Privacy Policy

1 Introduction

Welcome to Novaloom.

Novaloom respects your privacy and is committed to protecting personal data and maintaining appropriate privacy, security, transparency, and data-governance practices.

This Privacy Policy explains how Novaloom may collect, use, disclose, store, protect, and otherwise process personal data when you:

• visit or use the Novaloom website;
• create or use a Novaloom account;
• use the Novaloom publisher, partner, author, or administrative platforms;
• connect third-party accounts or services to Novaloom;
• use websites, applications, or advertising inventory managed through Novaloom;
• participate in Novaloom marketplace, direct-deal, or monetization programs;
• communicate with Novaloom;
• interact with Novaloom advertisements, analytics, or other services; or
• otherwise interact with Novaloom in connection with our products or services.

Novaloom is designed as a publisher intelligence and monetization operations platform. Depending on the services being used, Novaloom may process information relating to publishers, organizations, websites, advertising inventory, advertising performance, demand partners, advertisers, agencies, and website or application users.

This Privacy Policy should be read together with our Terms of Service, Disclaimer, Payment Terms, cookie or consent notices, and any applicable contractual data-processing terms.

2 Scope of This Privacy Policy

This Privacy Policy applies to personal data processed by Novaloom through its websites, applications, APIs, dashboards, integrations, and related services.

Because Novaloom operates in the advertising and publisher-monetization ecosystem, there may be situations where Novaloom processes data:

1. for its own business purposes, such as operating accounts, providing customer support, maintaining security, billing, analytics, and improving services; or

2. on behalf of a publisher, organization, advertiser, agency, or other customer, where Novaloom acts as a service provider, processor, or similar role under applicable law or contractual arrangements.

The applicable role may depend on the service, data involved, contractual relationship, jurisdiction, and applicable law.

Where Novaloom processes personal data on behalf of a customer, the customer's privacy notices, instructions, contracts, consent mechanisms, and other applicable requirements may also apply.

3 Information We Collect

The information we collect depends on how you interact with Novaloom.

We may collect the following categories of information.

3.1 Identity Data

This may include:

• name;
• username;
• account identifier;
• organization identifier;
• role;
• membership information;
• account status;
• publisher or partner identifiers;
• author information; and
• other information required to establish account or organizational identity.

3.2 Contact Data

This may include:

• email address;
• telephone number;
• business address;
• billing address;
• contact preferences;
• company or organization contact information; and
• communications you send to us.

3.3 Account and Organization Data

For publisher, partner, advertiser, agency, author, or enterprise accounts, we may process information such as:

• organization name;
• account configuration;
• membership and role information;
• permissions;
• feature entitlements;
• connected websites;
• advertising inventory;
• monetization settings;
• account status;
• service configuration;
• partner relationships;
• contractual information; and
• account activity.

3.4 Website and Inventory Data

Where a publisher uses Novaloom, we may process information relating to websites, applications, and advertising inventory, including:

• domain names;
• website identifiers;
• inventory identifiers;
• ad-unit or placement information;
• placement configuration;
• page or application context;
• inventory classifications;
• monetization configuration;
• advertising format;
• demand-route configuration;
• fill information;
• performance information; and
• information necessary to operate authorized monetization integrations.

3.5 Technical and Device Data

When you access Novaloom or interact with services using Novaloom technology, we may collect technical information such as:

• IP address;
• browser type;
• browser version;
• operating system;
• device type;
• device or advertising identifiers where applicable and permitted;
• language and regional settings;
• referring URL;
• pages or screens accessed;
• timestamps;
• network information;
• approximate geographic information derived from technical data where permitted;
• application or SDK information;
• error information;
• security information; and
• other technical information reasonably necessary to operate and secure the service.

3.6 Usage and Telemetry Data

Novaloom may collect event and telemetry information to understand:

• website and application performance;
• inventory activity;
• ad-request and ad-response events;
• monetization outcomes;
• demand performance;
• fill behavior;
• technical failures;
• latency;
• traffic quality signals;
• invalid-traffic or fraud-related signals;
• service reliability;
• user interactions with Novaloom products; and
• operational events.

Telemetry and analytics collection is intended to support measurement, security, optimization, troubleshooting, reporting, and controlled monetization operations.

