Privacy Policy

1) Who we are

ApexMediation is a brand owned and operated by Bel Consulting OÜ (Estonia) ("we", "us"). This Privacy Policy explains how we handle personal data when you use our website, developer documentation, Console, SDKs, and APIs (collectively, the "Services").

2) Roles under GDPR (Controller vs Processor)

Depending on the context, we act as:

• Controller for data collected on our website and for account/contract administration (for example, contact requests, account signup, security communications).
• Processor for end-user data processed on behalf of our publisher customers when they use ApexMediation in their apps/sites.

If you are an end user of a publisher's app, the publisher is typically the Controller for ad-monetization data. Your primary privacy contact is that publisher.

3) Data we collect

The data we process depends on how you interact with the Services.

Website & sales/contact

• Contact details (name, email), company name, message contents.
• Basic analytics/telemetry about site usage (see Cookies section below).

Console & platform operations

• Account identity data: email, name, organization membership, roles/permissions.
• Billing & finance contacts and records needed to provide the service.
• Security and audit logs (e.g., sign-in events, API key creation, admin actions).

SDK / ad-transaction data (processed for publishers)

When publishers integrate the ApexMediation SDK and backend APIs, we may process data required to run auctions, detect fraud, provide reconciliation, and deliver reporting. The exact fields depend on the publisher's integration and configuration.

• App identifiers (publisher app ID, placement ID) and configuration signals.
• Event telemetry (impressions, clicks, revenue events) and operational diagnostics.
• IP address and device/network metadata may be processed for fraud prevention, rate limiting, and security.

We aim to minimize collection and avoid cross-publisher sharing. Publishers control their own end-user relationships and consent obligations.

4) Purposes and legal bases

• Contract: to provide the Console, APIs, and support; to administer accounts and billing.
• Legitimate interests: to secure the Services, prevent abuse/fraud, improve reliability, and maintain audit logs.
• Consent: where required for certain cookies/analytics or marketing communications.
• Legal obligations: compliance, accounting, and record retention.

5) Sharing and subprocessors

We may share data with service providers (subprocessors) that help us host, monitor, and operate the Services (for example: infrastructure providers, email delivery, error tracking). We require subprocessors to protect data and only process it for agreed purposes.

For ApexMediation-hosted deployments, our current subprocessors include:

Updates and objection process are described in our Data Processing Addendum. If you are an end user of a publisher app, your data sharing is primarily governed by that publisher.

6) International transfers

We are based in the EEA (Estonia). Some vendors may process data outside the EEA. When this happens, we use appropriate safeguards (such as Standard Contractual Clauses or equivalent mechanisms) as required under GDPR.

7) Security

We use technical and organizational measures designed to protect data, including access controls, encryption in transit where supported, and audit logging. No system is perfectly secure; we encourage customers to use strong access controls and protect API keys.

8) Retention

We keep personal data only as long as necessary for the purposes described above, including legal, accounting, and security needs. Operational logs and reconciliation evidence may be retained longer where required for fraud prevention, dispute handling, or regulatory obligations.

9) Your rights

If we act as Controller for your data, you may have rights under GDPR, including access, rectification, erasure, restriction, portability, and objection. You may also lodge a complaint with your local supervisory authority.

If we act as Processor (for example, for end-user data in a publisher's app), we will assist the Controller as required; requests should generally be directed to the publisher.

10) Cookies

We use cookies and similar technologies for basic site functionality and (optionally) analytics. See our Cookie Policy for details.

11) Changes

We may update this Policy to reflect changes in our Services or legal requirements. We will post the updated version on this page with a new “Last updated” date.