xomos Privacy Policy

Last Updated: October 24, 2025

Introduction

xomos, LLC ("xomos," "we," "us," or "our") respects your privacy and is committed to transparency about how we handle information. This Privacy Policy describes the types of information we receive, how we use it, and your choices.

This Policy applies to our website (www.xomos.co) and related services (collectively, the "Services") that connect merchants and publishers within our adtech marketplace within the United States.

Our Role as a Data Processor

xomos operates primarily as a data processor on behalf of publishers and merchants who participate in our marketplace. Publishers are the data controllers responsible for end-user data collection and compliance with applicable privacy laws. Merchants are data controllers for their business contact information and campaign data.

This Privacy Policy establishes baseline privacy protections that apply to our Services. If you have entered into a separate written agreement with xomos (such as a Merchant Agreement or Publisher Agreement), the terms of that agreement supplement this Policy. In case of conflict between this Policy and your written agreement, the terms of your agreement will control with respect to data processing activities covered by that agreement.

This Policy does not apply to third parties' collection or processing of information through their own websites, platforms, or offerings—even if those third parties integrate with or link to xomos. Please refer to their respective privacy policies.

Information We Receive

Information from Publishers (Consumer Transaction Data)

xomos does not collect or process personally identifiable information ("PII") from end users or consumers.

Publishers participating in our marketplace conduct their own user tracking and maintain full responsibility for compliance with applicable privacy, PCI, and data protection laws. Publishers transmit only limited, deidentified transaction data to xomos that may include:

• Date of transaction
• Purchase amount
• Last four digits of the payment card number
• Deidentified user or transaction identifier (GUID)
• Associated merchant and campaign identifiers

Deidentification Methodology: All user identifiers transmitted to xomos are hashed using industry-standard cryptographic hash functions (SHA-256 or stronger) before transmission. We do not receive the original identifiers, and we do not maintain any means to reverse or re-identify hashed values. Publishers are contractually prohibited from transmitting data that would enable re-identification.

We do not receive names, full card numbers, email addresses, physical addresses, or any other data that can directly identify an individual consumer.

Information from Publishers (Brand Advertising Data)

For brand advertising campaigns (including display ads, app takeovers, banner ads, and sponsored content), publishers may transmit aggregated, non-identifiable performance data such as:

• Impressions delivered
• Clicks or engagement metrics
• Campaign identifiers
• Date and time of ad delivery
• General demographic data (aggregated age ranges, geographic regions)

We do not receive individual user identifiers or personally identifiable information for brand advertising campaigns. All data is aggregated at the campaign level.

Information from Merchants (Business Contact Information)

When merchants join xomos, we collect limited business contact and account information, which constitutes personal information under applicable privacy laws. This may include:

• Company name
• Contact person name and business email
• Business phone number
• Payment and billing information (if applicable)

This information is collected with the merchant's consent as necessary to establish and manage the business relationship, provide our Services, and fulfill our contractual obligations.

Website and Platform Data

Our website may automatically collect minimal technical data necessary to operate the site effectively and ensure security, such as:

• Browser type and version
• Operating system
• Referring URLs
• General geographic location (derived from connection data, not precise geolocation)

We do not use cookies or similar tracking technologies for behavioral advertising, cross-site tracking, or profiling. Any technical data collected is used solely for system operations, security, and service improvement.

How We Use the Information

Consumer Transaction Data (Deidentified)

We use deidentified transaction data received from publishers to:

• Validate merchant campaign performance and conversion attribution
• Provide aggregated reporting and analytics to merchants
• Calculate publisher commissions and attribution metrics
• Detect and prevent fraud or abuse of our Services
• Improve our platform functionality and algorithms

We may also use aggregated, non-identifiable data for industry benchmarking, analytics, and product development.

Brand Advertising Data

We use aggregated advertising performance data to:

• Provide campaign reporting to merchants (impressions, clicks, engagement)
• Calculate publisher earnings for ad placements
• Optimize ad delivery and placement strategies
• Improve our platform functionality

All brand advertising data is aggregated and does not contain personally identifiable information.

Business Contact Information

We use merchant and publisher business contact information to:

• Manage accounts and business relationships
• Communicate about Services, campaigns, and performance
• Process payments and billing
• Provide customer support
• Comply with legal obligations and enforce our terms

How We Share Information

Deidentified Transaction Data

We may share deidentified or aggregated data:

• With merchants to validate campaign performance and ROI
• With publishers to verify attribution and calculate commissions
• With Google Cloud Platform for data warehousing, analytics, and processing (specifically BigQuery and related services) under strict confidentiality and data processing agreements
• As required by law, regulation, subpoena, or valid legal process
• In connection with a business transaction (merger, acquisition, sale of assets), provided the acquiring party agrees to honor this Privacy Policy

We do not sell, rent, or license any information to third parties. We contractually prohibit our service providers from using data for their own purposes or attempting to re-identify deidentified information.

