Privacy Policy
Last updated: September 1, 2026 · AdX9.com
01 Who we are
AdX9.com ("AdX9", "we") operates a real-time programmatic advertising exchange with floors in Chicago, Frankfurt and Singapore. This policy covers data on adx9.com, seat-holder operations, and — at the summary level — the bid-path data we process for supply and demand partners under marketplace agreements (where partners act as controllers and AdX9 as processor).
02 Data we process
- Seat & business contacts: names, work emails, company details and KYB information for seat provisioning and billing.
- Bid-path data (as processor): pseudonymized request identifiers, truncated/coarse IP where required, device and OS class, coarse geography, format metadata, consent-string state, and auction outcomes. Raw personally identifying data never enters the bid path.
- Site telemetry: request logs retained 90 days for security. This website uses no advertising or analytics cookies.
03 Principles
- Consent-respecting by construction: TCF v2.2 / US state signals are evaluated at request admission; consentless traffic receives contextual, non-personalized treatment.
- Data minimization: identifiers are pseudonymized and rotated; precise location and sensitive categories are prohibited in marketplace terms.
- Immutable logs: request/response logs are append-only and auditable by the seat that generated them.
04 Purposes & bases
- Operating the exchange and matching supply to demand — contract / legitimate interest.
- Fraud prevention and market integrity — legitimate interest (our rulebook obliges it).
- Seat billing, KYB and tax compliance — contract and legal obligation.
05 Recipients & transfers
Data is shared with seat partners as needed to transact, with cloud and NOC infrastructure providers under contract, and with auditors or authorities where the law requires. International transfers use EU Standard Contractual Clauses / UK IDTA. Sub-processor list: [email protected].
06 Retention
Event-level bid data: 30 days raw, 13 months aggregated. Seat business records: statutory retention (typically 7 years). KYB records: 5 years post-relationship. Site logs: 90 days.
07 Your rights
Under GDPR, UK GDPR, CCPA/CPRA and similar laws, you may request access, correction, deletion, restriction, portability, and object to processing; we do not sell or "share" personal information as defined by the CPRA. End-users of publisher inventory should contact the publisher or seat first — they are the controllers; we assist promptly. Direct requests: [email protected], answered within 30 days. You may also contact the Illinois Attorney General, your EU supervisory authority, or equivalent.
08 Security
TLS 1.3 on all exchange endpoints, mTLS between seats and the exchange, AES-256 at rest, HSM-backed key custody, SOC 2 Type II program, and continuous scanning of creative demand. Vulnerability disclosure: [email protected].
09 Children & sensitive data
Marketplace terms prohibit processing children's data and sensitive categories. Violations are treated as fraud under the seat agreement.
10 Changes & contact
Material changes are posted here with a new date and noticed to active seats. Contact: AdX9.com, Attn: Privacy, 233 S Wacker Dr, Suite 4100, Chicago, IL 60606, USA · [email protected].