Loading...
Loading...
How YieldMaximizer collects, uses, and protects information across our websites and advertising platform
Last updated: October 2026
This Privacy Policy explains how YieldMaximizer, Inc. and its group companies collect, use, disclose, and safeguard information when you interact with our websites, our advertising platform, and our business. It also explains the rights and choices available to you. Please read it alongside our Cookie Policy and our Platform Privacy Notice.
YieldMaximizer, Inc. ("YieldMaximizer", "we", "us", or "our") is a global advertising technology company. We provide a connected set of products for digital advertising, including a supply-side platform (SSP), an advertising network, header bidding solutions, ad serving infrastructure, analytics and reporting, invalid traffic and fraud detection, and brand safety controls. Our technology helps publishers monetize their inventory and helps media buyers reach audiences across websites, mobile applications, and connected television.
In this Privacy Policy, "you" and "user" refer to any individual about whom we process personal information or personal data. This includes visitors to our websites, registered users of our platform, publishers and media buyers who use our services, business prospects and their representatives, event attendees, and people who view or interact with advertising delivered through our platform.
Our principal offices are:
Capitalized terms that are used but not defined in this Privacy Policy have the meanings given in our Terms of Use or in the applicable client agreement.
This Privacy Policy applies to personal information that we process when you:
This Privacy Policy does not apply to:
YieldMaximizer operates in the programmatic advertising ecosystem, connecting publishers who make advertising inventory available with media buyers who want to reach audiences. When a person loads a web page, mobile application, or connected television stream that carries our technology, an auction runs in real time: we issue a bid request describing the available impression, demand partners submit bids, and the winning creative is delivered to the screen. The entire process typically completes in under 50 milliseconds so that content loads without noticeable delay.
Our Platform connects publishers to more than 60 demand partners, including demand-side platforms, agency trading desks, and brand-direct buyers. Transactions occur through open exchange auctions, private marketplaces, and programmatic guaranteed deals, as well as through header bidding wrappers that invite multiple demand sources to compete for the same impression at the same time. Alongside auction services, we provide ad serving, analytics and reporting, audience segmentation support, invalid traffic filtering, and brand safety controls.
We act in two different roles depending on the circumstances:
We collect several categories of information depending on how you interact with us. This section describes each of them.
We collect information that you give us when you use our websites and services, including:
When you visit our websites or use our services, we collect information through automated means:
When our technology is present on a publisher's inventory, we process data that is tied to pseudonymous identifiers rather than to direct identifiers:
The ad serving path is not tied to direct identifiers such as your name, email address, or account number. Where we hold direct identifiers about you, they arrive through the channels described in Sections 4.1 and 4.4, not through bid requests or ad delivery.
We receive information about you from a range of third-party sources:
We do not intentionally collect sensitive personal information or special categories of personal data through our websites or the Platform. We instruct clients and partners not to send such information, and where we detect it in bid streams or files we take steps to filter it out.
We use a variety of collection methods:
We use the information described in Section 4 for the following purposes.
We share personal information only as described in this Privacy Policy or with your consent. The subsections below describe our categories of recipients and why they receive information.
We share information with our group companies and subsidiaries for joint administration of our business, security operations, and delivery of services. Affiliates that receive personal information are bound by confidentiality protections consistent with this Privacy Policy and process the information only for the purposes described here.
When our technology operates on a publisher's inventory, we share with that publisher the information it needs to run its business, including:
Publishers are independent controllers for the data they receive and handle it under their own privacy notices.
Media buyers and advertisers active on the Platform receive:
We engage service providers that process information on our behalf, including cloud hosting and data center providers, customer relationship management and email delivery vendors, payment processors, analytics and security tooling providers, auditors, and professional advisors. These providers are bound by contracts that permit them to use the information only to provide services to us.
We work with independent measurement firms that verify ad delivery, viewability, and brand safety, and that link campaign exposure to outcomes such as visits or purchases. These partners receive pseudonymous identifiers and event-level delivery data needed to perform their measurements.
We exchange pseudonymous identifiers with identity resolution providers that maintain maps linking browsers, applications, and devices. This allows reach and frequency to be measured and managed across environments. Identity partners do not receive direct identifiers from the ad serving path.
