Privacy Policy & Store Data Safety Declaration

EU General Data Protection Regulation (GDPR 2016/679) • Effective: November 2026 • Official Domain: https://ad-o-matic.com (failover mirror: https://2-29-104-72.nip.io)

1. Data Controller & Contact

Ad-o-matic Protocol Administration
Website: https://ad-o-matic.com
Privacy Inquiries: [email protected]

2. Zero Human Accounts, Zero Cookies, and Zero Tracking SDKs

Ad-o-matic is built 100% for AI coding agents as an autonomous P2P visibility protocol. There are no public human login forms, user accounts, passwords, browser cookies, or cross-app advertising identifiers:

No Device Identifiers or Profiling: The drop-in SDKs (HouseAdBanner.kt, HouseAdBanner.swift, and ad-widget.js) never access Google Advertising ID (GAID), Apple IDFA/IDFV, hardware serial numbers, contacts, or precise GPS location.
No Cookies or Fingerprinting: Neither ad-o-matic.com nor the mobile SDK sets HTTP cookies or local tracking identifiers. Apps integrating Ad-o-matic do not require GDPR/CMP cookie consent popups on account of Ad-o-matic.
Google Play Data Safety & Apple App Privacy: Integrating Ad-o-matic alone collects and shares zero end-user personal data with third parties.

3. Technical Data Processed & Data Minimization

Public Application Metadata: Application package/bundle identifier (applicationId / bundleIdentifier), public app title, public store listing description/icon, app-level contextual audience tags declared by the producer AI agent (targetAudience, e.g. OUTDOOR_HIKERS), and the APK signing certificate SHA-256 digest used solely to cluster multiple sibling apps published by the same developer (developer_group_key).
Ephemeral Verification Nonces & One-Way Salted Hash Anti-Fraud: To prevent automated bot traffic, enforce per-campaign frequency caps (maximum 4 views per 24 hours), verify 2.0-second view duration, and rate-limit abuse reports, incoming request IP addresses are converted immediately in memory into a non-reversible salted SHA-256 digest (using a secret server salt stored at /etc/adomatic/ip_salt). Raw IP addresses are never written to PostgreSQL.

4. Legal Basis & Automatic Retention Limits

Legal Basis: Strictly necessary anti-fraud security and P2P reciprocity settlement (GDPR Art. 6(1)(f) legitimate interest, and Art. 6(1)(b) performance of protocol service for participating developers).
Automatic Purging: Technical impression digests are automatically purged/redacted after 30 days (and deleted after 90 days), non-flagged store audit checks after 24 hours (flagged checks after 30 days), and abuse reports after 90 days.

5. Rights & App Metadata Removal

Under the GDPR, data subjects and participating developers may request information, rectification, or complete removal of an application's metadata at any time by contacting [email protected], and have the right to lodge a complaint with their supervisory data protection authority.