Privacy Policy

This policy explains how Sky Boosts processes personal data in the course of operating its advertising platform (the auction, SDK, mediation, server-side ad insertion, dashboards and APIs) and this website. Where a detail depends on company facts that are not yet fixed, this policy says [TO BE CONFIRMED] rather than guessing; those items are collected in one list at the end. The operational summary on theprivacy page remains the short form of everything here.

01Who we are

This website and the platform are operated by Sky Boosts, 3640 Concord Pike, Wilmington, DE 19803, United States. References to "Sky Boosts", "we" and "us" mean that entity and its affiliates listed in the account agreement. Our data protection officer or privacy contact is [TO BE CONFIRMED: DPO name or role mailbox], reachable at privacy@skyboosts.com or through the privacy route on thecontact page.

02Scope and roles

This policy covers two surfaces with different roles. For advertising inventory in publisher apps and connected TV applications, the publisher is the controller for the end-user data in their inventory, and Sky Boosts acts as processor under the data processing agreement (DPA); publishers inform their users and carry the consent conversation. For this website and our business relationships with publishers and demand partners, Sky Boosts is the controller of the data described below. The DPA sets the terms for each surface.

03What we process, at a glance

04Data categories in detail

• Request context. Timestamp, ad format and size, placement identifier, platform and operating system signals, IP-derived coarse geography, and supply-chain fields (app bundle or content identifiers) carried on OpenRTB bid requests.
• Device and app identifiers. Advertising identifiers (for example Apple's IDFA or Google's Android Advertising ID) and connected TV identifiers, processed only where the platform provides them and the consent signals on the request permit it, and used for frequency management, fraud scoring and attribution.
• Ad events. Impressions, render states, completions and interactions with served advertising, logged for reporting, settlement and invalid-traffic analysis.
• Consent signals. IAB TCF v2.2 consent strings, IAB GPP strings for US state signals, and COPPA child-directed flags, enforced on every request.
• Account data. Business contact details, payment and tax records, integration configuration and support correspondence with publishers and demand partners.
• Website usage. Server logs, strictly necessary cookies, your consent preferences and aggregate page analytics on skyboosts.com, described in the cookie policy.

We do not knowingly collect sensitive personal information (precise geolocation beyond what a request requires to serve, health, racial or ethnic origin, political opinions, religion, sexual orientation, criminal records) and instruct partners not to pass it. If we learn it was passed, it is deleted and the sender faces the enforcement ladder in the publisher policy.

05Information from partners and matching

We do not buy, license or enrich with third-party demographic or audience segments: there is no data marketplace behind this platform. What we receive from partners is what the request itself carries: publishers pass consent signals, inventory context and, where consented, platform identifiers; demand partners return bids. Identifier matching between systems happens only where the consent signals on the request permit it, and identifiers that arrive without the consent to support them are dropped before the auction.

If a partner sends data that exceeds what the request's signals authorize, including directly identifiable data or precise location without opt-in, the data is deleted, the sending party is notified, and repeat sending is an enforcement matter under the publisher policy.

06California disclosure summary

"Shared" above has the meaning in the CCPA/CPRA. Because ad-path identifiers move only as part of serving the impression the request exists for, and only under the signals carried on it, the platform does not engage in sharing for cross-context behavioral advertising.

07Purposes

• Operating the auction: packaging eligible impressions into bid requests and returning winning ads.
• Frequency management: limiting how often the same user or household sees one campaign.
• Fraud prevention: filtering general and sophisticated invalid traffic before it monetizes.
• Measurement and attribution: delivery confirmation, completion events and win and loss reporting.
• Publisher reporting and settlement: the metrics publishers are paid on, per the published definitions.
• Platform operation and security: running accounts, dashboards, APIs, and protecting the service.
• Legal compliance and enforcement of our policies and agreements.

08Disclosures

• Demand partners. Bid requests expose the request context described above to connected demand partners, scoped by deal and format and subject to the consent signals on the request.
• Sub-processors. Infrastructure and tooling providers listed in the DPA, with notice before additions.
• Verification and measurement partners. Where a deal requires third-party verification, the signals that partner needs, scoped per deal.
• Professional advisers and authorities. Legal, tax and audit obligations, and lawful requests, to the extent required.
• Business transfers. In a merger or sale of the business, with notice where required.