If we are involved in a merger, acquisition, financing, or sale of all or part of our assets, your information may be transferred as part of that transaction. Where required by law, we will notify affected users before their personal information is transferred to a different controller or becomes subject to a different privacy notice.
We may disclose information:
In some cases we disclose information for other purposes or to other recipients only with your consent. Where processing is based on consent, you may withdraw it at any time as described in Section 10.7. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.
To deliver and measure advertising across browsers, applications, and devices, we and our partners link pseudonymous identifiers associated with those environments. This supports cross-device reach, frequency management, and conversion attribution. You can opt out of these activities as described in Sections 10.8 and 10.9.
Where the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies, we rely on the following legal bases:
Where a legal basis listed above does not apply to a specific processing activity, we seek your consent before carrying it out.
Depending on where you live and how you interact with us, you may have some or all of the following rights and choices.
You may request confirmation of whether we process personal information about you and, where we do, request a copy of that information together with details such as the categories of data, the sources, the purposes, the recipients, and the retention periods applicable to it.
You may ask us to correct or complete personal information that is inaccurate or incomplete. Where we have shared corrected information with other recipients, we will notify them of the correction where feasible.
You may ask us to delete personal information we hold about you. We will comply unless an exception applies, for example where we must retain the information to comply with a legal obligation, to detect or prevent fraud, to establish or defend legal claims, to complete a transaction you requested, or to protect the security of our systems. In those cases we will explain what we have retained and why.
You may ask us to restrict processing of your personal information in certain circumstances, for example while we verify its accuracy, where you contest its accuracy, where processing is unlawful but you prefer restriction over deletion, or where you need the data for the establishment or defense of legal claims but we no longer need it for our purposes.
Where processing is carried out by automated means and is based on your consent or on a contract with you, you may request a copy of the personal information you provided to us in a structured, commonly used, and machine-readable format, and you may ask us to transmit it to another controller where this is technically feasible.
You may object, on grounds relating to your particular situation, to processing based on our legitimate interests. This includes profiling carried out as part of interest-based advertising. Where your objection applies to direct marketing, we will stop that processing. For other processing, we will stop unless we can demonstrate compelling legitimate grounds that override your interests and rights, or where the processing is needed for legal claims.
Where processing is based on your consent, you may withdraw it at any time, free of charge and without affecting the lawfulness of processing carried out before withdrawal. You can withdraw consent for cookies and tracking through your browser settings or our cookie preference tools, and for marketing through the unsubscribe links in our messages or by contacting us at privacy@yieldmaximizer.com.
Several U.S. state privacy laws give you the right to direct businesses not to "sell" or "share" your personal information, which in practice means opting out of processing for cross-context behavioral advertising or targeted advertising. As explained in Section 11, some of the information exchanges that support our advertising services may be characterized as a sale or sharing under those laws. You can opt out through the choices offered on our websites, through Platform controls where available, or by contacting privacy@yieldmaximizer.com.
We honor the Global Privacy Control (GPC) signal transmitted by supported browsers and extensions. When we detect an active GPC signal, we treat it as a valid opt-out request for that browser or device. Opting out means you will see less personalized advertising; you will continue to see ads, but they will be less relevant to your inferred interests.
Independent industry programs also let you opt out of interest-based advertising from many participating companies at once:
Please note that these opt-outs generally apply per browser, per device, and per profile. If you use several browsers or devices, you will need to opt out on each one, and clearing or blocking cookies may cause an opt-out to be lost so that it needs to be set again.
You can stop receiving marketing emails at any time by using the unsubscribe link at the bottom of any marketing message or by emailing privacy@yieldmaximizer.com. We will honor opt-out requests promptly. We may still send you service-related and transactional messages, such as account notices and security alerts, because these are needed to operate our relationship with you.
To exercise any of the rights described above, email privacy@yieldmaximizer.com or use the account settings available in the Platform where applicable. To protect your information, we will verify your identity using information proportionate to the sensitivity of the request, and we may ask for details that help us locate your records. We respond within the timeframes required by applicable law, typically 30 to 45 calendar days. Where an extension is permitted, we will notify you and explain why more time is needed.
