Privacy Policy

Effective 2026-11-04

This policy explains what personal information dlserve (“dlserve”, “we”, “us”) collects, why, who receives it, how long we keep it, and the choices and rights you have. It applies to:

• our websites, dlserve.ai and docs.dlserve.ai;
• the publisher dashboard at app.dlserve.ai; and
• the dlserve service: the code that publishers install on their websites and apps (our JavaScript snippet, service worker file and Android and Windows software development kits), and the ads we deliver through it.

It does not cover the websites and apps of our publishers, or of advertisers whose ads you click. They have their own privacy policies.

1. Who we are and our role

dlserve is an advertising technology company. Publishers (owners of websites and apps) use dlserve to show ads to the people who visit or use their websites and apps (“End Users”).

• For information about publishers and their staff, and about visitors to our own websites, dlserve decides how the information is used.
• For information about End Users, the publisher decides to use dlserve on its website or app and is responsible for telling its End Users about it and for any consent the law requires. We process End User information to provide our service to the publisher and, as described in this policy, for our own purposes: preventing fraud and invalid traffic, keeping the service secure, measuring and settling ad revenue, meeting legal obligations and improving the service.

If you are in the European Economic Area, the United Kingdom or Switzerland, the publisher and dlserve are joint controllers for collecting your information through our code on the publisher’s website or app and sending it to us. The publisher is responsible for telling you about it and for any consent the law requires, and we are responsible for this policy and for answering requests about the information we hold. You can use your rights with either of us. For everything we do with the information afterwards, dlserve is the controller.

If you are an End User, the publisher’s own privacy policy also applies to you.

2. Visitors to our websites

Our websites, dlserve.ai and docs.dlserve.ai, do not use analytics, advertising cookies or tracking scripts of our own. Like any website, the servers that deliver them, run for us by Cloudflare, receive your IP address, browser user agent and the pages you request, and process them to deliver the pages and protect them from attacks. Cloudflare may set strictly necessary security cookies for that purpose.

If you email us, we receive your email address and whatever you choose to send, and we use it to reply.

3. Publishers and dashboard users

When you sign up for and use the dashboard, we collect:

• Account details: your publisher or company name, your email address, a hashed version of your password (we never store the password itself), your role, when you verified your email, signed in and changed your password, and a hashed version of your sign-in session token. Links we email you to verify your email address or reset your password are stored only in hashed form.
• Sign-up country, which our network provider, Cloudflare, works out from your IP address when you sign up.
• Your websites and apps: the addresses, names, app IDs and settings of the placements you create, and any privacy policy address you give us.
• App credentials you upload, such as a Firebase service-account key for Android push. We store them encrypted and use them only to deliver notifications to your app’s users.
• Activity records: for certain actions in the dashboard, a record of who did what and when, including the IP address and browser user agent used.
• Payment records: the payouts we calculate for you, their status, the payment method and payment reference, and any payment or tax details you send us so that we can pay you.
• Site analysis: when you use Match my site, we visit the pages you name with an automated browser, take screenshots of them or read their text, and send that to Google’s Gemini AI service to suggest prompt wording and styles. We store the results with your placement, and the screenshots in our file storage at unlisted web addresses that anyone who has the address can open.
• Messages you send us, and records of the emails we send you.
• Technical information from your browser when you use the dashboard, such as your IP address and browser user agent, in our server and error logs.

We use this information to create and run your account, deliver the service, calculate and make payouts, send you service and security emails, provide support, prevent fraud and abuse, keep records required by law, and improve the dashboard.

Our advertising exchange partner. When you verify your email address, we create a matching publisher account for you with an advertising exchange we work with, and send it your publisher name, email address and country, together with a password we generate for that account. The exchange uses this information under its own privacy policy.

Your contact email may be included, as a technical contact, in the requests we send to browser push services when we deliver notifications for your placements.

The dashboard stores your sign-in session, theme, language and some display preferences in your browser’s local storage. It does not use advertising or analytics cookies.

4. End Users of publishers’ websites and apps

What we collect depends on the ad formats a publisher uses.

