Frameworks honored, categories named.
This page is the operational privacy notice: which frameworks we support, what data we process and why, your rights per framework, and the exact route to exercise them. The full legal policy is linked at the end.
Named, enforced, exercisable
What we support, by name.
| Framework | How it is honored |
|---|---|
| GDPR and UK GDPR | Consent signals from IAB TCF v2.2 are enforced in the auction; processing purposes and legal bases are listed below. |
| CCPA and CPRA | US state privacy signals, including GPP strings, restrict sale and sharing per impression. |
| Other US state laws | GPP carries the signal formats for additional state statutes as they take effect. |
| COPPA | A child-directed flag in the SDK restricts data processing and demand eligibility for flagged impressions. |
| IAB TCF v2.2 and GPP | Both signal formats pass through the SDK and are respected end to end: consented requests trade, the rest do not. |
What we process, and on what basis.
| Category | What it is | Purpose and basis |
|---|---|---|
| Technical bid data | Request context: format, size, timestamp, platform signals. | Running the auction. Legitimate interest in serving the transaction the request exists for. |
| Device and app identifiers | Advertising IDs and app identities, where consented and platform-allowed. | Frequency management, fraud scoring, attribution. Consent or legitimate interest per framework. |
| Consent signals | TCF strings, GPP strings, COPPA flags. | Enforcing your users' choices. Legitimate interest in honoring the law. |
| Account data | Publisher and demand partner contact and payment records. | Operating the contractual relationship. Contract performance. |
Roles, stated plainly: for in-app inventory, the publisher is the controller for their app data and Sky Boosts acts as processor; on our own web properties, Sky Boosts is the controller. The DPA sets the terms for each surface.
Your rights and how to exercise them
What rights exist
Access, deletion, correction, objection and portability under GDPR; know, delete, correct and opt out of sale or sharing under CPRA and sister states.
How to exercise them
Through the privacy route on the contact form or by email to privacy@skyboosts.com. A valid request states who you are, the app or service concerned, and the right invoked.
What happens next
Requests are verified, processed within the statutory window, and answered in writing. If a request must be redirected to a publisher controller, we say so and say where.
The maintained list
The sub-processor list is maintained in the data processing agreement and updated with notice before additions take effect. Enterprise reviews receive the current list as part of the documentation pack.
International transfers
Transfers rely on the mechanisms named in the DPA, including standard contractual clauses where applicable. The exact mechanism set per entity is in the agreement, not in a paragraph meant to replace it.
Privacy, stated in specifics.
Access, deletion, correction or a DPA copy: one route, handled by the desk that owns it.
GDPR · CCPA/CPRA · COPPA · TCF v2.2 · GPP