued use of AdPriva services after the effective date constitutes acceptance of the revised policy, except where fresh consent is required.

19. Contact

For all privacy-related questions, rights requests, or concerns: