Snapshot 30893
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Posted: September 19, 2026 · Effective: October 19, 2026 · View previous version
Privacy Policy
Terms of ServicePrivacy PolicyBrand Safety
This Privacy Policy explains how IRIS Inc., doing business as Gravity ("we", "us"), collects, uses, and shares information when you access our websites, SDKs, APIs, and related services (collectively, the "Services"). This Policy is intended to provide transparency regarding our advertising technology practices while maintaining a high standard of user trust and platform integrity. Where a practice described below applies specifically to Publishers or to Advertisers and Demand Partners (as defined in our Terms of Service), that is called out explicitly; otherwise, the practice applies to both.
1. Information We Collect
We may collect information in the following categories to enable ad delivery, measurement, security, and service improvement:
Device and Network: IP address, user-agent, operating system, device type, browser type, language, timezone, network provider, and connection metadata.
Identifiers: Advertising identifiers (e.g., AAID/IDFA where permitted), pseudonymous identifiers, and internal IDs used for fraud prevention, frequency management, and measurement.
Contextual Signals: Page or conversation-level context, keywords, categories, and other contextual signals that help determine ad or agent-recommendation relevance.
Interaction and Performance: Ad requests, impressions, clicks, conversions, viewability, scroll and visibility metrics, the content of user queries, prompts, and interactions made available to us by Publishers, agent recommendation outcomes, session timings, and SDK/API error diagnostics.
Location: Approximate geolocation derived from IP address or system signals, used for regional targeting, reporting, and fraud controls.
Where permitted by law or with appropriate consent, we may also collect or receive contact information (including email addresses associated with website visits as described in Section 5), ad campaign metadata, and aggregated audience segments provided by trusted partners for measurement and reach estimation. Content transmitted to us by Publishers, including user queries and prompts, may include information that is considered sensitive under applicable law. We do not target advertising on the basis of such information (selecting an ad for relevance to the current request is not targeting on that basis), and we process it only for the purposes and under the safeguards described in this Policy.
2. How We Use Information
We use the information described above to:
Serve, manage, and optimize native ad experiences and agent-native recommendation experiences in LLM environments
Measure performance, attribution, and reach across campaigns and inventory
Detect, prevent, and investigate ad fraud, invalid traffic, and abuse (including agent-specific abuse, as described in our Brand Safety Guidelines)
Provide reporting, analytics, and billing to Advertisers and Publishers
Comply with legal obligations and enforce our terms and policies
Improve our Services, including testing, research, and product development
Personalize, deliver, and measure advertising, and manage ad frequency, based on activity across the sites, apps, and AI platforms that use our Services
We may use de-identified or aggregated information for research, benchmarking, and product development. We may also perform limited modeling, inference, and prediction to improve ad relevance and safety, without attempting to re-identify individuals.
2.1 For Advertisers and Demand Partners. Campaign, creative, audience, and bid information supplied by an Advertiser or Demand Partner is used to deliver, measure, and optimize that party's campaigns across Publisher inventory, and for all other purposes described in this Section 2.
2.2 For Publishers. Information collected through a Publisher's integration of our SDKs or APIs is used to serve, measure, and optimize advertising or agent-native experiences on that Publisher's properties, to calculate and support amounts payable to that Publisher, and for all other purposes described in this Section 2.
3. Legal Bases
Where required, our processing is based on consent (including, for particular categories of data, consent obtained by the Publisher or AI platform through which you interact with us), legitimate interests in delivering and improving advertising services, performance of a contract, and/or compliance with legal obligations.
4. Controllers and Processors
IRIS Inc. acts as an independent controller (and, for purposes of the CCPA/CPRA, as a business and third party) with respect to the information described in Section 1, including information collected through Publisher properties and information supplied by Advertisers and Demand Partners, for the purposes described in Section 2. IRIS Inc. acts as a processor or service provider only where a data processing addendum signed by IRIS Inc. expressly provides so, and then only for the processing activities that addendum identifies.
4.1 For Advertisers and Demand Partners. With respect to campaign, audience, or bid data supplied by an Advertiser or Demand Partner, IRIS Inc. acts as an independent controller for the purposes described in Section 2, except where a data processing addendum signed by IRIS Inc. provides otherwise for specific data (for example, an Advertiser's customer lists).
4.2 For Publishers. With respect to End User data collected through a Publisher's properties, IRIS Inc. and the Publisher are each independent controllers. The Publisher is responsible for the notices, consents, and opt-out mechanisms described in Section 8 below, including disclosing its sharing of data with advertising partners such as IRIS Inc. and honoring applicable opt-out signals; IRIS Inc. is responsible for its own use of that data as described in this Policy.
5. Data Sharing
We may share information with trusted partners to operate the Services, such as advertisers and demand-side platforms, exchanges, measurement providers, anti-fraud vendors, and cloud service providers. We require recipients to use reasonable security and process data only for the purposes described herein or as otherwise authorized by you or required by law.
We may share Publisher-specific reporting, billing, and reconciliation data with the applicable Publisher, and campaign-specific performance, attribution, and measurement data with the applicable Advertiser or Demand Partner, in each case as necessary to perform our obligations under the applicable Insertion Order, Engagement Letter, or self-serve dashboard terms.