We do not sell personal information as that term is used in the CCPA/CPRA, and we do not share website visitor data for cross-context behavioral advertising.

09Legal bases (EEA and UK)

• Consent. Processing of advertising identifiers and any personalized delivery runs on consent collected by the publisher and passed to us through TCF v2.2 or equivalent signals. Without consent, requests are processed without identifiers, limiting them to contextual decisioning.
• Legitimate interests. Fraud prevention, security, service integrity, dispute resolution and the generation of aggregate reporting, in each case balanced against your interests and rights.
• Contract. Operating accounts, delivering the service and settling payments with our direct partners.
• Legal obligation. Where law requires retention or disclosure.

10Retention

Data is kept for the shortest period its purpose requires. Current figures are published in the reporting documentation and the DPA: impression-level ad event data for[TO BE CONFIRMED: N days] from the event, after which it survives only in aggregate form that cannot be re-identified; request logs for[TO BE CONFIRMED: N days]; account and payment records for the statutory duration of business and tax records. Consistent with the reporting policy, when a retention definition changes, the change notice precedes the data.

11Security

Technical and organizational measures are described on the security page: TLS in transit, encryption at rest, least-privilege access with multi-factor authentication, audit logging on privileged actions, monitoring, and a vulnerability disclosure route with committed response times.

12Your rights

If you are in the EEA or UK, you have the rights of access, rectification, erasure, restriction, objection, portability, and the right to withdraw consent at any time, plus the right to lodge a complaint with your supervisory authority. If you are a California resident under the CCPA/CPRA, you have the right to know, delete, and correct personal information, to opt out of sale or sharing (we do not sell or share as defined), to limit the use of sensitive personal information, and to be free from discrimination for exercising these rights. Comparable rights exist under other US state statutes and are honored on the same route.

To exercise any right, write to privacy@skyboosts.com or use the privacy route on the contact form, stating who you are, the app or service concerned and the right invoked. Because ad-path data is pseudonymous, we may need the request context (app, approximate date) to locate it; we will tell you exactly what we need. You may authorize an agent in writing to act for you. Requests are answered within the statutory window. If we decline a request, we say why, and you may appeal by replying to that decision; appeals are reviewed by someone who did not make the original decision.

13Children

Our services are not directed to children. Apps flagged as child-directed through the COPPA signal run under restricted processing: no advertising identifiers, no behavioral profiling and restricted demand eligibility. Where we learn that data from a child-directed context was processed contrary to those signals, it is deleted and the publisher faces the enforcement ladder in the publisher policy.

14International transfers

Data may be processed in [TO BE CONFIRMED: processing regions]. Transfers out of the EEA, UK or Switzerland rely on [TO BE CONFIRMED: adequacy decisions or EU-US Data Privacy Framework certification status] and otherwise on the UK/EU Standard Contractual Clauses or another lawful mechanism named in the DPA.

15Choices and opt-outs

• This website. Cookie preferences can be changed at any time from the cookie banner or the footer; the site sets no advertising cookies.
• Mobile in-app. Reset or limit your advertising identifier in your device privacy settings (iOS Limit Ad Tracking or Android Opt out of Ads Personalization); we honor the platform signal that results.
• Connected TV. Advertising preferences are available in your TV platform's settings; industry opt-out resources for connected TV are published by the Network Advertising Initiative.
• Browser signals. [TO BE CONFIRMED: whether Global Privacy Control is honored as an opt-out on this website].

16Changes to this policy

Material changes are announced on this page with their effective date before they take effect, and substantive changes are logged with dates below this notice as they occur.

17Open items for the company

• Company number for the registered entity.
• Data protection officer or privacy role mailbox.
• Retention day counts for impression-level data and request logs.
• Processing regions and transfer mechanisms, including any DPF certification status.
• Global Privacy Control handling on this website.

Until each item is confirmed, the corresponding sentence above stays bracketed rather than asserted, because a privacy policy that guesses is worse than one that marks its open items.

18Contact

Privacy requests: privacy@skyboosts.com or the privacy route on the contact form. Security reports: security@skyboosts.com and the security page. The sub-processor list and the DPA are available on request through the privacy route.