Emitra — Performance Marketing Network (“Emitra“, “we“, “us“, or “our“) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect information when you visit our websites, use our dashboards and APIs, participate in our advertiser/publisher marketplace, or otherwise interact with our services (collectively, the “Services“).

This Policy applies to advertisers/merchants (“Advertisers“), publishers/affiliates/creators (“Publishers“), agencies, and visitors/end‑users who interact with tracking links, coupon codes, pixels, or partner content (“End Users“).

If you do not agree with this Policy, you should not use the Services.

1. Who We Are & Roles Under Privacy Laws

Depending on the context, Emitra may act as:

• a controller/business (e.g., for our website analytics, account data, payment records, and network operations), and/or
• a processor/service provider on behalf of Advertisers for conversion tracking, reporting, fraud prevention, and payout operations.

We process personal data in accordance with applicable laws, including the EU/UK GDPR, CCPA/CPRA (California), and India’s Digital Personal Data Protection Act, 2023 (DPDP Act), as applicable.

2. Information We Collect

2.1 Information You Provide

• Account & Profile: name, email, phone, company, role, addresses, country, tax IDs (e.g., PAN/GST/VAT/TIN), payout details (e.g., bank/Wise/Payoneer/UPI), verification documents.
• Program Operations: campaign settings, geo restrictions, creative assets, product feeds, ad copy, keyword lists, disclosures, compliance attestation.
• Support & Communications: messages, tickets, call notes, feedback, surveys.

2.2 Information We Collect Automatically

• Service Usage: IP address, device/user‑agent, language, referrer, timestamps, session IDs, page views, event logs, error logs.
• Tracking & Attribution Data: click IDs, link parameters, coupon/code usage, pixel/postback events, transaction IDs, cart/order metadata (e.g., SKU/category, AOV), app install/open events, validation status (approved/void/returned), and deduplication identifiers across channels.
• Fraud & Security Signals: abnormal CTR/CR indicators, bot/VPN/proxy signals, velocity checks, geolocation approximation, fingerprinting signals (where permitted), and duplicate lead markers.

2.3 Information From Third Parties

• Advertisers & Publishers: order/lead/install confirmations, refund/cancel status, audience segments (where permitted), and placement details.
• Service Providers: payment processors, KYC/verification vendors, analytics, anti‑fraud tools, and hosting/CDN services.

We do not intentionally collect sensitive personal data unless required by law or for specific programs (e.g., regulated financial/health campaigns) with explicit controls and consent.

3. How We Use Information (Purposes & Legal Bases)

We use information to:

1. Provide and operate the Services (accounts, dashboards, APIs, links, coupons, pixels, postbacks). (Performance of contract / Legitimate interests)
2. Measure and attribute conversions across partners; deduplicate events; credit commissions. (Legitimate interests / Processor on behalf of Advertisers)
3. Prevent fraud and abuse, enforce policies, and ensure brand safety. (Legitimate interests / Legal obligations)
4. Process payments & payouts; manage invoices, taxes, and accounting. (Performance of contract / Legal obligations)
5. Support and communicate with users; respond to inquiries; provide updates and service notices. (Performance of contract / Legitimate interests)
6. Improve the Services, including analytics, testing, and product development. (Legitimate interests)
7. Comply with laws, regulatory requests, and enforce agreements. (Legal obligations / Legitimate interests)
8. Marketing our Services to business users (B2B), with opt‑out options. (Consent where required / Legitimate interests)

Where consent is required by law for setting cookies or processing certain data, we will obtain it (e.g., via a banner/consent manager).

4. Cookies & Similar Technologies

We use cookies, local storage, pixels, postback URLs, and similar technologies to:

• recognize browsers/devices;
• attribute clicks, code usage, and conversions;
• route users to geo‑specific storefronts;
• detect invalid traffic; and
• remember preferences.

You can manage cookies in your browser settings. Some features may not function properly without certain cookies. Where required, we present consent choices.

Cookie Categories (examples):

• Strictly Necessary: session, security, load balancing.
• Performance/Analytics: page views, feature usage, latency.
• Attribution/Advertising: click IDs, affiliate IDs, coupon/code attribution, conversion events.

A detailed cookie list is available on request and may be displayed in our cookie banner.

