Privacy Policy

Welcome to FulyX (“FulyX”, “we”, “us” or “our”) advertising exchange platform, an online advertising platform that is designed to allow businesses to create, submit and/or place advertising or sponsored content on websites, software applications and services offered by us. FulyX advertising exchange platform is operated by HUNGRY TECHNOLOGY PTE. LTD., which is the controller and responsible for your personal information.

This privacy policy explains how we collect, use, and share information through our Services and advertising platform. This privacy policy applies to all information collected or processed through:

• The FulyX advertising exchange platform and related services (“Services”)
• The interactions between FulyX and its Business Partners (e.g., publishers)

For the purpose of this Policy, “Users” means individuals whose personal information is processed through our Services, including end users who view or interact with advertisements delivered via the FulyX platform. “Business Partners” means publishers, app developers, advertisers, advertising agencies, ad exchanges, SSPs, DSPs, ad networks, attribution partners, and other entities that integrate with or use the FulyX platform.

Depending on the nature of a User’s interaction with the FulyX Services, we may collect information from the following sources:

• From Business Partners via bid requests: We receive information contained in OpenRTB-compliant bid requests transmitted by SSPs, ad exchanges, and publishers when ad inventory becomes available for auction.
• From demand partners (DSPs and advertisers): When FulyX acts in a supply-side capacity, we receive information from DSPs and advertisers participating in our auctions, including creative metadata and campaign parameters.
• From measurement and attribution partners: After an ad interaction, we may receive post-engagement data from attribution partners to facilitate measurement and reporting.

Where required by applicable laws, we have contractually required our Business Partners to obtain valid consent from Users for the processing of their personal information as described in this Policy.

When Users view ads served through the FulyX platform or interact with services provided by our Business Partners, we and/or our Business Partners may collect the following information:

2.1 Information collected through SSPs and publishers:

• Location Information: IP address, country, time zone and locale setting (including country information and preferred language)
• Device ID / Advertising ID: IDFA (iOS), GAID (Android), IDFV, or other platform-specific advertising identifiers
• Device Information: device make, device model, operating system type and version, device type, screen size, device language setting, connection type and carrier name, whether the device is an emulator, user agent string
• Application Information: app bundle ID, app name, app store URL, app version, SDK version, publisher ID
• Interactive Information: information about User interaction with ads (whether the User viewed or clicked an ad, ad type, creative ID, video completion events, viewability measurements)
• Consent and Preference Signals: TCF v2.2 consent string, GPP string, ATT status
• Others: timestamp, system boot time, device event information (such as crashes, system activity)

2.2 Information received from demand partners and measurement partners:

• Campaign and Creative Information (advertiser domain, creative ID, creative type, landing page URL)
• Conversion and Attribution Data (post-click and post-install events, conversion timestamps, attribution signals)
• Audience Segments (IAB audience taxonomy segments where permissible and where valid consent exists)

2.3 Sensitive Personal Information

We will not actively collect or process Sensitive Personal Information of Users. Our Business Partners shall not transmit Sensitive Personal Information (including but not limited to health data, biometric data, genetic data, precise racial or ethnic origin, political opinions, religious beliefs, sexual orientation, financial account numbers, government-issued identifiers, or authentication credentials of end users) to FulyX without explicit prior written authorization and a valid legal basis.

If we inadvertently receive Sensitive Personal Information, we will delete or return it without processing, and notify the relevant Business Partner.

We process personal information for the following purposes, relying on the corresponding legal bases where required by applicable law:

4.1 Sharing

In the course of providing our Services, we may share Users’ personal information with the following categories of recipients:

• Demand Partners(DSPs, advertisers, ad networks): We transmit information via OpenRTB bid requests to facilitate real-time bidding auctions. The transmission of bid request data in the RTB process may constitute a “sale” or “sharing” of personal information under the CCPA and other US States Privacy Laws.
• Supply Partners (SSPs, publishers): We share auction results, delivery confirmations, and performance data as necessary to facilitate ad delivery, reporting, and payment reconciliation.
• Measurement and Verification Partners: We share limited information for viewability measurement, invalid traffic detection, brand safety verification, and attribution/conversion measurement.
• Attribution Partners: We share information to facilitate install attribution and post-engagement measurement on behalf of advertisers.

