Privacy Policy

Publizia (“Publizia,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you access or use the Publizia website, marketplace platform, and related services (collectively, the “Platform”).

This Policy applies to all users of the Platform, including advertisers, publishers, visitors, and any individual who interacts with our services. By using the Platform, you acknowledge the practices described in this Privacy Policy.

Publizia operates as a data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you are located in the European Economic Area (EEA), Publizia is the data controller responsible for your personal data.

We collect the following categories of information to operate, improve, and secure our Platform:

We use your personal information for the following purposes:

• To Provide Services: Create and manage your account, process orders, facilitate payments via escrow, and enable communication between advertisers and publishers.
• To Improve the Platform: Analyse usage patterns, troubleshoot technical issues, and develop new features.
• To Communicate with You: Send transactional emails (order confirmations, payment receipts, support responses), product updates, and, with your consent, marketing communications.
• To Ensure Security: Detect and prevent fraud, abuse, spam, and violations of our Terms & Conditions.
• To Comply with Legal Obligations: Maintain records as required by applicable laws and respond to lawful requests from regulators or law enforcement.
• To Display Analytics Data: If you are a publisher who connects Google services, we display your GSC and GA4 metrics to advertisers browsing our catalogue (see Section 4).

We process your personal data on the following legal bases: (a) performance of a contract with you, (b) your consent (which you may withdraw at any time), (c) our legitimate interests in operating and improving the Platform, and (d) compliance with legal obligations.

Publizia offers publishers the ability to connect their Google Search Console (GSC) and Google Analytics 4 (GA4) accounts to display live traffic and SEO metrics to potential advertisers. This section explains how we handle this data specifically.

What We Collect

• GSC Data: Clicks, impressions, average search position, click-through rate (CTR), device breakdown, and top search queries from Google Search Console.
• GA4 Data: User count, session count, bounce rate, average session duration, traffic source breakdown, and user country breakdown from Google Analytics 4.
• Credentials: We store an OAuth 2.0 refresh token obtained from Google to maintain ongoing access to your data. We do not store your Google account password.

How We Use It

• Aggregated GSC and GA4 metrics are displayed on your publisher site listing pages in the marketplace so advertisers can assess your site's performance.
• Data is refreshed automatically on a scheduled basis (typically daily) to ensure buyers see current metrics.
• We do not share raw Google API data with third parties except as necessary to display it on the Platform.
• We do not use your Google data for advertising, profiling, or any purpose beyond displaying it on your publisher profile.

Google API Disclosure

Publizia's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Your Google data is only used to provide you with the analytics display feature and is never sold or used for other purposes.

Revoking Access

You may revoke Publizia's access to your Google data at any time:

• Through the Publizia dashboard by disconnecting the respective service (GSC or GA4).
• Through your Google Account permissions page by removing the Publizia app.

Upon revocation, we will delete the stored refresh token and cease all data collection from the disconnected service. Existing cached metrics data may remain visible until the next sync cycle unless you request deletion.

We use cookies and similar tracking technologies to enhance your experience, analyse usage, and support our authentication and security systems.

Types of Cookies We Use

• Essential Cookies: Required for the Platform to function, including session management, authentication, and security. These cannot be disabled.
• Functional Cookies: Remember your preferences, filter selections, and settings to improve your experience.
• Analytics Cookies: Help us understand how users interact with the Platform so we can improve it. We use services such as Tawk.to for live chat analytics.

Third-Party Cookies

We may embed content from third-party services (such as payment processors and live chat) that set their own cookies. These are governed by the respective third party's privacy policies.

You can control cookies through your browser settings. Disabling essential cookies may prevent the Platform from functioning correctly.

We do not sell your personal information. We share your data only in the following circumstances:

• With Other Users: Advertisers and publishers can see the information necessary to facilitate transactions, such as publisher site names, metrics, and advertiser order details.
• With Service Providers: We engage trusted third-party providers for payment processing (PayPal, Payoneer, Stripe, Binance), cloud hosting (Supabase), email delivery, analytics, and customer support. These providers are contractually bound to protect your data.
• For Legal Reasons: We may disclose information if required by law, legal process, or governmental request, or to protect our rights, property, or safety.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

We retain your personal information for as long as your account is active or as needed to provide you with the Platform services.

• Account Data: Retained for the duration of your account plus 90 days after account closure, unless a longer retention period is required by law.
• Financial Records: Transaction records are retained for 7 years to comply with tax and accounting obligations.
• Google OAuth Tokens: Retained until you disconnect the service or close your account, whichever comes first.
• Analytics Data: Cached metrics from GSC and GA4 are retained until you disconnect the service or request deletion.

When we no longer need your data, we will delete or anonymise it securely.

If you are located in the UK or EEA, you have the following rights under applicable data protection laws:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Right to Restrict Processing: Request that we limit how we use your data.
• Right to Data Portability: Request a machine-readable copy of your data to transfer to another service.
• Right to Object: Object to our processing of your data for direct marketing or legitimate interests.
• Right to Withdraw Consent: If processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at legal@publizia.com. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK or your local data protection authority.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption in transit (TLS 1.3) and at rest.
• Secure OAuth 2.0 token storage for Google API access.
• Regular security audits and vulnerability assessments.
• Access controls and authentication requirements for our staff.
• Database backup and disaster recovery procedures.

While we strive to protect your data, no method of transmission or storage is 100% secure. We encourage you to use strong, unique passwords and enable two-factor authentication where available.

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with their data, please contact us immediately at support@publizia.com and we will take steps to delete the information.

Publizia is based in the United Kingdom. Your personal data may be transferred to, stored in, and processed in countries outside the UK or EEA, including the United States where our cloud infrastructure providers (Supabase, Vercel) operate.

When we transfer your data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission and UK ICO.
• Data Processing Agreements (DPAs) with our service providers.
• Transfer only to countries with adequate data protection regimes or to organisations that comply with recognised frameworks (such as the UK-US Data Bridge).

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Material changes will be communicated via email or a prominent notice on the Platform at least 14 days before taking effect.

We encourage you to review this Policy periodically. Your continued use of the Platform after changes take effect constitutes your acceptance of the updated Policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Data Protection Inquiries: legal@publizia.com
• Support: support@publizia.com
• Registered Office: Publizia Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

If you have an unresolved privacy concern, you have the right to contact the UK Information Commissioner's Office (ICO) at ico.org.uk or your local data protection authority.