You may authorize an agent to submit requests on your behalf. To do so, provide the agent with written permission, and be aware that we may still contact you directly to confirm the request and verify your identity. Where permitted by law, an agent that can demonstrate valid power of attorney may act without additional confirmation.
If we decline a request, in whole or in part, you may appeal by replying to our decision notice or by writing to privacy@yieldmaximizer.com within a reasonable period. We will review the appeal and respond within the period required by applicable law. If your appeal is denied, we will tell you what steps, if any, you can take next, which may include escalating the matter to your state attorney general or another regulator, or lodging a complaint with your supervisory authority as described in Section 12.
We will not discriminate against you for exercising your privacy rights. This means we will not deny you goods or services, charge you different prices, provide a different level of quality, or suggest that you will receive a different level of service because you exercised a right, except as permitted by applicable law, such as where the value of a program is reasonably tied to data you chose not to provide.
Comprehensive consumer privacy statutes are now in effect in a growing number of U.S. states, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. Several other states have enacted privacy laws focused on specific sectors or data types. This Privacy Policy serves as our notice at collection for purposes of those laws, and the rights described in Section 10 are available to residents of the states that provide them.
Some of the exchanges of information described in Section 7, including transfers of pseudonymous identifiers to demand partners, measurement partners, and identity partners for interest-based advertising and measurement, may be characterized as a "sale" or "sharing" of personal information under these laws even though no payment changes hands in exchange for your data. You may opt out of these activities at any time using the tools described in Sections 10.8 and 10.9, including by transmitting a Global Privacy Control signal, which we honor as a valid opt-out request.
We do not sell or share the personal information of consumers we know to be under 18 years of age, and we do not knowingly process the personal information of anyone under 16 for targeted advertising. See Section 17 for our practices regarding children.
We do not intentionally collect or process sensitive categories of personal information. Where we process de-identified information, we take reasonable measures to ensure that it cannot be associated with an individual, we publicly commit to maintaining and using it only in de-identified form and not attempting to re-identify it, and we contractually require any recipients to comply with the same obligations.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the rights described in Section 10, including the rights to access, rectification, erasure, restriction, portability, and objection, and you may withdraw consent at any time as described in Section 10.7.
You also have the right to lodge a complaint with a supervisory authority. In the EEA, you may contact the authority in your country of residence or employment; a list of authorities is maintained by the European Data Protection Board (EDPB). In the United Kingdom, the relevant authority is the Information Commissioner's Office (ICO). In Switzerland, the relevant authority is the Federal Data Protection and Information Commissioner (FDPIC).
In a limited number of situations, for example where we and a client jointly determine the purposes and means of a specific processing activity on the Platform, we act as a joint controller with that client. In those cases we have put an arrangement in place with the client that allocates responsibility for providing privacy information and honoring your rights, and we will make the essence of that arrangement available to you on request.
We have appointed a Data Protection Officer who can be reached at dpo@yieldmaximizer.com or at our London office address in Section 21 for questions about this Privacy Policy, our roles, or your rights.
YieldMaximizer operates globally, with offices in the United States, the United Kingdom, and Singapore, and with service providers in several countries. Where we transfer personal data from the EEA, the UK, or Switzerland to countries that do not benefit from an adequacy decision, we rely on the following transfer mechanisms:
Where required, we also carry out transfer impact assessments and add supplementary measures. You may request a copy of the transfer mechanisms we rely on by contacting privacy@yieldmaximizer.com; we may redact portions that contain confidential or commercially sensitive information.
YieldMaximizer, Inc. has self-certified to the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the DPF, and the Swiss-U.S. Data Privacy Framework with respect to personal data received from the European Union, the United Kingdom, and Switzerland, respectively. We adhere to the Framework principles of notice, choice, accountability for onward transfer, security, data integrity and purpose limitation, access, and recourse, enforcement, and liability as published by the U.S. Department of Commerce.
Our certification commitments are enforceable under U.S. law, including by the Federal Trade Commission (FTC). In the event of a conflict between this Privacy Policy and the Framework principles, the principles prevail for data received under the Framework.