3.7 Advertising and Monetization Data

Depending on the services enabled by a publisher or customer, Novaloom may process information associated with advertising activity, including:

• ad requests;
• ad impressions;
• ad responses;
• bid or auction-related information;
• demand-source information;
• contextual information;
• placement information;
• campaign information;
• deal information;
• pricing and floor information;
• fill and no-fill outcomes;
• revenue and yield measurements;
• reporting information;
• conversion or performance information where contractually and technically supported; and
• information required for reconciliation.

Not every service collects every category of advertising data.

3.8 Consent and Privacy Signals

Where applicable, Novaloom may receive or process privacy and consent information, including:

• consent status;
• consent strings;
• privacy preferences;
• opt-out signals;
• regional privacy signals;
• authorized advertising preferences;
• limited-ad or non-personalized advertising preferences; and
• other signals required by applicable advertising technology or privacy frameworks.

Novaloom may use these signals to determine whether particular advertising or measurement activities are permitted.

3.9 Payment and Financial Information

If you purchase services, participate in paid programs, or receive payments from Novaloom, we may process information such as:

• billing information;
• payment status;
• transaction information;
• invoices;
• tax information;
• payout information;
• payment-account identifiers; and
• information required for accounting, fraud prevention, reconciliation, or legal obligations.

Payment-card information may be processed directly by third-party payment providers rather than stored by Novaloom, depending on the payment method and implementation.

3.10 Communications

We may collect information contained in:

• support requests;
• emails;
• contact forms;
• onboarding communications;
• sales communications;
• technical discussions;
• feedback;
• surveys; and
• other communications with Novaloom.

4 Information We Receive From Third Parties

Novaloom may receive information from third parties, including:

• advertising platforms;
• Google and other connected platforms;
• publishers and customers;
• advertisers and agencies;
• SSPs and exchanges;
• demand partners;
• analytics providers;
• fraud and traffic-quality providers;
• payment providers;
• identity and authentication providers;
• technology providers;
• business partners;
• marketplace participants; and
• publicly available sources.

Third-party information may be combined with information collected directly by Novaloom where reasonably necessary to provide, secure, measure, or administer the relevant service.

5 Google and Other Third-Party Account Integrations

Novaloom may integrate with third-party platforms through APIs and OAuth-based authorization.

For example, Novaloom may support authorized Google integrations, including Google Analytics, Google Search Console, Google Ad Manager, or other Google services where the applicable integration is enabled and authorized.

When you connect a third-party account, Novaloom may receive information permitted by the authorization you provide and by the relevant third-party API.

Where an integration is described as read-only, Novaloom intends to use the information for the specific functionality for which access was granted, such as analytics, account synchronization, reporting, or operational management.

We do not treat authorization to access one third-party service as authorization to collect unrelated information.

You may revoke an OAuth authorization through the relevant third-party account or service, subject to the third party's procedures.

After access is revoked, Novaloom may retain information that was previously obtained where retention is reasonably necessary for legitimate business purposes, contractual obligations, security, legal obligations, accounting, dispute resolution, or other lawful purposes.

6 How We Use Personal Data

Depending on the context, Novaloom may use personal data to:

Account and Service Operations

• create and manage accounts;
• authenticate users;
• manage organizations and memberships;
• provide dashboards and services;
• manage permissions and entitlements;
• provide customer support;
• configure websites and advertising inventory;
• operate APIs and integrations;
• synchronize authorized third-party accounts; and
• provide requested functionality.

Monetization and Advertising Operations

• manage authorized advertising inventory;
• facilitate authorized monetization routes;
• support header bidding or Open Bidding integrations where applicable;
• coordinate authorized demand partners;
• support direct advertiser or agency deals;
• operate marketplace functionality;
• manage campaigns and deals;
• measure advertising performance;
• calculate or estimate monetization metrics;
• perform revenue reconciliation;
• optimize eligible demand routes; and
• provide monetization reporting.

Security and Fraud Prevention

• protect accounts and systems;
• detect unauthorized access;
• identify abuse;
• investigate suspicious activity;
• detect invalid or potentially fraudulent traffic;
• protect advertising ecosystems;
• maintain platform integrity;
• enforce contractual restrictions;
• investigate security incidents.

