Last updated: October 18, 2026
Banche Labs, Inc. operates the Chosen ad network (https://chosen.ad). References in this Privacy Policy to "Banche Labs," "we," "us," or "our" refer to Banche Labs in its capacity as operator of the Chosen ad network. This Privacy Policy explains how we collect, use, share, and protect information when you interact with the Chosen network as a Curator, Publisher, Advertiser, or Platform, and the information our SDK collects about visitors to the publisher and Platform properties where it runs.
1. Information We Collect
From Curators (via Platforms or directly)
- Selection data: which ads you are presented with, which you select, selection timing, examination patterns (hover, dwell, click-through during selection), and notes you provide
- Published-phase engagement: impressions, clicks, and audience engagement on your scope after an ad is selected
- Scope characteristics: information about your property relevant to ad matching (content category, audience demographics if provided by your Platform, historical selection patterns)
- Identity tokens: issued by your Platform or by Chosen directly, identifying you and your scope
From Advertisers
- Account information: email address, organization name, billing details
- Ad creatives: images, text, links, and metadata you submit
- Campaign data: budget, creative variants, withdrawal and blocking actions
From Publishers
- Account information: email address, property details
- Property characteristics: content category, audience description, integration method
- Performance data: impression counts, click-through rates, audience engagement patterns
From Platforms
- Platform registration: organization name, API key, integration details
- User identity tokens: signed tokens identifying Curators and their scopes
- Scope metadata: scope characteristics relevant to ad matching
From Visitors to Publisher and Platform Properties
- Server logs: IP address, browser type, operating system, referring URL, timestamps. Retained for security and operational purposes.
- SDK session data: session identifiers, page context, and timing data collected by the Chosen SDK when it runs on a publisher's property or Platform
- Impression and click data: each ad impression and click on a publisher property
- Geography: derived from IP address
- Device, browser, and OS information
- Page context: the URL and content characteristics of the page where the ad appears
Third-Party Audience Enrichment
We may supplement the data above with information from commercial data providers, including demographic data and interest categories. This enrichment is used to improve ad matching and is not shared with other participants in individually identifiable form.
Cross-Site Identity Within the Chosen Network
To support frequency capping, conversion attribution, and audience profiling, we may use persistent identifiers to recognize the same visitor across publisher properties within the Chosen network. This does not extend beyond the Chosen network. The identifiers, their scope, and their purpose are described in the Cookies and Tracking section below.
2. How We Use Information
| Purpose | Information used | Legal basis (GDPR) |
|---|---|---|
| Operate the ad network (curate selection sets, record selections, serve ads) | Selection data, scope characteristics, identity tokens | Performance of contract |
| Improve ad matching (learn publisher preferences, estimate creative appeal) | Selection data, published-phase engagement, scope characteristics | Legitimate interest |
| Build and maintain publisher and creative representation models (embeddings, taste profiles) | Aggregated selection and engagement patterns across publishers and creatives | Legitimate interest |
| Third-party audience enrichment (demographic and interest data) | First-party SDK data combined with commercial data provider profiles | Consent |
| Cross-site frequency capping, conversion attribution, audience profiling | Persistent identifiers, impression/click data across publisher sites | Consent (ePrivacy) |
| Group-related processing (boundary curation feedback, identity synthesis, behavioral clustering) | Selection data, feedback, peer assessments, engagement patterns | Legitimate interest |
| AI/ML processing (algorithmic matching, group formation, quality scoring) | Aggregated participant data, property characteristics, creative data | Legitimate interest |
| Advertiser reporting (selection rates, impressions, publisher breakdown) | Selection data, impression data (aggregated) | Performance of contract |
| Publisher/Curator reporting (compensation, selection history) | Selection data, compensation records | Performance of contract |
| Billing and compensation | Account data, budget data, selection records | Performance of contract |
| Prevent fraud and abuse | Server logs, engagement patterns, identity tokens | Legitimate interest |
| Respond to legal requests | Account information, logs | Legal obligation |
3. Information We Share
With Platforms
When a Curator accesses Chosen through a Platform, we share selection state (which ad is currently selected for a scope) and aggregate performance data with the Platform to support their integration.