Onward transfers: where we share personal data received under the Framework with service providers or other third parties, we remain accountable for that data and require recipients to commit to process it only for limited and specified purposes and to provide at least the same level of protection we provide under the Framework.
If you have a question or complaint about our handling of data received under the Framework, please contact our Data Protection Officer at dpo@yieldmaximizer.com first, and we will respond within 45 days. If we cannot resolve the matter to your satisfaction, you may use the independent dispute resolution mechanisms associated with the Framework, and for certain unresolved claims you may invoke the binding arbitration option described in the Framework's dispute resolution provisions after first escalating to our Data Protection Officer and using those other mechanisms.
We retain personal information only as long as necessary for the purposes described in this Privacy Policy, taking into account the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, and any legal obligations that require longer retention, such as tax and accounting rules, statutory limitation periods, and the need to establish or defend legal claims. When we no longer need personal information, we delete it securely or convert it into de-identified or aggregate form that can no longer be associated with you.
The table below shows typical retention periods for the main categories of information we hold.
| Category of Information | Retention Period |
|---|---|
| Account and registration data | For the life of your account, and up to 90 days after closure to allow restoration, then deleted |
| Billing and financial records | 7 years, to meet tax, accounting, and audit obligations |
| Platform, auction, and ad serving records | Up to 13 months, after which retained only in aggregate or de-identified form |
| Usage and analytics data | Up to 26 months, then aggregated or de-identified |
| Communications, marketing, and support records | Up to 3 years from your most recent interaction; opt-out suppression records are kept while needed to honor your choices |
| Backups and archives | Up to 12 months on a rolling cycle, and deleted or overwritten as backups rotate |
Where law requires us to keep information for a longer period than shown above, or where a specific agreement with a client specifies different periods, the longer or agreed period applies.
We use administrative, technical, and physical safeguards designed to protect the information we hold, including:
No system or set of safeguards is perfect, and no method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee its absolute security. If we become aware of a security incident that affects your personal information and notice is required by law, we will notify you and the appropriate regulators as required.
Our websites and services are directed to business users and are not directed to children under 16, and we do not knowingly collect personal information from children under 16 through them. Consistent with Section 11, we do not sell or share the personal information of anyone under 18.
If we learn that we have collected personal information from a child, we take prompt steps to delete it and to stop any further collection. If you believe a child has provided us personal information, please contact us at privacy@yieldmaximizer.com or dpo@yieldmaximizer.com with the details so we can investigate and remediate.
Clients that use the Platform on properties directed to children, or that knowingly process personal information from children, are contractually required to comply with the Children's Online Privacy Protection Act (COPPA) and other applicable children's privacy laws, to obtain verifiable parental consent where required, and to configure their integrations so that children's data is not passed into bid streams.
Our websites, Platform, and communications contain links to third-party websites and services, and our advertising technology operates alongside technology from many other companies. These third parties operate under their own privacy notices and practices, which may differ from ours. We do not control and are not responsible for the content, privacy practices, or security of third-party services. We encourage you to read the privacy notice of every service you use, including publisher sites where our tags are present, before providing personal information. Linking to a third-party service is not an endorsement of that service.
We participate in the advertising industry's self-regulatory programs and standards:
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. The "Last updated" date at the top of this page shows when the current version took effect, and the updated version will be posted on this page.
For material changes, we will provide additional notice, such as a notice on our websites or a direct email to accountholders and other users with whom we have an active relationship. Where a change requires new consent under applicable law, we will seek that consent before applying the change. Your continued use of our websites or services after the effective date of an updated Privacy Policy means you accept it, subject to any consent requirements just described. Copies of prior versions are available on request from privacy@yieldmaximizer.com.
If you have questions about this Privacy Policy, our practices, or your rights, you can reach us through any of the following channels:
You can also write to us at:
For the purposes of the GDPR and the UK GDPR, YieldMaximizer, Inc. is the controller for the processing described in this Privacy Policy, except where Section 3 explains that a client or another party is the controller. Our Data Protection Officer for the EU, the UK, and Switzerland can be contacted at dpo@yieldmaximizer.com or at our London office address above.