PRIVACY POLICY

About Us

Tapjoy, Inc. ("Tapjoy") operates an ad network platform that allows app developers to serve ads within their apps, and advertisers to promote their products, and services within apps.

We collect information in either of 2 ways:

1. Directly – through our SDKs integrated by app developers in their apps. SDK, or a Software Development Kit, is a software component that allows us to serve ads in a mobile app, and to collect information directly from such apps.

2. Indirectly – through other third-party mediation platforms with which we engage in order to serve ads in apps, or by receiving information from our advertisers, or affiliates.

Scope

This privacy policy describes Tapjoy’s privacy practices with respect to information it processes through its ad network. This privacy policy does not govern the use of our website, dashboard for publishers, and dashboard for advertisers.

Tapjoy serves ads to users all around the world. Accordingly, throughout the document, we try to harmonize our approach and the language of the privacy policy as much as possible. However, sometimes we refer to specific laws that require further disclosures. For example, whenever you see throughout the policy the annotation “The GDPR angle”, it means that the purpose of such section is to satisfy the transparency requirements of the General Data Protection Regulation (the “GDPR”), and therefore it applies only to personal data (as defined by the GDPR) associated with devices who we deem to be located in the European Economic Area, United Kingdom, or Switzerland. If you are a resident of California, Virginia, Colorado or Connecticut, please see the “State Privacy Rights” section of this privacy policy for information related to privacy laws in these states.

INFORMATION WE COLLECT THROUGH OUR AD NETWORK PLATFORM

Identifiers: Advertising ID, IP address, a self-created ID unique to a specific app, and IDs unique only to apps of the same developer. The term Advertising ID refers to the Google Advertising ID on Android devices, and ID For Advertising (“IDFA”), on iOS devices . The Advertising ID is a resettable persistent identifier generated by Android or iOS that allows online advertising companies to recognize a device across apps, for advertising purposes. You can find additional information about how to limit our use of the Advertising ID under “How to Control Information”. If you submit a customer support request to us, we will also collect your email address in order to respond to your request.

General technical information about a device: Technical information such as the device’s time zone, the amount of free memory on the device, the name and version of the app to which the ad is served, battery status, operating system name and version, the language of the operating system, time zone, the name of the mobile carrier, internet connection type (e.g. WiFi), etc.

Campaign information: An indication if an ad was viewed, or clicked, or if there was an install of an advertised app. Information about actions performed within an advertiser’s app following such an install, such as in-app purchases, and level in the game (if the advertiser chooses to provide such information). Publishers, at their option, may also share with us information about what level of the game you are on and your in-app purchases.

HOW WE USE INFORMATION WE COLLECT

We use the information we collect through our ad network platform to provide you with the service and to serve ads on app developers' apps. More specifically, we use that information in the following ways:

• Ad delivery: we use the information to technically enable the delivery of ads to your device.
• To serve you offers customized based on your interests inferred from your past activity.
• To serve you offers based on information such as the publisher app, technical parameters of the device, and interactions with the offerwall.
• Reporting, billing and attribution: Generating reports for our publishers and bill advertisers and publishers, including for ensuring that if you interacted with our ads, we will receive payment for our service.
• Internal Operations: For internal operations, such as debugging, support, security, and improving our services.
• Optimization and frequency capping: For optimizing advertising campaigns, including for limiting the number of times you view a specific campaign across our network, or the number of ads you view in a specific app.
• Whitelisting/blacklisting: We allow advertisers to upload lists of device IDs to include/exclude in, or from their advertising campaigns.
• To notify app developers of when you earn rewards through our platform, so they can increase your in-app virtual currency balances by the amount of the reward.
• To respond to and resolve your customer support requests.
• To prevent and detect fraud.

The GDPR Angle:

Our legal basis for processing personal data:

• When we process personal data for operating our ad network, including for purposes listed above, such as optimization and frequency capping, reporting, attribution, fraud detection and prevention and internal operations, we process data as a data controller and we rely on our legitimate interests, and the legitimate interests of our app developer and advertiser partners.
• When we process personal data for the purpose of serving you offers based on your interests, we process data as a data controller, and we rely on your consent.
• When we process personal data for the purpose of serving you offers based on information such as the publisher app, technical parameters of the device, and interactions with the offerwall, we rely on our legitimate interests, and the legitimate interests of our app developer and advertiser partners
• When we process personal data for the purpose of excluding/including devices from, or in an ad campaign, we act as a processor on behalf of our app developer or advertiser partner, who also chooses the applicable legal basis for such processing, as the data controller.
• We may also process personal data for compliance with applicable legal obligations. In that case, we shall act as a data controller and our legal basis is compliance with a legal obligation.