With Advertisers
Advertisers receive aggregate reporting: selection rates, impression counts, click-through rates, and publisher-level breakdowns (which publishers had access to their ad and which selected it). Advertisers do not receive individual Curator identity information beyond what is visible on the publisher's property.
With Publishers / Curators
Publishers and Curators see their own selection history, compensation records, and scope-level performance data.
Service Providers
We use service providers for hosting, payment processing, and infrastructure. They process data on our behalf and are contractually required to protect it.
Legal Authorities
When required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
Business Transfers
In connection with a merger, acquisition, reorganization, or sale of assets, information may be transferred as part of that transaction. We will notify you of any such change.
What We Do Not Do
- We do not sell personal information.
- We do not share individual Curator selection data with advertisers (only aggregate reporting).
- We do not share data with ad networks other than Chosen.
- We do not use data for purposes beyond operating and improving the Chosen ad network.
GDPR Controller Relationship
When Chosen's SDK collects personal data on a publisher's or Platform's property, Chosen acts as a joint controller with the publisher or Platform for ad serving purposes, and as an independent controller for algorithmic matching, group formation, and network-level analysis.
The relationship between Chosen and Publishers/Platforms regarding personal data is governed by a Data Processing Agreement, which defines the controller relationship, the personal data processed, purposes of processing, security obligations, data breach notification timelines, international transfer mechanisms, and subprocessor management.
4. Cookies and Tracking
The Chosen SDK sets the following cookies and identifiers:
| Cookie / Identifier | Purpose | Type | Duration |
|---|---|---|---|
| chosen_session | Ad selection session tracking | First-party, HttpOnly | Session |
| chosen_id | Cross-site identity within the Chosen network (frequency capping, conversion attribution, audience profiling) | First-party, HttpOnly | Persistent (up to 1 year) |
We do not use third-party advertising or analytics cookies.
Consent requirements. The persistent cross-site identifier (chosen_id) may require consent under the ePrivacy Directive before being set. Publishers and Platforms are responsible for obtaining this consent through their own cookie consent mechanisms.
Publisher and Platform disclosure. Publishers and Platforms must disclose Chosen's cookies and tracking in their own privacy policies and cookie consent dialogs.
5. Data Retention
- Selection and engagement data: retained for as long as the associated Curator, Publisher, or Advertiser account is active, and for a reasonable period afterward for aggregate analysis
- Account data: retained for as long as the account is active. Deleted upon account closure, subject to legal retention requirements.
- Server logs: retained for a standard operational period
- Aggregated and anonymized data: may be retained indefinitely
6. Your Rights
Depending on your location, you may have the following rights:
- Access: request a copy of the information we hold about you
- Correction: request that we correct inaccurate information
- Deletion: request that we delete your account and associated data
- Portability: receive your data in a structured, machine-readable format
- Objection: object to our processing where we rely on legitimate interest
- Restriction: request that we restrict processing in certain circumstances
- Withdraw consent: where processing is based on consent, you may withdraw at any time
To exercise these rights, contact us at privacy@chosen.ad.
7. International Data Transfer
We and our service providers process your information in the United States and in other countries where those providers operate. These countries may have data protection standards different from those of your country of residence.
Where required by GDPR, we use Standard Contractual Clauses (SCCs) or other approved transfer mechanisms to provide adequate safeguards for international data transfers.
8. Children's Privacy
The Chosen ad network is not directed at anyone under 18, or under the age of majority where they live if that is higher. We do not knowingly collect information from anyone under this age.
9. Data Security
We implement technical, administrative, and organizational measures to protect information against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure. While we strive to protect information, we cannot guarantee absolute security.
10. Changes
We may update this Privacy Policy from time to time. We will notify affected parties at least one month before material changes take effect. Continued use of the network after the notice period constitutes acceptance. Non-material changes may take effect immediately.
11. Contact
If you have questions about this Privacy Policy, contact us at:
Banche Labs, Inc. privacy@chosen.ad