4.2 Entrusted Processing

We engage service providers (including cloud infrastructure providers, CDN providers, analytics tools) who process data on our behalf under written data processing agreements with appropriate security, confidentiality, and data protection obligations.

4.3 Public Disclosure

We will not publicly disclose Users’ personal information, except: (a) where we have obtained separate consent; (b) where disclosure is based on applicable laws, regulations, legal proceedings, or mandatory requirements of competent government authorities.

FulyX operates globally. Personal information collected through our Services may be transferred to and processed in jurisdictions other than where it was originally collected.

If you are located in the European Economic Area (“EEA”), United Kingdom, or Switzerland, personal information may be transferred to recipients in countries outside these regions. In such cases, we ensure appropriate safeguards are in place, including:

• EU Commission-approved Standard Contractual Clauses (SCCs)
• UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs
• Transfer Impact Assessments (TIAs)
• Supplementary technical measures (encryption, pseudonymization, access controls)

For other jurisdictions requiring specific transfer safeguards, we comply with applicable local requirements.

Subject to applicable law, you may generally have the following rights regarding your personal information:

• AccessConfirm whether we process your information and get a copy.
• CorrectionFix inaccurate or incomplete information.
• DeletionRequest deletion when the information is no longer needed or you withdraw consent.
• RestrictionAsk us to limit how your information is used in certain cases.
• ObjectionObject to processing based on legitimate interests (e.g., marketing, profiling).
• PortabilityReceive your information in a structured, machine-readable format.
• Opt-OutDecline "sale," "sharing," or "targeted advertising" where applicable.
• Withdraw ConsentWithdraw consent at any time (prior processing remains valid).
• AppealChallenge our decision on your privacy request where the law allows.
• Non-DiscriminationWe will not treat you differently for exercising your rights.

The specific rights available to you may vary depending on your jurisdiction and applicable law.

Because FulyX does not typically have a direct relationship with End Users, we recommend first contacting the publisher or app through which your data was collected. You may also contact us at privacy@fulyx.com. We will respond within the timeframe required by applicable law. We may need to verify your identity and may request your device advertising identifier to locate relevant records.

We implement industry-standard physical, technical, and administrative security measures to protect personal information from unauthorized access, use, disclosure, or destruction. These include encryption of data in transit and at rest, role-based access controls, regular security audits, and a documented incident response plan. In the event of a personal data breach, we will notify affected parties and supervisory authorities in accordance with applicable law.

When an inventory source (a publisher, SSP, or SDK) signals that an impression is child-directed or originates from a child-directed app or website — including through COPPA, TFCD, or TFUA flags in the bid request — we:

• serve only contextual advertising (no behavioral or interest-based targeting);
• do not build or apply audience segments, profiles, or look-alike models for that impression;
• do not use the associated device or user data for cross-app or cross-site tracking; and
• limit retention of any data linked to that impression to the minimum necessary for delivery and fraud prevention.

These restrictions are enforced in our bidding and delivery systems, not only in this Policy.

We retain personal information only for the period necessary to fulfill the purposes described in this Policy, after which it is securely deleted or irreversibly anonymized.

We determine retention periods based on:

• The nature and sensitivity of the personal information
• The purposes for which it is processed
• Applicable legal, regulatory, and contractual obligations (including tax and financial record-keeping requirements)
• Industry standards and best practices for programmatic advertising

In general, operational data related to ad delivery and auction processing is retained for shorter periods, while business records and financial data may be retained for longer periods as required by law.

We may update this Policy from time to time to reflect changes in our practices, applicable laws, or industry standards. When we make material changes:

• We will notify Business Partners by email at least 30 days before the effective date
• We will post an updated version with a revised “Last Updated” date on our website
• We will provide notice on the Business Partner dashboard

Continued use of our Services after the effective date of changes constitutes acceptance of the updated Policy.