Analytics and Product Improvement

• understand service usage;
• measure website and application performance;
• diagnose technical problems;
• evaluate feature performance;
• improve platform reliability;
• develop reporting and analytics;
• improve operational workflows; and
• develop and evaluate product functionality.

Legal and Administrative Purposes

• comply with applicable legal obligations;
• respond to lawful requests;
• maintain business records;
• enforce agreements;
• resolve disputes;
• protect legal rights;
• prevent fraud and abuse; and
• satisfy accounting, tax, regulatory, and compliance requirements.

7 Legal Bases for Processing

Where applicable law requires a legal basis for processing personal data, Novaloom may rely on one or more of the following bases:

• Performance of a contract — where processing is necessary to provide services or fulfill contractual obligations.
• Legitimate interests — where processing is necessary for legitimate business, security, operational, analytical, or commercial interests and those interests are not overridden by applicable rights.
• Consent — where consent is required or otherwise appropriate.
• Legal obligation — where processing is necessary to comply with applicable law.
• Protection of rights and interests — where permitted by applicable law.

The appropriate legal basis depends on the particular processing activity and jurisdiction.

8 Advertising, Header Bidding, Open Bidding and Programmatic Demand

Novaloom may support or integrate with advertising technologies and demand sources, including:

• publisher ad servers;
• Google Ad Manager;
• SSPs and exchanges;
• header bidding technologies;
• Open Bidding where authorized;
• managed demand;
• alternative advertising networks;
• native advertising providers;
• video advertising providers;
• direct advertiser and agency demand;
• owned-media campaigns;
• marketplace deals; and
• other authorized monetization partners.

The availability of a particular demand source does not mean that every publisher, website, visitor, inventory type, geography, or traffic source is eligible for that demand source.

Each advertising or demand partner may independently determine its eligibility requirements, privacy requirements, contractual requirements, traffic-quality requirements, and technical requirements.

Novaloom does not represent that connecting a publisher to Novaloom guarantees approval by any third-party advertising platform.

9 Advertising and Website Visitor Data

When Novaloom technology is implemented on a publisher website or application, information associated with website or application activity may be processed for purposes such as:

• delivering authorized advertisements;
• measuring advertising performance;
• determining whether an advertising request is eligible;
• preventing fraud and invalid traffic;
• analyzing inventory performance;
• supporting demand competition;
• measuring fill and yield;
• enforcing advertising policies;
• detecting technical failures; and
• providing reporting to authorized customers and partners.

The precise information processed depends on the implementation, advertising partners, consent configuration, jurisdiction, and applicable contractual requirements.

Where required, appropriate consent or privacy controls should be implemented before processing data for purposes that require user consent.

10 Cookies and Similar Technologies

Novaloom and its service providers may use cookies, pixels, SDKs, local storage, server-side identifiers, and similar technologies.

These technologies may be used for:

• authentication;
• account security;
• session management;
• preferences;
• analytics;
• service performance;
• advertising measurement;
• fraud prevention;
• traffic-quality analysis;
• frequency or campaign management;
• attribution;
• reporting; and
• other permitted purposes.

Cookies and similar technologies may be operated by Novaloom or by authorized third parties.

Where required by applicable law, Novaloom or the relevant publisher may provide a consent mechanism or preference-management interface.

Your browser or device may also provide controls for managing cookies and similar technologies. Disabling certain technologies may affect the availability or functionality of some services.

11 Interest-Based Advertising and Privacy Choices

Advertising technology may involve processing information to provide contextual, personalized, or otherwise targeted advertising where permitted.

Depending on the applicable jurisdiction, consent status, publisher configuration, and advertising partner, advertising may instead be limited, contextual, non-personalized, or otherwise restricted.

You may have rights or choices concerning:

• personalized advertising;
• cookies;
• advertising identifiers;
• consent;
• sale or sharing of personal information;
• targeted advertising;
• measurement technologies; and
• other forms of data processing.

The availability of these choices depends on applicable law and the services involved.

Where Novaloom acts on behalf of a publisher or customer, that customer may provide the applicable privacy preference interface or consent-management mechanism.

