Privacy Policy

1. Who we are

OnlyMedia operates an advertising technology business at onlymedia.co: an ad network, a supply-side platform (SSP) and an agency desk that connects publisher inventory with curated demand, including top DSPs, curated SSP pathways, private marketplace and programmatic guaranteed deals, and direct campaigns. Publishers on the network operate websites and apps with more than one million monthly pageviews across North America, South America, EMEA and APAC.

Our principal place of business is OnlyMedia, 420 W 19th, Cheyenne, WY 82001, United States. General inquiries go to contact@onlymedia.co; privacy-specific contacts are listed in section 20.

2. Scope of this policy

This policy covers personal data processed through: (a) this website and its forms; (b) the OnlyMedia ad platform, including ad serving, the unified auction, real-time bidding (OpenRTB 2.6), Prebid header bidding, VAST 2.6 through 4.3 video delivery on both client side and server side, XML and JS tag delivery, and the reporting console; (c) our sales, support and marketing communications; and (d) partner and publisher onboarding.

It does not cover third-party services you reach from our site, the data practices of publishers whose properties carry our tags, or the data practices of demand partners who receive bid requests. Where we process personal data only as a service provider or processor on behalf of a client, that client's privacy notice governs its use of the data, and our processing is governed by contract, including our Data Processing Agreement.

3. About our advertising services

Publishers place our JS or XML tags, or integrate through Prebid or an ad server, and route impressions into a unified, curated auction. Demand partners bid in real time. We price impressions on expected value: bid multiplied by calibrated probability of the outcome it was bought for, with first-price mechanics, bid shading and transparent floors. Demand is contracted and monitored rather than open-market sweepings: every supply path runs through vetted publishers, verified chains (ads.txt and sellers.json) and pre-bid screening.

In platform processing we act predominantly as a service provider or processor for publishers and buyers: the identifiers we collect and transmit serve the delivery, measurement and protection of advertising on publisher properties. For our own website, our console accounts, and our marketing, we act as a controller.

4. Information we collect

4.1 Provided directly to us

When you contact the desk, request an estimate, open a support ticket or create a console account we collect your name, business email address, company and site domains, traffic profile details you choose to share, message content, and billing or payment data that onboarding requires. Job applicants who write to us provide whatever their application contains.

4.2 Collected automatically on this website

Device and browser characteristics, pages viewed, referring page, approximate location derived from IP at country or region level, and cookie or similar identifiers. Details sit in our Cookie Policy.

4.3 Platform data processed in ad serving

To run auctions and deliver and measure advertising on publisher properties we process pseudonymous identifiers and technical context: cookie identifiers and synced identifiers; mobile advertising identifiers such as IDFA and Android Advertising ID; connected TV and OTT device identifiers where publishers pass them; IP address; user agent; language; timestamp; the URL, ad slot and content category of the impression; bid request context under OpenRTB 2.6; ad interaction data such as views, clicks, video start, quartile completion and video completion; frequency and recency data; derived approximate location at country or metro level; and, only where a publisher has enabled location-based delivery and the end user has granted permission, precise geolocation used solely to serve location-relevant advertising and regional reporting. Audience or contextual segments supplied by publishers or vetted data partners may ride on bid requests.

We do not collect name, clear-text email address, phone number or government identifiers through ad serving, and we contractually prohibit partners from passing sensitive categories or direct identifiers in bid requests.

4.4 From third parties

Clients may send hashed or otherwise pseudonymised identifiers for matching on direct campaigns; data partners supply segments under contract; identity providers enable identifier syncing; verification and fraud partners share invalid-traffic signals; public sources such as WHOIS and app store listings inform vetting.

5. How we collect information

Directly from you through forms, accounts and correspondence; automatically through tags, cookies and similar technologies when you use this website; through the ad-serving process itself when impressions flow through the auction; from clients and partners under contract; and from public sources during vetting.

6. How we use information

• Service operation: running the unified auction, ad delivery, personalisation of advertising, frequency capping and pacing, cross-device recognition where permitted, identifier syncing, and deal or PMP delivery against contracted terms.
• Measurement and analytics: reporting impressions, CPM, fill rate, ad requests, pageviews, revenue, video completion and the console statistics that refresh every ten minutes.
• Fraud, brand safety and security: pre-bid filtering, MFA and arbitrage screening, invalid-traffic detection, category enforcement and chain verification.
• Communications: responding to enquiries, onboarding, revenue reporting, and marketing we believe is relevant, always with a way out.
• Business operations: billing, reconciliation, Net30 payment cycles, product improvement, and incrementality or value measurement.
• Legal and compliance: enforcing terms, meeting tax and regulatory obligations, and responding to lawful requests.

7. How we disclose information

• Publishers: reporting on their own inventory, including placement-level revenue, CPM and fill.
• Media buyers and DSPs: real-time bid requests containing impression data and device context so they can evaluate and bid; winning buyers receive the data needed to serve and measure the creative.
• Curated SSP and direct partners: impressions routed through contracted, vetted pathways under deal terms.
• Service providers: hosting, infrastructure, billing, CRM and support tools bound by contract to process data on our instructions.
• Measurement and verification partners: viewability, brand safety and fraud assessment data.
• Identity partners: identifier syncing where consent or a lawful basis permits.
• Business transfers: data as part of a merger, acquisition or asset sale, under this policy's protections.
• Legal and regulatory: where law requires or rights must be enforced.
• With consent: anywhere else you have agreed.

