Privacy Policy

Last updated: 27 September 2026

This policy explains what data the SmartXSP platform (my.smartxsp.io) collects, why it is collected, who it is shared with, how long it is kept and how to have it deleted. It covers the people who sign in to SmartXSP (our customers' staff), the data our customers process through the platform in order to run advertising campaigns, and the data collected when a SmartXSP creative or measurement tag runs in a browser.

1. Who we are

SmartXSP is an advertising campaign management platform operated under the OursBlanc brand by:

Edge Query SAS — société par actions simplifiée with a share capital of €100,000
RCS Saverne — SIREN 851 509 315
Registered office: Lutzelhouse, Alsace, France — offices in Paris, Lyon and Luxembourg
Publication director: Olivier Schaal
General contact: hello@oursblanc.io
Privacy contact: privacy@oursblanc.io
Full legal notices: oursblanc.io/legal-mentions

Edge Query SAS is registered in the IAB Europe Global Vendor List (GVL) under Vendor ID 1338.

For data our customers upload or generate while running their campaigns, the customer is the data controller and Edge Query SAS acts as a processor on their instructions. For account data, for the operation of the platform itself and for the advertising identifiers described in section 2.3, Edge Query SAS is the controller.

2. Data we collect

2.1 Account and identification data

Name, professional email address, telephone number where provided, employer or agency, role and permissions inside the platform.
Authentication data: a hashed password, session identifiers, API tokens and, where enabled, two-factor authentication secrets.
Sign-in and activity records: timestamps, IP address and user agent of sessions, and an audit trail of the actions taken in the platform (campaign created, budget changed, creative published).

2.2 Campaign and business data

Campaigns, insertion orders, budgets, flight dates, targeting settings, audience segment definitions, product feeds and creative assets uploaded by the customer.
Commercial documents: contracts, purchase orders and invoices related to the customer's use of the platform.
Aggregated delivery and performance statistics: impressions, clicks, viewability, video completions, conversions and spend, by campaign, creative, placement, site, device and geography.

2.3 Data collected when an advertisement is served

Our ad-serving and measurement tags process the following when a campaign creative is displayed, or when a measurement tag fires on a partner website:

Technical request data: IP address, user agent, referring page URL, timestamp, language and screen characteristics.
Derived, non-identifying context: approximate location at city or region level obtained from the IP address, device type, and contextual signals such as local weather or the time of day, used to select which creative variation to display.
A device identifier stored in the _ob_uid cookie, used for frequency capping and for click and conversion de-duplication.
For our retargeting services only, the browsing events the customer attaches to that identifier from its own website: the page or product viewed, its category and its price. These are used to select which advertising to serve to that identifier.

These purposes rely on the consent collected by the website operator through its Consent Management Platform, under the IAB Europe Transparency and Consent Framework (TCF):

Purpose	Legal basis (IAB TCF — Vendor 1338)
Store and/or access information on a device	Consent (Purpose 1)
Create a personalised advertising profile	Consent (Purpose 3)
Use a profile to select personalised advertising	Consent (Purpose 4)
Measure advertising performance	Consent (Purpose 7)

We do not sell personal data, and we do not knowingly process data relating to children. Reporting datasets shown in the platform are aggregated and are not used to identify a named individual.

2.4 Data obtained from Google APIs

When a customer connects a Google advertising account to SmartXSP, we store the OAuth access and refresh tokens issued by Google, the identifiers of the accounts, containers, advertisers and line items the customer designates, the campaign and creative objects we create there on the customer's behalf, and the delivery and spend figures we read back for reporting.

SmartXSP requests only the scopes needed for the modules the customer enables: reading and editing the designated Google Tag Manager container (we never publish a container version, the customer does), and Display & Video 360, Campaign Manager 360 and Google Ad Manager trafficking and reporting. We do not request access to Gmail, Google Drive, Contacts, Calendar, Photos or any other personal Google service.

Limited Use disclosure

SmartXSP's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through Google APIs is used only to provide and improve the campaign management features the customer asked for; it is never sold, never transferred to third parties except as necessary to provide the service, to comply with applicable law or as part of a merger or acquisition, never used for advertising profiling of our own, and never read by humans except with the customer's explicit consent, to resolve a support request, for security purposes, or where required by law.

