Privacy policy

1. Who we are

This policy explains how Ulumob Digital Marketing Ltd., Sarıyer / İstanbul ("UluMob", "we") handles personal data. It covers two groups of people:

• Account holders: advertisers and publishers who use the UluMob website, panel and API, and anyone who contacts us.
• Visitors: people who view a page, domain, video player or Telegram Mini App where the UluMob ad tag runs.

For account data we act as controller. For ad-serving data we act as a controller, on our own or as an independent controller alongside the publisher, depending on applicable law.

2. Data about account holders

Data	Why we use it
Name, email address, password (stored only as a hash), roles, timezone, language	to create and run your account, sign you in, send service email
Company name, address, country, VAT number, finance contact emails	invoicing, tax and verification
Payout method details	to pay publishers; stored encrypted and shown only masked
Deposits, charges, payouts and balance history	accounting, fraud prevention, legal record-keeping
Campaigns, ads, sites, zones, settings and API key metadata	to provide the Service
Referral link used at sign-up and the referring account	to credit the referral program
Session data: IP address, user agent, last activity	to keep you signed in and protect your account
Messages you send us, including through the contact form	to answer you

Card payments are processed by Stripe. We do not receive or store full card numbers; we receive a payment reference and status.

3. Cookies on our website and panel

We set only cookies needed for the site to work:

• Session cookie: keeps you signed in to the panel; expires after a period of inactivity.
• XSRF-TOKEN: protects forms against cross-site request forgery; lasts as long as the session.
• ulumob_consent: remembers your choice in the cookie banner; 180 days.
• ulm_ref: remembers a referral link you opened, so the referral is credited if you register; 30 days.

The light or dark theme setting is kept in your browser's local storage and is never sent to us. We do not set analytics or marketing cookies today. See the cookie page for the current list.

4. Data about visitors who see ads

When a page carrying our tag requests an ad, we process:

• IP address and user agent as sent by the browser;
• Country, region and city, derived from the IP address, and the carrier, ISP and connection type;
• Device type, operating system and its version, device model, browser, browser version and browser language, derived from the user agent and the client-hint headers (or the same values the publisher tag reads from the browser);
• Page context: the path and title of the page that asks for the ad, cut short, for keyword targeting;
• A random visitor id (uv), which the publisher tag creates and keeps in the first-party local storage of the publisher's site. It is used for frequency capping, so the same person is not shown the same ad too often. Where the id is unavailable, a hash of IP address and user agent is used instead;
• Ad context: the zone, site domain, publisher sub-IDs, whether an ad blocker was detected, and which ad was served;
• Events: impressions, click ids (a random identifier created for each click) and the time of each event;
• Conversion postbacks sent by advertisers: the click id, conversion type, reported payout and the advertiser's transaction id, plus the sending server's IP address for refused postbacks.

We use this data to select and deliver ads, apply targeting and frequency caps, bill advertisers and pay publishers, detect bots and fraud, and produce aggregated reports. Advertisers can receive some values for their own clicks, such as the click id, country, device and visitor id, through URL macros in their destination links.

We do not use ad-serving data to build profiles of individuals across unrelated sites, and we do not sell it.

Country, region, city and network are looked up in a database on our own servers; the IP address is not sent to anyone for this. IP geolocation by DB-IP, licensed under CC BY 4.0.

5. Legal bases

Where the law requires a legal basis, we rely on: performance of a contract (account data); legal obligations (accounting and tax records); legitimate interests in operating, securing and billing an ad network and preventing fraud (ad-serving data); and consent where a publisher or local law requires it.

6. Retention

• Account data: for as long as the account is open and then for 10 years to meet legal and accounting obligations.
• Raw ad-serving events (impressions, clicks, conversions and refused postbacks, stored in our ClickHouse event database): 400 days, then deleted automatically.
• Aggregated statistics without IP addresses or visitor ids: for as long as needed for reporting and accounting.
• Contact messages: for as long as needed to answer them and follow up.

7. Processors and transfers

We use service providers who process data on our behalf:

• Stripe, for card payments;
• our hosting provider, for servers and databases;
• our email delivery provider, for service and transactional email;
• payout providers (the bank, PayPal, Payoneer or crypto network of the method a publisher selects), for publisher payments.

Some providers may be located outside your country. Where required, transfers are protected by standard contractual clauses or another safeguard the applicable law recognises.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict its use, to withdraw consent, and to complain to a data-protection authority. Residents of some US states may also opt out of the sale or sharing of personal data; see do not sell or share.

To make a request, email [email protected]. Account holders should write from the address on their account. Visitors who want ad-serving data deleted should include the visitor id from the publisher site's local storage if possible, since we cannot otherwise link an individual to events reliably.

9. Security

We encrypt payout details and postback secrets at rest, store passwords as hashes, store only hashes of API keys, sign click and impression links, and limit staff access to what each role needs. No system is perfectly secure; we will notify you of a breach where the law requires.

10. Children

The Service is not directed at children, and account holders must be at least 18.

11. Changes

We will post changes here with a new date and, for material changes, notify account holders by email or in the panel.

12. Contact

Ulumob Digital Marketing Ltd., Sarıyer / İstanbul. Email: [email protected].

13. Türkiye (KVKK) and the EU and EEA (GDPR)

This section is for people whose personal data is protected by the Turkish Personal Data Protection Law No. 6698 (KVKK) or the EU General Data Protection Regulation (GDPR).

• Data controller: Ulumob Digital Marketing Ltd., Sarıyer / İstanbul
• Company registration number: 458912-5
• Contact for data protection requests: [email protected]
• What we process, why and on which legal basis: sections 2 to 5 of this policy.
• How long we keep it: section 6.
• Who receives it and transfers abroad: section 7.
• Your rights and how to use them: section 8, and any other right the applicable law gives you.
• Complaints: you may complain to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) in Türkiye, or to the data protection supervisory authority of your EU or EEA country.