12 Disclosure of Personal Data

Novaloom may disclose or make available personal data to appropriate categories of recipients, including:

Service Providers

Companies that provide services necessary to operate Novaloom, such as:

• hosting providers;
• cloud infrastructure providers;
• database and storage providers;
• security providers;
• analytics providers;
• communication providers;
• customer-support systems;
• payment providers;
• monitoring providers; and
• other technology service providers.

Advertising and Demand Partners

Where authorized and applicable, information may be shared with:

• advertising platforms;
• SSPs;
• exchanges;
• header bidding partners;
• Open Bidding participants;
• demand networks;
• advertisers;
• agencies;
• direct-deal participants; and
• other authorized advertising ecosystem participants.

The information shared depends on the specific integration, applicable privacy requirements, consent status, contractual arrangements, and technical protocol.

Customers and Publishers

Where appropriate, Novaloom may provide publishers, organizations, advertisers, agencies, or other customers with information relating to their own websites, inventory, campaigns, accounts, transactions, and performance.

Novaloom does not provide one customer's confidential account information to another customer merely because both customers use Novaloom.

Professional and Legal Advisors

We may disclose information to:

• lawyers;
• accountants;
• auditors;
• insurers;
• consultants;
• regulators;
• courts; and
• other professional advisors or authorities where legally permitted or required.

Corporate Transactions

Personal data may be disclosed in connection with:

• mergers;
• acquisitions;
• financing;
• restructuring;
• asset sales;
• corporate reorganizations; or
• similar transactions.

13 Data We Do Not Sell

Novaloom does not sell personal information merely because it operates an advertising technology platform.

However, certain privacy laws use broader definitions of terms such as "sale" or "sharing" that may include certain advertising or technology disclosures even where money is not directly exchanged for the personal information itself.

Where such laws apply, Novaloom will address applicable rights and disclosures according to the relevant legal requirements.

14 Data Processing by Publishers and Customers

Publishers and other customers using Novaloom may be responsible for determining:

• what information they collect;
• which technologies they deploy;
• what notices they provide;
• whether consent is required;
• how consent is obtained;
• what advertising partners they authorize;
• what data-processing instructions they provide;
• how long information should be retained; and
• how they respond to individual privacy requests.

Publishers should ensure that their own privacy policies, cookie notices, consent-management systems, contracts, and website configurations accurately reflect their use of Novaloom and other advertising technologies.

Novaloom may provide technical functionality to support these requirements but does not replace the publisher's own legal or compliance responsibilities.

15 Data Retention

Novaloom retains information only for as long as reasonably necessary for the purposes described in this Privacy Policy, contractual obligations, legitimate business purposes, security, accounting, legal requirements, dispute resolution, and enforcement of agreements.

Retention periods may vary depending on the type of information.

For example:

• account information may be retained while an account remains active and for an appropriate period afterward;
• security and audit records may be retained for periods necessary for security and compliance;
• transaction and financial records may be retained according to applicable accounting and tax requirements;
• telemetry and analytics data may have configurable retention periods;
• backups may retain information for a limited additional period before expiration;
• credentials and sensitive authentication material should have stricter lifecycle controls; and
• information subject to a legal hold may be retained for the duration of that obligation.

When information is no longer required, Novaloom may delete, anonymize, aggregate, or otherwise securely dispose of it, subject to applicable legal and technical limitations.

16 Data Security

Novaloom uses reasonable technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, misuse, or destruction.

Depending on the system and service, security controls may include:

• authentication;
• authorization;
• role-based access controls;
• tenant isolation;
• encryption in transit;
• encryption at rest where appropriate;
• credential and secret management;
• API security;
• rate limiting;
• audit logging;
• monitoring;
• backup controls;
• environment separation;
• access reviews;
• incident response procedures; and
• infrastructure security controls.

No method of transmission, storage, or processing can be guaranteed to be completely secure.

17 International Data Transfers

Novaloom may operate globally and may use service providers or infrastructure located in countries other than the country where you reside.

Where personal data is transferred internationally, Novaloom intends to use appropriate safeguards required by applicable law.

Depending on the jurisdiction, these safeguards may include:

• contractual protections;
• approved transfer mechanisms;
• adequacy decisions;
• standard contractual clauses;
• data-processing agreements;
• regional storage controls; or
• other legally recognized safeguards.

Data residency and international-transfer requirements may vary by customer, service, and jurisdiction.