4.1 Web push notifications

When you allow notifications from a website that uses dlserve, and again each time you visit that website while subscribed, we collect:

• your push subscription: the address and encryption keys your browser gives us to send it notifications;
• your IP address, and the country and region we work out from it using a geolocation database that runs on our own servers;
• your browser’s user agent, and the browser, operating system and device type we read from it;
• your language and time zone, as your browser reports them, and the website you subscribed on;
• a random subscriber ID, when you subscribed and when you were last active;
• your ad interactions: which ads we sent you, and which were shown and clicked;
• if the website passes them to us, a tracking reference (such as the ID of the ad campaign that brought you there), and a customer ID or labels the website attaches to your subscription.

When we ask whether you want notifications, we record your answer with your country, region, browser and operating system, but without any ID.

4.2 Ads on a website’s pages

Websites can also show in-page notifications, ads that open in a new tab (pop ads), and ads shown when you are about to leave a page or at other moments (exit-intent ads), whether or not you allowed notifications. For each of these ads, your browser requests the ad from our advertising partners, either directly or through our servers, and they receive your IP address, browser user agent, language, the address of the page and, if there is one, the tracking reference. We record when these ads are shown, clicked or closed, with your country, region, browser and operating system but without any ID.

4.3 Android apps

When you open an Android app that uses dlserve, the app registers your device to receive ad notifications, even if notifications for the app are turned off, and updates its registration each time you open the app. We collect:

• your push token, which Google’s Firebase Cloud Messaging service gives the app;
• your IP address, and the country and region we work out from it;
• your device model, Android version, the app’s version, and the user agent of your device’s built-in web browser component (or, where it is not available, a generic Android Chrome browser user agent);
• your language and time zone, and whether notifications from the app can currently be shown;
• a random subscriber ID, when you were registered and when the app last contacted us;
• your ad interactions: which ads we sent you, and which were shown and tapped;
• a customer ID or labels, if the app attaches them.

We do not collect your advertising ID or other hardware identifiers.

4.4 Windows apps

When ads start in a Windows app that uses dlserve, we collect a random install ID the app creates and a random subscriber ID linked to it, your IP address and the country and region we work out from it, your Windows version, the app’s name and version, your default web browser (used to build the browser user agent we use for ad requests), your language and time zone, whether ads are on for you (if the app asked you or showed you a notice: your answer, when you gave it and which version of the text you saw; and when you turned ads off), when ads started and when the app last contacted us, and your ad interactions, including whether an ad could be shown at that moment.

Before ads start, the app makes one check with us that carries no ID; we use your IP address only to look up your country for that check and do not store it.

4.5 What we do not collect

We do not collect End Users’ names, email addresses, phone numbers, precise location, contacts, files, or browsing history on other websites. A publisher could attach such information to a subscription as a customer ID or label; our terms forbid publishers from doing so.

4.6 How we use End User information

We use it to:

• deliver ads and notifications, and the publisher’s own messages;
• choose ads that suit your country, language and device;
• decide how often, and at what time of day, to send you ads, so that you are not over-messaged. For this we give each subscriber an engagement score, recalculated every hour from how they responded to earlier ads and how long they have been subscribed, and use their time zone. These scores only affect the number and timing of ads; they have no legal or similarly significant effect on you;
• check that ad views and clicks come from real people, and prevent fraud and abuse;
• count ads shown and clicked, report them to the publisher and settle ad revenue;
• keep the service secure, fix problems, and improve it, using aggregated information where we can; and
• comply with the law.

4.7 Our legal bases (EEA, United Kingdom and Switzerland)

For publishers and dashboard users:

• creating and running your account, delivering the Service, site analysis you ask for, calculating and making payouts, and service and security emails: to perform our contract with you or with the organization you work for (for the organization’s staff, our legitimate interest in performing that contract);
• creating your matching account with our advertising exchange partner: to perform our contract with you, as our Terms of Service describe;
• activity records, fraud and abuse prevention and security: our legitimate interest in protecting the Service, our publishers and our advertising partners;
• tax, accounting and other records the law requires: our legal obligations;
• improving the dashboard: our legitimate interest in developing our service.