8. Cookies and tracking technologies

We and publishers use cookies, pixels, SDKs, local storage and related technologies to make advertising work: capping frequency, measuring completion, syncing identifiers and protecting delivery. The full detail, including categories and durations, lives in our Cookie Policy.

9. Legal bases where the EEA, UK or Swiss GDPR applies

We process personal data under: consent for personalised advertising, profiling and access to device identifiers; contract for publisher, partner and advertiser relationships and console accounts; legitimate interests for fraud prevention, security, frequency capping, ad delivery and the operation of a network business, balancing those interests against your rights; and legal obligation for tax, accounting and lawful requests. Our legitimate-interest assessments are available on request to privacy@onlymedia.co.

10. Your privacy rights and choices

Depending on where you live you may have some or all of the following: access to a copy of your data; correction; deletion; restriction; portability; objection to processing; withdrawal of consent; opt-out of sale, sharing or targeted advertising; and limits on use of sensitive personal information. We honour Global Privacy Control signals as an opt-out where the law requires it.

You can also control interest-based advertising through industry choice pages such as the NAI and DAA opt-outs, the mobile settings on iOS and Android, and the choices your publisher offers on its property. Opting out is browser and device specific, does not delete data we lawfully hold for other purposes, and does not remove advertising; it makes the advertising you see less relevant.

To exercise a right, email privacy@onlymedia.co. We verify identity before acting, respond within the timeframes the applicable law requires, do not charge unless a request is excessive or repetitive, support authorised agents with written permission and verification, and will never discriminate against you for exercising a right. Appeals processes required by state law are described on our CCPA page.

11. United States state privacy laws

This section is our Notice at Collection for residents of California, Colorado, Connecticut, Virginia, Utah and the other U.S. states with comprehensive privacy laws. The categories we collect are described in section 4; the business purposes in section 6; retention in section 14. We do not knowingly sell or share personal information of consumers under 18, we treat Global Privacy Control as a valid opt-out, we commit to de-identification where we report in aggregate, and we disclose identifiers and ad-interaction data to buyers in ways that may constitute a sale or sharing under these laws, which you may opt out of as described in section 10. Our CCPA page has the state-specific detail.

12. EEA, UK and Swiss data subjects

You may lodge a complaint with your supervisory authority, the UK Information Commissioner or the Swiss FDPIC, and you may withdraw consent at any time without affecting prior processing. Where we and a publisher each determine the purposes of identifier collection and transmission, we act as joint controllers to that limited extent and have Art. 26 arrangements with the publisher; all further processing is ours alone.

13. International data transfers

We operate from the United States and serve four regions, so data moves globally. Where the EEA, UK or Swiss GDPR applies we rely on Chapter V safeguards: the European Commission's Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, adequacy decisions where available, and supplementary technical measures such as pseudonymisation and encryption. Transfer impact assessments are part of our onboarding for new sub-processors, and a copy of the mechanism we rely on is available on request.

14. Data retention

We keep personal data only as long as the purpose requires. Request-level ad data, including identifiers, is retained no longer than 13 months, after which it is deleted or aggregated beyond re-identification. Console account data lives for the life of the account plus a short wind-down. Billing and tax records follow statutory accounting periods. Anonymous and aggregate statistics, which do not identify anyone, may be kept indefinitely because they are not personal data.

15. Data security

Traffic to and within the platform is encrypted with TLS; stored data is protected with encryption and pseudonymisation; access is role-based and protected by multi-factor authentication; infrastructure is monitored with intrusion detection and logging; staff are trained and bound by confidentiality; and we maintain an incident response process. No security regime is absolute, but we design ours so a single failure is neither likely nor sufficient to expose data.

16. Children's privacy

Our services are not directed to children, and publishers contractually warrant that their inventory is not child-directed within the meaning of COPPA. We do not knowingly collect personal data from children under 16, and we do not knowingly sell or share data of consumers under 18 where a state law prohibits it. If we learn such data reached us, we delete it.

17. Third-party websites and services

Our site links to third parties and advertisements may contain third-party tags; we do not control their practices and this policy does not apply to them. Review their notices before sharing data.

18. Industry frameworks and self-regulation

We operate in line with IAB self-regulatory frameworks for digital advertising, honour Transparency and Consent Framework signals passed by publishers' consent management platforms, and follow the NAI and DAA principles for interest-based advertising, including their mobile and cross-device guidance.

19. Changes to this policy

We post changes on this page with a new effective date. Where a change is material we give additional notice, such as a banner or direct message to account holders, before it takes effect.

20. Contact us

• Privacy team: privacy@onlymedia.co
• Data Protection Officer: dpo@onlymedia.co
• Cookie questions: cookies@onlymedia.co
• Support and console help: support@onlymedia.co
• Legal department: legal@onlymedia.co
• General: contact@onlymedia.co

OnlyMedia, Attn: Privacy Team, 420 W 19th, Cheyenne, WY 82001, United States.