We may disclose information in connection with a merger, acquisition, financing, or sale of assets, and as required to comply with law, respond to lawful requests, enforce our rights, or protect the safety of users and the public.
When you visit our website, our data partners or vendors may use cookies and similar technologies to associate your visit with information they already hold, which can include an associated email address. We (or service providers on our behalf) may then use that information to send relevant communications and marketing. You may opt out of this advertising at any time by visiting https://app.retention.com/optout.
6. Data Retention
We retain information for as long as necessary to fulfill the purposes described in this Policy, including recordkeeping, dispute resolution, fraud prevention, compliance with legal obligations, and operating and improving our advertising engine and models. The criteria we use to determine retention periods include the nature and sensitivity of the information, the purposes for which it was collected, whether those purposes can be achieved by other means, whether the individual or customer continues to interact with the Gravity network, and applicable legal, regulatory, tax, accounting, and contractual requirements. We may retain the content of user queries and prompts, including in the form received, for the purposes described in this Policy and for as long as those purposes require, applying the criteria above. We may retain information for longer where required by law or where reasonably necessary for a legal hold, an open dispute, billing reconciliation, or to establish, exercise, or defend legal claims, and copies in backups are removed on our routine backup cycle. We retain de-identified, aggregated, and derived information indefinitely. Termination of an Advertiser's or Publisher's relationship with us does not by itself require us to delete information we have collected, except where applicable law requires. This Section describes our retention practices and does not limit the rights in data granted to IRIS Inc. under Section 7 of our Terms of Service.
7. Security
We employ administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, or misuse. No system can be guaranteed to be 100% secure.
8. Your Choices
Depending on your location and applicable law, you may have rights and choices with respect to certain data practices, including the ability to opt out of interest-based advertising, access or delete certain information, and manage consent settings.
8.1 For Advertisers and Demand Partners. Advertisers and Demand Partners are responsible for ensuring that any audience, customer, or contact data they provide to us has been collected in compliance with applicable law and with any necessary consents or disclosures to their own customers or audiences.
8.2 For Publishers. Publishers integrating our SDKs or APIs are responsible for providing appropriate notices and obtaining necessary consents from their end users, including with respect to any agent-native features made available on their properties.
We honor applicable consent and opt-out signals where they are transmitted to us in a supported format, including the Global Privacy Control (GPC). Where applicable law requires consent for a processing activity and a valid consent signal does not accompany a request, we limit our processing of that request accordingly, which may include serving contextual ads only. Individual rights requests relating to information we hold as a controller may be submitted to us as described in Section 9 or Section 13; requests relating to an Advertiser's or Publisher's own use of information should be directed to that entity. We honor rights requests to the extent required by applicable law and subject to the exceptions it provides.
9. California Privacy Rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), provides you with the following rights with respect to your personal information:
Right to Know/Access: to request the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collecting it, and the categories of third parties with whom it is shared.
Right to Delete: to request deletion of personal information we have collected from you, subject to certain exceptions.
Right to Correct: to request correction of inaccurate personal information.
Right to Opt Out of Sale or Sharing: to direct us not to sell your personal information or share it for cross-context behavioral advertising.
Right to Limit Use of Sensitive Personal Information: to limit the use or disclosure of sensitive personal information, where applicable.
Right to Non-Discrimination: we will not discriminate against you for exercising any of these rights.
The use of cookies and similar technologies by our data partners described in Section 5, and our use of pseudonymous identifiers for advertising personalization and measurement as described in Sections 1 and 2, may constitute a "sale" or "sharing" of personal information under the CCPA/CPRA. You may opt out of this activity (our "Do Not Sell or Share My Personal Information" mechanism) as follows: for website-visitor cookies described in Section 5, by visiting https://app.retention.com/optout; for pseudonymous identifiers processed through the Gravity network, by sending the Global Privacy Control signal where the Publisher property or AI platform supports it, or by emailing support@trygravity.ai with the subject line "Do Not Sell or Share". You may also exercise choices offered by the AI platform or Publisher property through which you interact with us.
To exercise your rights to know, delete, or correct, contact us at support@trygravity.ai. We will verify your request as required by law, and you may use an authorized agent to submit requests on your behalf.
10. International Transfers
We may transfer information to countries other than your own, including the United States, where we and our service providers operate. Where required by law, we implement appropriate safeguards for such transfers, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
11. Children
Our Services are not directed to children, and we do not knowingly collect personal information from children under the age of 13, consistent with the Children's Online Privacy Protection Act (COPPA). We do not sell or share the personal information of consumers we know to be under 16 years of age without the affirmative authorization required by the CCPA/CPRA. If we learn that a child under 13 has provided us with personal information, we will take appropriate steps to delete such information.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the Services or by other reasonable means. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy. For any party operating under a then-current Engagement Letter or Insertion Order with IRIS Inc., changes to this Policy are subject to Section 22 of our Terms of Service.
13. Contact
If you have questions about this Privacy Policy or our privacy practices, please contact us at support@trygravity.ai.