For End Users:

• storing or reading information on your device (section 5), and delivering ads and notifications to you and requesting them from our advertising partners: your consent where the law requires it, which the publisher is responsible for obtaining for itself and for us before our code runs, or, in Windows apps that ask you, the consent you give in the app; where consent is not required, our and the publisher’s legitimate interest in funding the website or app through advertising;
• deciding how often and when to send you ads: our legitimate interest in not over-messaging you;
• checking that views and clicks come from real people, preventing fraud and keeping the service secure: our legitimate interest, and our advertising partners’, in preventing fraud and invalid traffic;
• counting ads, reporting to the publisher and settling ad revenue: our legitimate interest in being paid and paying publishers correctly;
• complying with the law: our legal obligations.

You do not have to give us any information, but without it we cannot run your account or deliver ads.

Your right to object. Where we rely on legitimate interests, you can object at any time on grounds relating to your situation. You can object at any time, without giving a reason, to our use of your information to send you ads, and we will stop: use the steps in section 10.1. Where we rely on consent, you can withdraw it at any time in the same way. This does not affect what we did before.

5. Cookies and similar technologies

On publishers’ websites, our code may store the following in your browser, on the publisher’s own domain. They are not shared with other websites.

Web push also uses a service worker, a small script your browser keeps for the website so it can receive notifications. Our Android and Windows code stores its settings, IDs and your ads choice on your device, in the app’s private storage.

6. Who we share information with

We share personal information with:

• Advertising partners, which choose and supply the ads. Each time we request an ad for you, they receive your IP address, a browser user agent, your language, your random subscriber ID, when you subscribed or ads started, the website address or app ID and, if there is one, the tracking reference. When an ad is shown or clicked, your browser or device also connects to their servers (to load the picture, report the view, or follow the click), through addresses on our domain, so they receive your IP address and device details again. They use this information under their own privacy policies, including to select ads and to detect fraud.
• Push services run by browser and operating system makers, such as Google (including Firebase Cloud Messaging), Mozilla, Microsoft and Apple, which carry web and Android notifications to your device. They receive your push subscription or token and the notification, which for web push is encrypted. Ads in Windows apps do not use a push service: the app collects them from us directly.
• Service providers that process information for us under contract: DigitalOcean (hosting, databases and storage, in the United States), Cloudflare (content delivery, network security, DNS and backup storage), Sentry (error monitoring), Resend (email delivery), and Google (Gemini, for the site analysis described in section 3).
• Our advertising exchange partner, for publisher account details as described in section 3.
• Publishers, who see reports and records about the End Users of their own websites and apps.
• Authorities and others, when the law requires it, or when needed to protect the rights, safety and security of dlserve, our users or the public, including to investigate fraud.
• A buyer or successor, if dlserve is involved in a merger, acquisition or sale of assets, subject to this policy.

Sale and sharing under US state laws. When we request and measure ads, we give our advertising partners End Users’ IP address, browser user agent, language, random subscriber ID, subscription time and the website or app, and we are paid for the ads they supply. Under the California Consumer Privacy Act and similar US state laws, we treat this as “selling” and “sharing” personal information and as “targeted advertising”. We do not knowingly sell or share the personal information of anyone under 16. See section 10.3 to opt out.

7. How long we keep information

8. International transfers

We host our service in the United States. If you are outside the United States, your information is transferred to and processed there, and by our service providers in other countries. For information that publishers in the European Economic Area, the United Kingdom or Switzerland transfer to us, we rely on the European Commission’s Standard Contractual Clauses, with the UK Addendum and the Swiss adaptations, which our Terms of Service incorporate. Our service providers process information under their own data processing terms, which include these clauses where they are needed. You can ask us for a copy at hello@dlserve.ai.

9. Security

We protect information with technical and organizational measures, including encryption in transit, hashed passwords and tokens, encrypted storage of app credentials, access controls on our systems, monitoring and backups. No system is completely secure, and we cannot guarantee the security of information sent over the internet.