5. Disclosures & Recipients of Information

We share information with:

• Advertisers and Publishers to operate campaigns (e.g., clicks, conversions, placements, approvals, payout statuses). We minimize personal data and share aggregated or pseudonymized data where possible.
• Service Providers & Sub‑processors (hosting, analytics, anti‑fraud, payment processors, communications, KYC/verification), bound by confidentiality and data‑processing terms.
• Corporate Transactions (merger, acquisition, financing, or sale of assets), subject to appropriate protections.
• Legal & Safety authorities where required by law or to protect rights, safety, or the integrity of our Services.

We do not sell personal information for money. To the extent “share” or “sale” under CPRA could include cross‑context behavioral advertising, we provide opt‑out mechanisms where applicable.

6. International Data Transfers

We operate globally and may transfer data to countries that may have different data protection laws. Where required, we use appropriate safeguards (e.g., EU Standard Contractual Clauses or UK addendum) and technical/organizational measures to protect data during transfer.

7. Data Retention

We retain information for as long as necessary to fulfill the purposes outlined in this Policy, comply with legal and tax obligations, resolve disputes, and enforce agreements. Typical retention periods: tracking logs and attribution data 12–36 months (or as required by campaign terms), financial records 7 years (or applicable law).

8. Security

We implement administrative, technical, and physical safeguards designed to protect information, including encryption in transit, access controls, role‑based permissions, logging, and incident response processes. No method of transmission or storage is 100% secure.

9. Your Privacy Rights

Depending on your location, you may have rights to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Delete data (subject to lawful exceptions);
• Portability of certain data;
• Object or restrict certain processing;
• Withdraw consent where processing is based on consent;
• Opt out of certain marketing or cross‑context behavioral advertising (where applicable).

To exercise rights, see Section 12.

End Users: Many requests (e.g., order/lead details) are best directed to the Advertiser whose products/services you interacted with. We will forward or assist as appropriate where we act as a processor.

10. Children’s Privacy

Our Services are intended for business users and are not directed to children. We do not knowingly collect personal data from children under the age required by local law. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.

11. Automated Decision‑Making & Profiling

We use rule‑based systems to detect fraud/invalid traffic and to attribute conversions (e.g., last‑click/first‑click/time‑decay). We do not make decisions with legal or similarly significant effects solely by automated means without human involvement.

12. How to Exercise Your Rights

Submit a request to privacy@emitra.co with: (a) your name, (b) email, (c) country/region, (d) the right you wish to exercise, and (e) any relevant IDs (e.g., click ID, order ID, publisher ID). We may verify your identity and request additional details to locate records. Authorized agents may submit requests where allowed by law.

You may also manage certain preferences in your account settings (where available) and unsubscribe from marketing emails via the link in the message.

13. India‑Specific Disclosures (DPDP Act, 2023)

• Data Fiduciary/Processor: Emitra acts as a Data Fiduciary for its own operations and as a Data Processor on behalf of Advertisers for campaign tracking.
• Consent & Notices: Where consent is required, we provide a notice describing the personal data and purpose. You may withdraw consent at any time.
• Grievance Officer: See Section 16 for contact details. We endeavor to respond to grievances within timelines prescribed by Indian law.

14. EEA/UK‑Specific Disclosures (GDPR/UK GDPR)

• Controller Details: Emitra acts as controller for our own operations and as processor for Advertiser campaigns. For processor activities, the Advertiser is the controller; our Data Processing Addendum (DPA) is available upon request.
• Legal Bases: performance of contract, legitimate interests (e.g., attribution, fraud prevention), consent (e.g., certain cookies/marketing), legal obligations.
• EU Representative / DPO (if appointed): Available upon request at privacy@emitra.co.

15. US‑Specific Disclosures (CCPA/CPRA and others)

• No sale for monetary consideration. We may share limited identifiers for attribution/fraud prevention, which may be considered “sharing” under CPRA; you can opt out where applicable.
• Sensitive information: We do not use sensitive personal information for purposes other than those permitted by law.
• Right to Non‑Discrimination: We will not discriminate against you for exercising privacy rights.

16. Contact Us & Grievance Redressal

Privacy Contact:
Emitra — Performance Marketing Network
Email: privacy@emitra.co

For legal notices, see our Terms of Use.

17. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a revised effective date and, where required, provide additional notice. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.

18. Additional Documents

• Data Processing Addendum (DPA) — available upon request for controller/processor relationships and cross‑border transfers.
• Cookie Notice — provides a detailed list of cookies/technologies used and consent options.
• Security Overview — summary of technical and organizational measures.

If this Policy is provided in multiple languages, the English version controls in case of conflict.