1. Who is responsible for your data
The controller of your personal data is [Operator: full name and business name of the sole trader, or company name], [Registered business address in Poland], [NIP, REGON and CEIDG entry, or KRS number and registry court] (“we”, “us”). You can reach us at [contact email] about anything in this policy. We have not appointed a data protection officer, because the law does not require one for our business.
This policy covers visitors to our website, members of Promerang and their team members, people who see Promerang ads on members' websites, business contacts we may invite, and anyone who writes to us. It explains what we process under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
2. Visitors to our website
What: your IP address, browser and device details, the address you request and the time, recorded in our server logs.
Why and on what basis: to deliver the website, keep it secure and fix faults. Our legal basis is our legitimate interest in running a secure website (Article 6(1)(f) GDPR).
Fonts: our pages load their fonts from Google Fonts, so your browser connects to Google's servers, which receive your IP address and browser details. We do this, on the basis of our legitimate interest, to show the site consistently.
Security check: the sign-in and registration pages use Cloudflare Turnstile to tell people from bots. Cloudflare processes information about your browser, device and IP address for this check. Our legal basis is our legitimate interest in protecting accounts from automated attacks (Article 6(1)(f) GDPR).
3. Members
Account: your email address; your password, stored only as a one-way hash; your name, if one is entered; your roles; when the account was created, the email address confirmed and you last signed in. Address-confirmation and password-reset links are stored only as hashes and expire after 24 hours and 1 hour. We use this data to create and run your account and send account emails. Legal basis: performing our contract with you (Article 6(1)(b) GDPR).
Sites and campaigns: each site's domain, name, category, audience, language and verification key; your campaigns, their destination links, format and status; your targeting rules; review decisions and their reasons; and your weekly report settings, including your time zone. Legal basis: performing the contract. Your campaigns are shown publicly on other members' sites, and other members can see your site's name, domain and category in their targeting tools.
Credits and statistics: credit ledger entries, views and clicks on your placements and campaigns, statements and exports. Legal basis: performing the contract, and our legitimate interest in keeping an accurate record and resolving disputes (Article 6(1)(f) GDPR).
Payments: for each credit order, the package, amount, currency, status and Stripe's payment references, the email address we pass to Stripe, and a hashed and shortened IP address used against fraud. You enter card details on Stripe's page; we do not receive them. Legal basis: performing the contract; complying with tax and accounting law (Article 6(1)(c) GDPR); and our legitimate interest in preventing payment fraud.
Fair play and account security: while you are signed in to the dashboard or the admin console, we record keyed hashes of your IP address, your network (the first three parts of an IPv4 address, or the first 48 bits of an IPv6 address), your IP address combined with your browser, and a random device ID kept in the sx_dev cookie, together with a shortened IP address as a label. We use them to recognise when you, your team or a linked account views or clicks ads on your own sites, so that this traffic never earns credits, and to detect one person running several accounts. Legal basis: our legitimate interest in crediting fairly and preventing fraud (Article 6(1)(f) GDPR). Matching looks back 14 days and entries are deleted 90 days after they were last seen. These are default settings that we can adjust.
Emails: we send emails the Service needs, such as address confirmation, password reset and notices about these documents. If you turn on the weekly site report, we send it on the day and at the time you choose until you turn it off in your dashboard. Legal basis: performing the contract.
Moderation and enforcement: review decisions, traffic alerts, IP blocking rules, reversed views and a log of what our operators did. Legal basis: our legitimate interest in protecting the exchange and its members, and our legal obligations as a hosting service under the Digital Services Act (Article 6(1)(c) and (f) GDPR).
Team members with internal access: if we give you access to our CRM or admin tools, we also record what you create and change there, so that we know who did what. Legal basis: our legitimate interest in the accountability of our tools.
You need to give us your email address and a password to create an account; without them we cannot provide the Service. Billing details are needed only if you buy credits. Everything else is optional or created as you use the Service.
4. People who see ads on member sites
Members place the Promerang Widget on their websites. When you open such a page, your browser asks our servers for an ad, tells us when the ad has been visible for one second, and goes through our servers if you click the ad.
What our servers receive: your IP address, your browser's user-agent string and preferred languages, the browser's request metadata (Sec-Fetch headers), the website the request comes from, the time, which ad was shown, whether it became visible and whether you clicked it. If you are signed in to Promerang yourself, a click is also linked to your account and device ID.
What we keep: the full IP address is held only in temporary memory until the event is recorded, usually within milliseconds and never longer than 24 hours; our IP blocking rules may check it while the request is handled. If an advertiser limits views per IP address, a keyed hash of the address is also kept in temporary memory for the period the advertiser chose. We then store keyed hashes of the IP address, network and browser, a shortened IP address (for example 203.0.113.x), the user-agent string, a risk score and the reasons for it. After 90 days we delete these details from view and click records; what remains are counts that are no longer linked to you.