HOW WE SHARE INFORMATION

We share information with:

• App developers and advertisers: To provide you with the service and for the purposes of attribution, whitelisting/blacklisting and reporting, as stated above, and as required to investigate and resolve your customer support requests.
• Our corporate affiliates: For the purposes described in this privacy policy.
• Service providers: for the purpose of receiving services such as fraud detection and prevention, viewability measurement, reporting, and storage.
• We may also disclose information if we have a good faith belief that disclosure of such information is reasonably necessary to: (i) comply with any applicable law, regulation, legal process or governmental request; (ii) enforce our agreements and policies, including investigations of potential violations thereof; (iii) investigate, detect, prevent, or take action regarding illegal activities or other wrongdoing, suspected fraud or security issues; (iv) to establish or exercise our rights to defend against legal claims; (v) prevent harm to the rights, property or safety of us, our users, yourself or any third party; (vi) for the purpose of collaborating with law enforcement agencies or in case we find it necessary in order to enforce intellectual property or other legal rights; or (vii) when we are undergoing any change in control, including by means of merger, acquisition or purchase of all or substantially all of our assets.

HOW LONG DO WE KEEP INFORMATION COLLECTED?

We keep information as long as necessary to provide our services, generally speaking. Information used for interest-based ad targeting is rotated out on a 90-day basis. Conversion data and non-production backups of production data are retained for longer due to financial records and disaster recovery requirements.

HOW TO CONROL INFORMATION

Updated versions of iOS, and Android, enable you to control how apps can collect the Advertising ID. To do that, please follow the below instructions:

• iOS devices (iOS 14+): go to Settings > Privacy > Tracking > Allow Apps to Request to Track. Please note that if you use more than one device, you need to opt-out separately in each device.
• Android devices: Please follow the instructions set forth at: https://support.google.com/ads/answer/1660762 (under Mobile devices). Please note that if you use more than one device, you need to opt-out separately in each device.

The GDPR Angle:

Withdraw consent – You have the right to withdraw the consent you provided to us. You can withdraw your consent from within the app you provided to us the consent (this will affect only our processing within this specific app), or by following the instructions above on how to control collection of device data (this will affect our processing of data of all apps on your device).

Data subject rights – Please note that you have the right to request from us access to and rectification or erasure of your personal data we process as controllers, or to restrict or to object to processing of your personal data in accordance with the provisions of the GDPR. To submit a request for exercising your rights, please use one of the following ways:

• For access and erasure requests, submit your request through our online form, which can be accessed here.
• For other data subject requests, please send an email with your request to the following address: tapjoy-privacy-request@unity3d.com.

Please note that we will process your request subject to verification, and authentication of your identity.

Complaint to supervisory authority – You also have the right to file a complaint with the relevant supervisory authority (e.g. of your country or domicile) where Tapjoy has not addressed your concerns.

INTERNATIONAL TRANSFERS

We store information that we collect from a device on our Amazon Web Services and Google Cloud servers in the United States. Accordingly, please note that if you do not live in the United States, we will transfer your information to and store it in the United States.

The GDPR Angle:

We will transfer personal data to third parties located outside of the European Economic Area, the United Kingdom, or Switzerland based on standard contractual clauses.

CHILDREN

If you believe your child has provided us with personal information, you may contact us at tapjoy_privacy@unity3d.com and we will make reasonable efforts to delete the information from our records.

The GDPR Angle:

We do not collect or otherwise process personal data from individuals in the European Economic Area, the United Kingdom, and Switzerland whom we know to be under the applicable age stated in the different implementations of the GDPR, except to comply with law or to support our legitimate interests or the legitimate interests of our app developers partners as described above.

CHANGES TO OUR PRIVACY POLICY

We may revise this privacy policy from time to time. The most current version of the policy will govern our processing of information and is posted at https://dev.tapjoy.com/en/legal/Privacy-Policy. If we make a change to this policy we will post the revised privacy policy to this page.

STATE PRIVACY RIGHTS

California, Virginia, Connecticut and Colorado residents have certain rights under state privacy laws with respect to personal data we collect. If you are a resident of such states, this section of the privacy policy contains disclosures required by law and explains rights that may be available to you.

This section applies only to personal data that is subject to the state laws noted above.

