Privacy Policy
Effective date: May 8, 2026 · Last updated: May 8, 2026
This Privacy Policy explains how Qityol Inc. ("Qityol", "we", "our", or "us") collects, uses, and protects information when you use Qityol Ads Studio. It applies to both advertiser account data and listener-side signals used for campaign targeting.
1. Introduction
We are committed to protecting your privacy and handling data responsibly. This policy is intended to be transparent about what data we collect, why we collect it, and how it is used. Please read it carefully alongside our Terms of Service.
2. Data Controller
Qityol Inc. is the data controller for personal data processed through the Ads Studio platform. For listener data processed on behalf of third-party publishers integrated into the Qityol exchange, Qityol acts as a data processor.
Qityol Inc.
Email: privacy@qityol.com
3. Information We Collect
We collect the following categories of information:
Account Information
Name, email address, company name, billing address, and payment method details (tokenized — raw card data is never stored by Qityol).
Campaign Data
Creatives (audio files, scripts, banner images), targeting parameters, budget settings, bid strategies, and scheduling configurations.
Performance Metrics
Impressions, clicks, listen-through rates, conversions, and spend data aggregated at the campaign and ad-unit level.
Usage Data
Pages visited within the Platform, features used, session duration, browser type, and IP address (used for security and product analytics).
Listener Signals (Aggregated)
Genre preferences, mood signals, listening session context, and demographic cohorts derived from Qityol's audio platform — never linked to identifiable individuals when used for ad targeting.
Communications
Messages you send to our support team or any survey responses.
4. How We Use Information
We use the information we collect to:
- Provision, operate, and improve the Ads Studio Platform.
- Deliver your campaigns to the correct audiences on the right inventory.
- Process payments and manage your wallet balance.
- Send you transactional emails (campaign alerts, billing receipts, security notices).
- Provide aggregated reporting and performance analytics.
- Detect and prevent fraud, invalid traffic, and abuse.
- Comply with legal obligations and respond to lawful requests.
- Conduct internal research and product development using anonymized/aggregated data.
We will only send you marketing communications (product updates, feature announcements) with your explicit consent, which you can withdraw at any time.
5. Campaign & Creative Data
Audio creatives and banner images you upload are stored securely and used exclusively to serve your campaigns. Qityol does not use your creatives to train AI models or share them with other advertisers.
Campaign configuration data (targeting, budgets, schedules) is retained for the life of your account to enable historical reporting. Deleted campaigns are marked inactive and removed from active delivery; their configuration data is retained for 12 months for audit purposes, then permanently deleted.
6. Third-Party DSP Data Sharing
When you activate the Multi-DSP Bridge, your campaign parameters (creative URLs, targeting segments, bid values, flight dates) are transmitted to the selected third-party network (Google Ad Manager, Spotify Megaphone, AdsWizz). Each network processes this data under its own privacy policy:
We only share the minimum data required to execute your campaign. We do not sell advertiser personal data to any third party.
8. Data Retention
We retain personal data for as long as necessary to fulfil the purposes described in this policy:
- Account data: retained while your account is active and for 3 years after closure for legal/financial compliance.
- Campaign performance data: retained for 5 years to support historical reporting.
- Creative assets: deleted within 90 days of campaign deletion or account closure.
- Server access logs: retained for 90 days for security monitoring.
After the applicable retention period, data is securely deleted or anonymized.
9. Security
We implement technical and organisational safeguards to protect your data including:
- TLS 1.3 encryption for all data in transit.
- AES-256 encryption for data at rest in our database.
- Row-level security (RLS) policies in Supabase Postgres.
- Two-factor authentication (2FA) available for all accounts.
- Regular third-party security audits and penetration testing.
No method of transmission over the internet is 100% secure. If you become aware of a security vulnerability please report it responsibly to security@qityol.com.
10. Your Rights
Depending on your location you may have the following rights regarding your personal data:
Access
Request a copy of the personal data we hold about you.
Rectification
Correct inaccurate or incomplete information.
Erasure
Request deletion of your data (subject to legal retention requirements).
Portability
Receive your data in a structured, machine-readable format.
Restriction
Ask us to restrict processing while a dispute is resolved.
Objection
Object to processing based on legitimate interests.
Opt-out of sale
We do not sell personal data. CCPA opt-out is therefore not applicable.
Withdraw consent
Withdraw consent for marketing at any time.
To exercise any of these rights, email privacy@qityol.com. We will respond within 30 days (GDPR) or 45 days (CCPA).
11. Children's Privacy
The Ads Studio Platform is not directed at children under the age of 13 (or 16 in the EU/UK). We do not knowingly collect personal data from children. Advertisers must not target campaigns to audiences under 13 without appropriate parental consent mechanisms in place.
12. International Transfers
Qityol is based in the United States. If you access the Platform from outside the US, your information may be transferred to and processed in the US. We use Standard Contractual Clauses (SCCs) approved by the European Commission as the legal basis for transferring personal data from the EEA or UK to the US.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email to your registered address and by displaying a prominent notice in the Platform dashboard for 30 days. The "Last updated" date at the top of this page will always reflect the most recent revision.
14. Contact Us
For privacy enquiries, data requests, or to reach our Data Protection Officer:
Qityol Inc. — Privacy Team
Email: privacy@qityol.com
Security: security@qityol.com
Legal: legal@qityol.com
You also have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or your national supervisory authority in the EU).