Why and on what basis: to choose an ad that fits the website, count views and clicks, move credits fairly, detect bots and fraud, protect the Service and give members statistics. Our legal basis is our legitimate interest, and that of our members, in running a fair ad exchange that resists fraud (Article 6(1)(f) GDPR). Where the law applicable to a website requires consent for the Widget to access information on your device, the website's owner asks for it before loading the Widget.
What we do not do: we do not set cookies on members' websites, track you across websites or build a profile of you. Ads are chosen by the website's audience and language and by members' targeting rules, never by who you are. The Widget saves something in your browser only when you close the ad bar (so it stays closed for that browser session) or when a website owner opens their own preview link.
Joint responsibility: the member who runs the website decides to embed the Widget. For collecting your data and passing it to us when the Widget loads, that member and we may be joint controllers. Under our arrangement, the member informs you and, where required, asks for your consent, and we handle everything else, including your requests about your data. You can contact either of us.
When you click an ad, you are taken to the advertiser's website, whose own privacy policy then applies.
5. Business contacts
We use a CRM to keep track of founders and companies who might benefit from Promerang.
What: your name, business email address, company, role, country of headquarters and website; public social media handles and follower counts; notes on our conversations; where you are in our pipeline and events such as an invitation sent or an account created; and the emails we have sent you, including their content.
Where it comes from: from you, from publicly available sources such as your company's website and public social media profiles, and from people who recommend you to us.
Why and on what basis: to present Promerang to businesses and keep track of our conversations. Our legal basis is our legitimate interest in direct marketing of our service (Article 6(1)(f) GDPR). We send commercial information by email only where the law allows it, in particular where you have agreed to receive it.
You can object at any time, and we will stop using your data for marketing. We keep only your email address on a suppression list so that we do not contact you again. Otherwise we keep CRM data until you object or it is no longer needed, at the latest three years after our last contact with you. If you become a member, your CRM record may be linked to your account.
6. When you contact us
If you write to us, including with a complaint, a notice about illegal content or a request about your data, we process your contact details and what you tell us to answer and to keep a record. Legal basis: our legitimate interest in answering you and defending claims, and our legal obligations, for example under the Digital Services Act (Article 6(1)(c) and (f) GDPR).
8. Who receives data
We share personal data only as needed with these service providers, who act on our instructions unless stated otherwise:
- [Hosting provider and the country where its servers are]: hosting of our servers and databases;
- Mailjet SAS (France, part of the Sinch group): sending emails; for some CRM emails we may use Zoho as a second email provider;
- Stripe Payments Europe, Limited (Ireland): payment processing. Stripe also acts as a separate controller for its own fraud prevention and legal obligations;
- Cloudflare, Inc. (USA): the Turnstile security check, and icons for our internal CRM pages;
- Google Ireland Limited and Google LLC: Google Fonts;
- jsDelivr: chart scripts for our internal CRM pages;
- accountants, legal advisers and, where the law requires it, public authorities.
Other members see only what section 3 describes and statistics for their own sites, never data about individual visitors. We do not sell personal data.
9. Transfers outside the European Economic Area
Cloudflare, Google, Stripe and Zoho may process data in the United States or other countries outside the EEA. We rely on the European Commission's adequacy decision for companies certified under the EU-U.S. Data Privacy Framework, or on the Commission's standard contractual clauses. You can ask us for a copy of the relevant safeguards.
10. How long we keep data
- Account, sites and campaigns: while your account exists. After it is closed, we delete or anonymise this data within 30 days, except for what the next points require.
- Credit ledger, orders and invoices: as long as tax and accounting law requires, generally five years from the end of the year in which the tax became due.
- Data needed to establish, exercise or defend legal claims: until those claims are time-barred.
- Network and browser details of views and clicks, and owner recognition entries: 90 days, as described in sections 3 and 4.
- Server logs: for a short time, normally no longer than 30 days.
- CRM data: as described in section 5.
- Backups: overwritten in rotation; deleted data disappears from them as they are replaced.
Aggregated statistics that no longer identify anyone may be kept longer.
11. Your rights
You have the right to access your data and receive a copy, to have it corrected, to have it erased, to restrict its processing, to receive data you gave us in a portable format, and to object to processing based on our legitimate interests. You can object to direct marketing at any time, without giving reasons. Where we rely on your consent, you can withdraw it at any time; this does not affect processing before the withdrawal.
Write to [contact email] to use these rights. We answer within one month, which may be extended by up to two further months for complex requests; we will tell you if so. For views and clicks we keep IP addresses only hashed or shortened, so we may not be able to link that data to you. If you tell us your IP address and when you saw an ad, we will try.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or with the supervisory authority where you live or work.
12. Automated decisions
An automated scorer decides whether a view or click counts and moves credits, using the signals described in sections 3 and 4. This has no legal or similarly significant effect on the people who see ads. Decisions to reject campaigns, suspend sites or restrict accounts are made by a person.
13. Security
We use HTTPS, store passwords and account links only as hashes, replace IP addresses with keyed hashes and shortened forms, limit internal access by role and keep backups. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the authority as the law requires.
14. Changes to this policy
We will publish any change on this page with a new date. If the change is significant, we will also tell members by email before it applies. The Service is not intended for anyone under 18.