In many cases, we act as a service provider or processor to collect personal data from, or on behalf of, customers who use our services. These customers have their own privacy policies that describe how they use information. To the extent that we are processing personal data subject to state privacy laws on behalf of a customer in our role as a service provider or processor, you should reach out to that customer directly to exercise your rights under state privacy laws.

The remainder of this section provides disclosures for users for cases where we are not acting as a service provider or processor to a customer.

Personal Data We Collect and Disclose: In the past 12 months, we have collected, sold (including sharing for targeted advertising), and disclosed for business purposes the following categories of personal data. We do not knowingly sell, nor do we share or process for targeted advertising purposes, personal data about consumers under the age of 16.

Categories of Personal Data	Disclosed for business purposes to the following categories of third parties:	Sold to the following categories of third parties (including sharing for targeted advertising purposes):
Personal and online identifiers (such as first and last name, email address, or unique online identifiers)	See the “How We Share Information” Section	All categories listed below.
Commercial or transactions information (like records of products or services purchased, obtained, or considered)	See "How We Share Information" Section	Not sold.
Internet or other electronic network activity information (such as browsing history, search history, interactions with a website, email, application, or advertisement)	See the “How We Share Information” Section	All categories listed below.
Geolocation information	See the “How We Share Information” Section	All categories listed below.
Other information about you that is linked to the personal information above	See the “How We Share Information” Section	All categories listed below.

Categories of Sources – As described in the “About Us” section above, we collect personal data from the following categories of sources:

1. Directly through our SDKs integrated by app developers in their apps.

2. Advertising partners.

Our Purposes for Processing Personal Data – We use and disclose the personal data we collect for our commercial and business purposes, as further described above in the “How We Use the Information We Collect” and the “How We Share Information” Sections.

Recipients of Personal Data – Although we do not sell personal data for monetary consideration, we do sell personal data, including sharing for targeted advertising purposes, subject to users’ choices communicated to us by app developers, to the categories of third parties listed below:

• Advertising/marketing companies;
• App developers

Your Rights Regarding Personal Data – Residents of certain states have rights with respect to the personal data collected by businesses like Tapjoy. You may be able to exercise the following rights regarding your personal data, subject to certain exceptions and limitations: The right to confirm whether we are processing personal data about you.

• The right to correct inaccuracies in the personal data we have collected about you.
• The right to know the categories and specific pieces of personal data we collect, use, disclose, and sell about you, the categories of sources from which we collected your personal data, our purposes for collecting or selling your personal data, the categories of your personal data that we have either sold (including shared for targeted advertising purposes) or disclosed for a business purpose, and the categories of third parties with which we have disclosed personal data.
• The right to request that we delete the personal data we have collected from you or maintain about you.
• The right to opt out of our sale of your personal data and our processing (including sharing) for targeted advertising purposes. Please note that if you opt out of certain practices, we may be unable to provide you with some services.
• The right not to receive discriminatory treatment for the exercise of the above privacy rights.

While some states provide residents with rights related to “sensitive” personal data, Tapjoy does not collect this type of personal data.

Exercise your rights – To exercise any of the above rights, please use one of the following ways:

• For exercising your rights to know or to delete personal data, submit your request through our online form, which can be accessed at https://ironsrc.formtitan.com/ftproject/tj-privacy
• Alternatively, you may send an email with your request to the following address: tapjoy-privacy-request@unity3d.com

Depending on your state, if you have submitted a request that you believe we have not fulfilled, you may contact us to appeal our decision by replying to our response to your request, or by contacting us at tapjoy-privacy-request@unity3d.com.

Verification Process and Required Information – Note that we may need to request additional information from you to verify your identity or process your request, although you will not be required to create an account with us to submit a request or have it fulfilled. We will require you to provide, at a minimum, your email address and state of residence. We will also collect information that identifies your device when you submit a request, in order to help verify your identity.

Authorized Agent – You may designate an authorized agent to make a request on your behalf by verifying your identity and providing the agent with written permission to make the request on your behalf.

Information about California resident requests in 2022 – As required by California law, Tapjoy has provided the following information about requests it received from California residents in 2022.

Request type	Requests received	Requests complied with	Requests denied	Mean number of days for response
Request to know	562	100	462	2.8 days
Request to delete	1219	508	711	1.87 days

CONTACT US

Tapjoy, Inc.

℅ Unity Technologies SF

30 3rd Street

San Francisco, CA 94564

tapjoy_privacy@unity3d.com

Attn: Data Protection Officer

Please note, these communication channels do not support customer support matters. Please visit https://tapjoy.helpshift.com/hc/en/ to access our customer support center for help with customer support questions or concerns.

Effective Date: September 12, 2023