3. Why we use this data

Purpose	Data used	Legal basis (GDPR)
Providing the platform: authentication, permissions, campaign management	Account data, campaign data	Performance of the contract
Executing campaigns on connected platforms	Campaign data, Google API tokens and objects	Performance of the contract
Serving, capping and personalising the creative shown to a browser	Request data, `_ob_uid` identifier, advertising profile	Consent (IAB TCF purposes 1, 3, 4 and 7)
Reporting and invoicing	Aggregated statistics, commercial documents	Contract and legal obligation
Security, fraud prevention, debugging	Logs, audit trail	Legitimate interest

4. Who the data is shared with

Programmatic partners, acting as independent controllers for the processing they carry out on their own account: Google Ireland Limited (Display & Video 360, Google Ad Manager), Microsoft Advertising (Xandr), Adform A/S and Equativ SA, together with the publishers and marketplaces to which those platforms give access. Each operates under its own privacy policy.
An account the customer has connected itself, such as a tag manager container or the customer's own ad server, where the customer has set up that integration.
Sub-processors: hosting and managed databases by Scaleway SAS (BP 438, 75366 Paris CEDEX 08, France); text messaging by OVH SAS (France); transactional email by Gandi SAS (France). Servers are located in the European Union.
Two further sub-processors, reached only by data about our customers' own users and never by data about the internet users exposed to a campaign: OpenAI Ireland Ltd, which operates the assistant embedded in the platform, and Slack Technologies Limited, which routes support requests to our team. Both involve a transfer to the United States, covered by the European Commission's Standard Contractual Clauses.
Nobody else. We do not sell personal data and we do not share it with data brokers.

Where a transfer outside the European Economic Area is unavoidable — for instance when a campaign is executed on a Google platform — it takes place under the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism.

5. How long we keep it

Detailed delivery and measurement events (TCF purpose 7): 13 months. Aggregated statistics, which no longer allow identification, are kept without a time limit.
The _ob_uid cookie (TCF purposes 1, 3 and 4): 90 days from the day it is set.
The IP address prefix cached to resolve an approximate location: 24 hours at most. The frequency-capping counter: 24 hours.
Browsing events collected for our retargeting services: for as long as the customer uses the service, then deleted.
Exchanges with the embedded assistant and requests sent to support: for the life of the account, then 12 months.
Technical and security logs: 12 months.
Account data: for the life of the account, then deleted or anonymised after it is closed.
Google OAuth tokens: until the customer disconnects the integration or revokes access, at which point the stored tokens are deleted. Tokens are also deleted when an account is closed.
Campaign and creative data: for the life of the account, unless the customer deletes it sooner.
Invoices and contracts: 10 years, as required by accounting law.

6. Security

Traffic is encrypted in transit with TLS. Passwords are stored only as salted hashes. Access to production systems is restricted to named administrators, over authenticated channels, and is logged. Each customer account is isolated by application-level access control so that one customer cannot read another's campaigns, creatives or statistics. Credentials for connected platforms, including Google OAuth tokens, are stored in access-restricted storage and are used only by the server-side jobs that need them.

7. Your rights

Under the GDPR (EU Regulation 2016/679) and the French Data Protection Act, you have the right to access your personal data, to have inaccurate data corrected, to have it erased, to object to processing, to request restriction of processing, to withdraw your consent at any time without retroactive effect, and to receive a portable copy of your data.

To exercise these rights, write to privacy@oursblanc.io. If you are an employee of one of our customers, we may need to forward your request to that customer, who is the controller of their campaign data. If a complaint remains unresolved, you may refer the matter to the CNIL (www.cnil.fr) or to your own national data protection authority.

To disconnect a Google account from SmartXSP, use the integration settings inside the platform, or revoke SmartXSP's access at myaccount.google.com/permissions. Revoking access stops all further API calls; the tokens we hold become invalid and are deleted.

8. Cookies and similar technologies

On my.smartxsp.io we set only the cookies required to keep you signed in and to protect forms against cross-site request forgery. No advertising or analytics cookies are set on the platform itself.

As part of our retargeting services, we place one advertising identification cookie on the .deepsmx.com domain:

Name	Domain	Duration	Purpose
`_ob_uid`	`.deepsmx.com`	90 days	Cross-site identifier for the delivery of personalised advertising

This cookie is set only after the user's consent has been collected through the Consent Management Platform in place on the partner website, in accordance with the IAB Europe Transparency and Consent Framework. Our full technical declaration is published as deviceStorage.json and summarised in our legal notices.

9. Changes to this policy

We update this page when our processing changes, and revise the date at the top. Material changes affecting customers are announced by email to account administrators.

10. Contact

Edge Query SAS — Lutzelhouse, Alsace, France
Privacy: privacy@oursblanc.io · General: hello@oursblanc.io · Platform support: technical@smartxsp.io