Privacy Policy

01

Who is who in this policy

In shortThree groups: our account holders, offerwall users, and site visitors. The rules differ for each.

PubsNest is operated by the entities registered in Delaware, United States, and in England & Wales, United Kingdom. For questions about any of this, write to privacy@pubsnest.com.

This policy covers three different relationships:

Account holders

Publishers and advertisers who sign in to the dashboard. We are the controller of their account data.

Offerwall users

People who open a publisher's offerwall and complete offers. The publisher decides what identifier reaches us; we process the rest to run and protect the offer.

Site visitors

Anyone reading pubsnest.com. Minimal, mostly technical.

If you reached us through a publisher's app or website, that publisher has its own privacy notice covering what it collects before anything reaches us. We are not responsible for their notice, nor they for ours.

02

What we actually hold

In shortAccount details, conversion records, and the technical signals needed to tell a real user from a bot.

From account holders

Name or company name, email, password hash, contact and billing details, payout method and the address or account it pays into, tax information where we are required to collect it, support correspondence, and the sign-in record of the account (time, IP, device).

From offerwall users

The user identifier your publisher sends us — normally a pseudonymous id, not a name — plus what is needed to run and validate the offer:

Activity

Offers opened, clicks, conversions, events credited, timestamps and the reward value.

Network

IP address, and what it tells us: approximate country and city, and whether it belongs to a VPN, proxy, hosting provider or Tor exit.

Device

User agent, operating system and version, browser, language, screen and timezone, plus a derived device signature used to spot the same device behind many accounts.

Attribution

Placement, publisher, sub-identifiers you pass through and the click identifier that ties a conversion back to its click.

From site visitors

Request logs (IP, user agent, page, time) and whatever you type into a form on the site.

We do not ask for, and do not want, special category data — health, politics, religion, biometrics — or payment card numbers. Card details for advertiser deposits are handled by the payment provider; we see the result, not the card.

03

What we use it for

In shortRun the offerwall, pay the right person, keep fraud out, meet the law.

Delivering offers. Showing a catalogue that is available where the user is, on the device they use, and crediting the reward when the advertiser confirms the event.
Attribution and payment. Matching a conversion to the click, the placement and the publisher, so the right account is credited and the right invoice is raised.
Fraud prevention. Comparing network, device and behavioural signals to detect bots, emulators, duplicated devices, location spoofing and incentivised abuse. This is the single biggest reason we hold technical data at all.
Support and operations. Answering tickets, investigating missing conversions, and keeping the platform working.
Reporting. Aggregated statistics for publishers, advertisers and ourselves. Aggregates do not identify anyone.
Legal duties. Tax records, accounting, sanctions screening and responding to lawful requests.

We do not build advertising profiles of offerwall users, we do not sell personal data, and we do not share it with data brokers.

04

Our legal basis

In shortContract for the service, legitimate interest for anti-fraud, consent where the law asks for it.

Contract

Running your account, delivering offers, crediting conversions and paying you.

Legitimate interest

Fraud detection, platform security, service improvement and the defence of legal claims. We balance this against the user's interests and keep the data minimal and short-lived.

Consent

Non-essential cookies and marketing email. Withdrawable at any time, without affecting what was done beforehand.

Legal obligation

Tax, accounting and regulatory record-keeping.

05

Cookies and similar technology

In shortSession, preference and attribution. No advertising cookies of ours.

The dashboard uses a session cookie to keep you signed in and a CSRF token to stop forged form submissions; neither is optional. A preference cookie remembers the light or dark theme.

Inside the offerwall, a short-lived identifier ties a click to the conversion that follows it, so the correct publisher is credited. Where consent is required for anything beyond what is strictly necessary, it is the publisher who must collect it from their users.

Advertisers' landing pages set their own cookies once a user leaves the offerwall. Those are governed by their policies, not ours.

06

Who else sees it

In shortAdvertisers get the minimum needed to validate a conversion; processors get what they need to do their job.

Advertisers and networks

The click identifier, the event and the technical signals needed to validate it. They do not receive your users' names or email addresses from us.

Publishers

Their own conversions, their own users' identifiers and their own statistics. Never another publisher's data.

Infrastructure

Hosting, storage and email delivery providers, bound by contract to process only on our instructions.

Fraud services

IP reputation and device intelligence providers who tell us whether an address or device looks abusive.

Payment providers

What they need to move money to you.

Authorities

When a valid legal request requires it, or to establish or defend legal claims.

If the business is ever sold or merged, account data moves with it, and we will say so in advance.

07

Where the data goes

In shortEurope and the United States, with standard contractual clauses where needed.

Our servers are in the European Union. Some processors, and many advertisers, are in the United States or elsewhere. Where personal data leaves the UK or the EEA we rely on the European Commission's or the UK's standard contractual clauses, or on an adequacy decision where one exists, and we keep what crosses borders to the minimum the integration needs.

08

How long we keep it

In shortLogs months, conversions years, invoices as long as the tax office says.

Account data

While the account is open, then up to 24 months, unless accounting law requires longer.

Conversions and clicks

24 months, so that reversals, disputes and reconciliation can be resolved.

Technical and fraud logs

12 months, or longer for a specific record under investigation.

Invoices and tax records

As required by law, generally 6 to 10 years.

Support correspondence

24 months from the last message.

After that, records are deleted or irreversibly aggregated into statistics that identify nobody.

09

How it is protected

In shortEncrypted in transit, access limited, passwords hashed, incidents reported.

Traffic runs over TLS. Passwords are stored hashed, never in plain text. Access to production data is limited to the people who need it and is logged. Backups are encrypted and tested. Payout and API credentials are stored separately from the rest.

No system is perfect. If a breach affects your personal data and is likely to create a risk to you, we will notify you and the relevant supervisory authority within the time the law allows — 72 hours for the GDPR.

10

What you can ask us to do

In shortAccess, correct, delete, port, object. One email, thirty days.

Get a copy of the personal data we hold about you.
Correct anything inaccurate.
Have it deleted, where we are not required to keep it for accounting or fraud reasons.
Restrict or object to processing based on legitimate interest, including fraud profiling.
Receive your account data in a portable, machine-readable format.
Withdraw consent for marketing or non-essential cookies at any time.
Complain to your data protection authority — the ICO in the United Kingdom, or your national authority in the EEA.

Write to privacy@pubsnest.com. We answer within thirty days and may ask you to confirm your identity first. If you are an offerwall user, ask your publisher as well: they hold the account you use, and we may need them to confirm which identifier is yours.

If you are in California, the same rights apply under the CCPA, including the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined there.

11

Children

In shortNot for under-18s. Tell us and we delete it.

PubsNest is a business service and the offerwall is not directed at children. Publishers must not place it on a property aimed at under-18s, and accounts may only be opened by adults. If we learn that we hold data about a child, we delete it. If you believe we have, write to privacy@pubsnest.com.

12

Changes to this policy

In shortVersion and date at the top; material changes announced in advance.

When this policy changes we update the version and the date at the top of the page. If a change materially affects how we handle your data, we announce it in the dashboard at least fourteen days before it takes effect, and by email where the change requires it.

This policy forms part of our Terms of Service.