Datenschutzerklaerung

Controller

Company

ReVantage GmbH

Address

Leipziger Strasse 48/27 , 1200 Vienna , Austria

Email

publishers@dokira.com

Data protection contact

No data protection officer is appointed. Contact: partners@dokira.com

This notice covers dokira.com and the publisher dashboard. If you are a visitor of a website that shows ads through Dokira, see the privacy notice for advertising instead.

Visiting dokira.com

Server logs

Our web server records each request: IP address, date and time, the page requested, the referring page, browser and operating system. We need this to deliver the site and keep it secure (Art. 6(1)(f) GDPR, our legitimate interest in a working and secure site). Logs are deleted after 14 days.

Cookies

dokira.com sets only the two cookies it needs to work: a session cookie and a security token against forged form submissions. Neither is used to track you, and no analytics, advertising or third-party cookies are set on dokira.com. Details are in the cookie policy. Storing these cookies is permitted without consent because they are strictly necessary (section 165(3) TKG 2021).

Applying and contacting us

When you apply through the form we store the domain, your email address, the pageview range, the optional text about your current setup, and the IP address the application came from. We use this to assess your site and reply to you (Art. 6(1)(b) GDPR, steps before a contract). The IP address is kept to stop automated abuse of the form (Art. 6(1)(f)). Applications that do not lead to an account are deleted after 12 months.

When you email us, we use what you send to answer you (Art. 6(1)(b) or (f) GDPR).

Publisher accounts

Your account

We store your name, email address, company, password (only as a one-way hash), the sites you add with their settings, and a record of logins. This is needed to provide the service (Art. 6(1)(b) GDPR).

Your sites and their earnings

For each site we keep its ad settings, its daily ad statistics (impressions, revenue) and the revenue reported by our demand partners, and the monthly statements built from them. Where you connect Google Analytics or Google Ad Manager, we receive an access token from Google and the data you grant access to (for Analytics: daily traffic figures for the property you choose). You can disconnect at any time in the dashboard. Basis: Art. 6(1)(b) GDPR.

To plan in-content ad placement we may open public article pages of your site in an automated browser, take screenshots and record the page layout, and have them analysed by an AI model (see Recipients). This concerns your site's public pages, not visitors' data.

Payouts and identity verification

Payouts are made through Stripe. When you set up payouts, you give your bank and tax details directly to Stripe, and we receive the status of your payout account. Before the first payout we verify the account holder's identity through Stripe Identity: Stripe checks an identity document and may compare it with a selfie. That comparison uses biometric data, which Stripe processes only with your explicit consent, given in Stripe's own flow (Art. 9(2)(a) GDPR). We receive the result and the verified name, not the images. Basis for the rest: Art. 6(1)(b) and (c) GDPR, to pay you and to meet anti-money-laundering, tax and accounting obligations.

Emails we send

We send account emails (sign-in links, password resets, statements, payout and policy notices). These are part of the service (Art. 6(1)(b) GDPR).

Business contacts we approach

We contact website operators whose sites may suit our network. For this we keep the site's domain and publicly available business information about it, such as public traffic and technical indicators, and the name and business email address of a contact person where one is published. We obtain this from the site itself and public sources (Art. 14 GDPR). Once we are in touch, we also keep the emails exchanged, when and how we made contact, the status of the conversation and our internal notes on it. Basis: our legitimate interest in finding publishers for our network (Art. 6(1)(f) GDPR). If nothing comes of the contact, we delete these details after 12 months. You can object at any time by writing to publishers@dokira.com; we then delete your details and keep only what we need to not contact you again.

Recipients

We use the following service providers. Those marked as processors act only on our instructions (Art. 28 GDPR).

• Hosting: Hetzner Online GmbH, Germany, on servers in Finland (EU), processor.
• Email: Google Ireland Ltd. (Google Workspace), Ireland, for sending and receiving our email, processor.
• Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA): payouts and identity verification, as an independent controller for its own legal obligations.
• Google (Google Ireland Ltd.): only if you connect Google Analytics or Ad Manager.
• Anthropic (Anthropic PBC, USA): AI analysis of screenshots and layout of publisher sites for ad placement, processor.
• InMobi (InMobi Pte. Ltd.): the consent banner Dokira provides to publisher sites; see the advertising notice.
• Tax advisers, auditors and authorities, where the law requires it.

Transfers outside the EU

Some providers above process data in the USA. Transfers rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). A copy of the safeguards is available on request.

How long we keep data

• Account data: for as long as the account exists, then deleted, except as below.
• Statements, payouts and the records behind them: seven years, as Austrian tax law requires (section 132 BAO).
• Identity verification results: for as long as anti-money-laundering rules require.
• Server logs and applications: as stated above.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have data erased (Art. 17);
• restrict processing (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interest, including direct marketing (Art. 21);
• withdraw consent at any time, without affecting processing carried out before.

Write to publishers@dokira.com. We answer within one month.

You may lodge a complaint with the Austrian data protection authority: Oesterreichische Datenschutzbehoerde, Barichgasse 40-42, 1030 Wien, dsb.gv.at, or with the authority where you live or work.

Do we have to have your data?

Applying and holding an account need the data marked as required in the forms; without it we cannot assess your site or pay you. We make no decisions about you based solely on automated processing with legal or similarly significant effects (Art. 22 GDPR).