10. Your choices and rights

10.1 Stopping ads

• Web push: block notifications for the website in your browser’s settings. We mark your subscription as ended when your browser tells us, or the next time we try to send you an ad; until then we may still request an ad for you.
• Ads on a website’s pages: close the ad, or leave the website. You can also clear the cookies listed in section 5.
• Android apps: use the app’s own ads setting, if it has one, or uninstall the app. Turning off notifications for the app hides the ads, but the app stays registered until you use its setting or uninstall it, and until then we may still request an ad for your device from time to time, which gives our advertising partners the information described in section 6.
• Windows apps: use the app’s own ads setting, or uninstall the app. We mark your install as ended when the app’s uninstaller tells us; if it does not, your record stays as it was until you ask us to delete it.

10.2 Your rights

Depending on where you live, you may have the right to ask for access to, a copy of, correction of, or deletion of your personal information; to object to or restrict how we use it; to withdraw consent you have given; and to opt out of the “sale” or “sharing” of personal information or of targeted advertising. You also have the right not to be treated differently for using these rights. If you are in the European Economic Area, the United Kingdom or Switzerland, you can complain to your local data protection authority.

To use your rights, email hello@dlserve.ai. If you are an End User, we do not know your name or email address, so tell us the website or app, the browser and device you used, roughly when, and, if you can, your IP address at the time. We may ask for more information to find your records and to confirm the request is yours. If we still cannot identify you, we will tell you, and we may be unable to act on the request. We may refer you to the publisher where the request concerns the publisher’s own use of your information. When we delete your record, the records and summaries in section 7 that carry your random subscriber ID are kept for the periods stated there but are no longer linked to your push subscription, IP address or device in our systems, and copies in our backups are deleted when the backups expire. You can use an authorized agent where the law allows it. We reply within the time the law requires.

10.3 Opting out of sale, sharing and targeted advertising

Every ad request carries the information described in section 6, so the way to opt out is to stop the ads as section 10.1 describes. Once your web push subscription, Android registration or Windows install is marked as ended, we make no further ad requests for it. Ads on a website’s pages are requested without any ID, each time the page shows one; to stop them, leave the website. You can also email hello@dlserve.ai with the subject “Do not sell or share” and the details in section 10.2, and we will end the subscriptions or installs we can find for you.

10.4 California notice

In the past 12 months we collected these categories of personal information: identifiers (IP address, push subscription or token, random subscriber and install IDs, a publisher’s email address, and any customer ID a publisher attaches); internet or other electronic network activity (ads sent, shown, clicked and closed, the website or app, and browser and device details); approximate geolocation (country and region from your IP address); professional information (publisher name and role); commercial information (payout records); and inferences (the engagement score and the best time of day to send you ads). We collect them from you, your browser or device, and the publisher, for the purposes in sections 3 and 4.6, and keep them as section 7 sets out. We sold or shared identifiers, network activity and approximate geolocation to advertising partners (section 6), disclosed publisher identifiers and professional information to our advertising exchange partner (section 3), and disclosed each category to our service providers for the business purposes in section 6. The only sensitive personal information we collect is your dashboard account login (your email address with your password); we store the password only in hashed form. We do not use or disclose sensitive personal information to infer characteristics about you.

10.5 Appeals

If we decline your request, you can appeal by replying to our decision with “Appeal” in the subject line. We will answer within the time the law requires and explain the outcome. If we deny your appeal, you can contact your state attorney general.

11. Children

Our service is not directed to children, and our terms forbid publishers from using it on websites or apps directed to children. We do not knowingly collect personal information from children under 16. If you believe we have, contact us and we will delete it.

12. Information for publishers

Publishers must tell their End Users about dlserve in their own privacy policies and obtain any consent the law requires before our code runs, as our Terms of Service set out. Our dashboard offers privacy policy templates for web, Android and Windows placements as a starting point.

13. Changes to this policy

We may update this policy. We will post the new version on this page with a new effective date and, for material changes, tell publishers by email or in the dashboard.

14. Contact

Questions or requests about privacy: hello@dlserve.ai.