18 Your Privacy Rights

Depending on where you live and subject to applicable legal limitations, you may have rights concerning your personal data.

These may include the right to:

• request access to personal data;
• request correction of inaccurate information;
• request deletion;
• request restriction of processing;
• object to certain processing;
• request data portability;
• withdraw consent where processing is based on consent;
• opt out of certain forms of targeted advertising;
• opt out of certain sale or sharing activities where applicable;
• request information about categories of personal data processed; and
• appeal a privacy-rights decision where required by applicable law.

Certain rights may be subject to exceptions, verification requirements, or other legal limitations.

19 How to Submit a Privacy Request

To submit a privacy request, contact:

Email: support@novaloom.co

Please provide enough information for us to understand and verify your request.

For security purposes, Novaloom may need to verify your identity before fulfilling certain requests.

If Novaloom processes your information on behalf of one of its customers, we may direct your request to the relevant customer where appropriate, or assist that customer in responding to the request according to the applicable contractual and legal framework.

20 Children's Privacy

Novaloom's services are not intentionally directed toward children where prohibited by applicable law.

We do not knowingly seek to collect personal information from children in circumstances where such collection is prohibited.

If you believe that a child has provided personal information to Novaloom in circumstances where it should not have been collected, please contact us at:

support@novaloom.co

We will evaluate the request and take appropriate action as required by applicable law.

21 Artificial Intelligence and Automated Processing

Novaloom may use analytics, machine learning, predictive models, automation, or artificial-intelligence technologies to support functions such as:

• traffic analysis;
• demand analysis;
• revenue and yield analysis;
• anomaly detection;
• forecasting;
• recommendation generation;
• operational assistance;
• optimization;
• reporting; and
• other platform functions.

AI or automated systems may process information necessary for these functions.

Novaloom's architecture is designed so that automated systems operate within defined authorization, policy, security, ownership, and operational boundaries.

Automated recommendations do not necessarily constitute final decisions, and the availability of an AI-generated recommendation does not independently authorize an otherwise prohibited action.

Where required by applicable law, Novaloom will provide applicable information concerning automated processing and individual rights.

22 Analytics and Measurement

Novaloom may process analytics and measurement information to understand:

• traffic;
• inventory;
• advertising performance;
• fill rates;
• revenue;
• yield;
• demand performance;
• campaign performance;
• technical performance;
• operational performance; and
• other service metrics.

Advertising and revenue measurements may originate from multiple systems and may therefore be estimates, observed values, reported values, adjusted values, or finalized values depending on the measurement stage.

Analytics information may be aggregated, anonymized, or otherwise processed for reporting and platform-improvement purposes where permitted.

23 Invalid Traffic, Security and Abuse Prevention

Because Novaloom operates in the advertising ecosystem, the platform may process technical and behavioral signals to identify:

• suspicious traffic;
• automated activity;
• invalid traffic;
• fraudulent activity;
• abuse;
• account compromise;
• manipulation of advertising systems;
• unusual activity; and
• other security or integrity risks.

These systems may produce risk indicators or classifications.

Such indicators are intended to support security, policy, and operational decisions and should not automatically be interpreted as a definitive statement about an individual's identity, intentions, or conduct.

24 Third-Party Services and Links

Novaloom may link to or integrate with third-party websites, platforms, applications, advertising services, analytics systems, payment providers, or other services.

Third parties operate under their own privacy policies and terms.

Novaloom does not control the privacy practices of independent third parties.

You should review the applicable privacy policy of a third-party service before providing information to that service or authorizing an integration.

25 Advertising Partners and Subprocessors

Novaloom may use third-party providers and advertising partners to operate particular services.

The categories of third parties may change as the platform evolves.

Depending on the service, these may include:

• cloud and hosting providers;
• analytics providers;
• advertising and monetization platforms;
• SSPs and exchanges;
• header bidding providers;
• demand networks;
• fraud and traffic-quality providers;
• payment processors;
• communication providers;
• security providers;
• customer-support providers; and
• other infrastructure or technology providers.

Where applicable law or contractual requirements require disclosure of subprocessors, Novaloom may maintain or provide an applicable subprocessor list or equivalent disclosure.

26 Direct Deals and Marketplace Transactions

Novaloom may support direct advertiser, agency, publisher, or marketplace relationships.