Business Contact Information

We may share merchant and publisher business contact information:

• With service providers who support our business operations under confidentiality obligations
• As required by law or to protect our legal rights
• With your consent or at your direction

Data Security

We implement comprehensive administrative, technical, and physical safeguards to protect the information we process, including:

Administrative Safeguards:

• Access controls limiting data access to authorized personnel only
• Regular security training for employees
• Confidentiality agreements with all personnel handling data
• Vendor management and due diligence processes

Technical Safeguards:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest using AES-256 or equivalent
• Multi-factor authentication for system access
• Regular security assessments and vulnerability scanning
• Automated monitoring and logging of access to sensitive data
• Secure hash functions (SHA-256 or stronger) for all identifiers

Physical Safeguards:

• Use of Google Cloud Platform infrastructure with enterprise-grade security
• Geographically distributed data centers with redundancy
• Physical access controls to infrastructure

Despite these measures, no system is completely secure. We cannot guarantee absolute security of data transmitted through or stored within our Services.

Data Breach Response

In the event of a data breach affecting information within our control, we will:

• Promptly investigate and contain the incident
• Notify affected merchants and/or publishers as required by law and our contractual obligations
• Cooperate with merchants and publishers in their own breach notification obligations
• Take remedial action to prevent recurrence

Because we do not collect or maintain personal information about consumers, any breach notification obligations to consumers would be the responsibility of the applicable publisher or merchant as the data controller.

Data Retention

Consumer Transaction Data: We retain deidentified transaction data for up to one (1) year from the date of the transaction, unless a merchant requests a longer retention period for specific business purposes (e.g., extended campaign analysis, historical benchmarking). In such cases, we will retain the data only as long as necessary to fulfill the merchant's legitimate business need.

Business Contact Information: We retain merchant and publisher business contact information for the duration of the business relationship and for up to one (1) year following account closure, or as required to comply with legal obligations, resolve disputes, and enforce our agreements.

Aggregated Data: Aggregated, non-identifiable data may be retained indefinitely for analytics, benchmarking, and product development.

Secure Deletion: Upon expiration of the applicable retention period, data is securely deleted or anonymized in accordance with industry best practices.

Children's Privacy

xomos does not knowingly collect any information from individuals under the age of 18. Our Services are directed exclusively to businesses, not to consumers or minors. Publishers are responsible for ensuring they do not transmit data relating to minors to our platform.

Your Privacy Rights

California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have certain rights regarding their personal information.

xomos does not collect, sell, or share personal information of consumers as defined by the CCPA/CPRA. We do not track, profile, or identify individual consumers, and the limited transactional information we receive is deidentified through cryptographic hashing and cannot be linked back to an individual by xomos.

If you are a California resident with questions about how your data may flow through our publisher or merchant partners' systems, please review their respective privacy policies, as they are the primary data collectors and controllers.

For merchant and publisher business contacts who are California residents, you have the right to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information (subject to exceptions)
• Opt-out of sale or sharing (though we do not sell or share personal information)
• Correct inaccurate personal information
• Limit use of sensitive personal information (though we do not process sensitive personal information)

To exercise these rights, contact us at privacy@xomos.co. We will not discriminate against you for exercising your privacy rights.

Other U.S. State Residents

If you are a resident of Virginia, Colorado, Connecticut, Utah, Montana, or other states with comprehensive privacy laws, you may have similar rights regarding your personal information, including:

• Right to confirm whether we process your personal information
• Right to access your personal information
• Right to correct inaccuracies in your personal information
• Right to delete your personal information
• Right to obtain a copy of your personal information
• Right to opt out of targeted advertising (we do not engage in targeted advertising)

These rights apply to merchant and publisher business contacts. To exercise these rights, contact us at privacy@xomos.co. We will respond within the timeframes required by applicable law.

Limitations: Certain rights may be limited by law or where necessary to comply with legal obligations, prevent fraud, or maintain system security.

Business Contact Data Processing

Merchant and publisher business contact information (names, business emails, phone numbers) constitutes personal information under applicable privacy laws. We process this information based on the following legal grounds:

• Contractual Necessity: To fulfill our obligations under merchant and publisher agreements
• Legitimate Interest: To operate our business, provide customer support, and improve our Services
• Consent: Where required by law or for specific uses beyond our core Services

Business contacts have the right to:

• Access their personal information
• Correct inaccurate information
• Request deletion (subject to our contractual and legal obligations)
• Opt-out of non-essential communications

To exercise these rights or update your information, contact your account manager or email privacy@xomos.co.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes, we will:

• Post the revised Policy on our website with an updated "Last Updated" date
• Notify merchants and publishers via email to the address on file
• Provide reasonable notice before material changes take effect

Your continued use of our Services after such updates constitutes your acceptance of the changes. We encourage you to review this Policy periodically.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

xomos, LLC

1580 N Logan St, Ste 660 PMB 639664

Denver, Colorado 80203-1994

United States

Email: privacy@xomos.co

Website: www.xomos.co

For privacy rights requests, please include:

• Your full name and contact information
• Your relationship to xomos (merchant contact, publisher contact, or other)
• A description of your request
• Any information that will help us verify your identity and locate your records

We will respond to verified requests within the timeframes required by applicable law.