Where a publisher participates in a direct deal or marketplace transaction, Novaloom may process information necessary to:

• identify the relevant parties;
• classify inventory;
• create or manage proposals;
• establish deal terms;
• manage campaigns;
• manage budgets or pricing;
• monitor pacing;
• measure delivery;
• reconcile transactions;
• provide reporting; and
• administer contractual obligations.

Commercial visibility does not automatically provide access to publisher inventory.

Inventory access remains subject to applicable publisher permissions, contractual terms, technical eligibility, privacy requirements, monetization policies, and execution controls.

27 Partner APIs and Data Access

Novaloom may provide APIs to approved partners, publishers, advertisers, agencies, demand providers, and other ecosystem participants.

API access may be subject to:

• authentication;
• authorization;
• scopes;
• permissions;
• inventory grants;
• contractual restrictions;
• rate limits;
• data minimization;
• schema validation;
• security controls;
• audit logging; and
• other applicable policies.

Access to one Novaloom API or resource does not automatically provide access to other data, accounts, organizations, websites, or inventory.

28 Business and Operational Communications

Novaloom may contact you regarding:

• account administration;
• security;
• service changes;
• technical issues;
• billing;
• transactions;
• legal notices;
• policy changes;
• support requests;
• product functionality; and
• other service-related matters.

Where permitted by law, Novaloom may also send marketing or promotional communications.

You may unsubscribe from marketing communications using the applicable unsubscribe mechanism.

Certain transactional, security, legal, or service communications may continue even if you opt out of marketing communications.

29 Data Aggregation and De-Identification

Where permitted by applicable law, Novaloom may aggregate, de-identify, anonymize, or otherwise transform information so that it is no longer reasonably associated with an identifiable individual.

Such information may be used for purposes including:

• analytics;
• reporting;
• benchmarking;
• security;
• product development;
• research;
• service improvement;
• business analysis;
• operational planning.

Novaloom will apply appropriate safeguards to information that is intended to be treated as de-identified or anonymized.

30 Data Accuracy

We take reasonable steps to maintain accurate information appropriate to the purpose for which it is processed.

However, information may originate from users, publishers, third-party platforms, advertising partners, automated systems, or other sources.

Accordingly, Novaloom cannot guarantee that all information received from third parties or generated by automated systems will always be complete, accurate, or current.

31 Privacy by Design

Novaloom's platform architecture is intended to incorporate privacy and security considerations throughout the product lifecycle.

Depending on the applicable system, this includes principles such as:

• collecting information for defined purposes;
• minimizing unnecessary data collection;
• separating tenant data;
• limiting access based on permissions;
• protecting credentials and secrets;
• maintaining audit records;
• applying retention controls;
• validating external data;
• controlling partner access;
• supporting consent and privacy signals; and
• maintaining explicit boundaries between data collection, analytics, policy, execution, and automation.

32 Changes to This Privacy Policy

Novaloom may update this Privacy Policy from time to time.

Changes may be made to reflect:

• changes to our services;
• changes to technology;
• new advertising or monetization capabilities;
• changes to third-party integrations;
• changes to legal or regulatory requirements;
• changes to our data practices; or
• other operational or business developments.

When we make material changes, we may provide additional notice where required by applicable law.

The "Last Updated" date at the beginning of this Privacy Policy indicates when the policy was most recently revised.

33 Contact Us

If you have questions, concerns, or requests concerning this Privacy Policy or Novaloom's privacy practices, please contact us:

Novaloom

Email: support@novaloom.co

We will review privacy inquiries and respond in accordance with applicable law and our contractual obligations.

34 Important Notice for Publishers and Customers

35 Governing Privacy Requirements

This Privacy Policy is intended to describe Novaloom's privacy practices at a general level.

Depending on where you live, where your organization operates, where your users are located, and which Novaloom services you use, additional privacy laws or contractual requirements may apply.

These may include, where applicable:

• data-protection laws;
• consumer privacy laws;
• electronic communications and cookie laws;
• advertising and consent requirements;
• children's privacy requirements;
• international data-transfer requirements;
• sector-specific privacy requirements; and
• contractual data-processing obligations.

Where a specific law or contractual agreement provides additional rights or requirements, those provisions may apply to the relevant processing activity.