Privacy Policy

1. Who we are

Taroviser is a self-serve advertising platform for iGaming advertisers. It is operated by Hygiene Software and Digital Ads Limited, a company registered in Hong Kong at West Wing 2/F, 822 Lai Chi Kok Road, Cheung Sha Wan, Kowloon. We decide how and why the personal data described in this policy is processed.

Taroviser is a business-to-business service intended only for people aged 18 or over who act for themselves or for a business.

2. Information you give us

Account details. When you create an advertiser account we collect your account type (individual or company), your full name, your email address, a password, your company name (company accounts only) and, if you choose to give them, your country and Telegram username. You also confirm that you are 18 or over and accept our Terms of Service and this Privacy Policy.

Enquiries. If you use our contact form we collect your name and work email, plus any optional details you add: company, website, vertical, monthly budget range, Telegram username and your message.

Billing details. If you ask for invoices that show formal billing details, we record what you send us, such as your legal company name, company registration number, tax ID and registered address. We do not ask for these at sign-up.

Campaigns and creatives. When you create campaigns we store the settings you choose (campaign name, ad format, pricing model, landing page URL, vertical, bids, budgets and targeting such as countries, devices, operating systems and schedules) and your ad creatives (titles, text and images). Uploaded images are stored exactly as uploaded, including any embedded metadata, and are publicly accessible by their link because they have to be shown as ads.

Support conversations. When you contact support from the dashboard we store your messages, the replies and any files you attach, such as CSV, Excel, PDF or image files.

3. Information we collect as you use the service

Payments and wallet. For every top-up we record the amount, currency, payment method, status, processing fee, amount credited, dates, and the payment processor's order ID or the blockchain transaction hash. We keep a ledger of your wallet balance, deposits, campaign spend and refunds.

Campaign performance. We receive aggregated statistics for your campaigns (impressions, clicks, conversions and spend per day, and by country or region) from the advertising network partners that deliver them.

Conversions. If you send conversions to our postback URL, we store the click ID, event type, payout amount and currency, and whether we forwarded it successfully.

Website and dashboard usage. Google Tag Manager, Google Analytics and Google Ads tags on our website and dashboard collect information about how you use our pages, including the address of each page you visit, your IP address and your browser and device details. See section 8.

Technical logs. If an error occurs we store technical details such as the error message, stack trace, the page address or request path and, if you are signed in, your account ID. Our background services also write log files on our servers, which can contain support message text, account email addresses and campaign details. Our network provider processes your IP address and request details to deliver and protect the site.

IP addresses. The current platform does not store advertisers' IP addresses. Apart from the archived records described in section 12, we store IP addresses only in an internal audit log of actions taken by our own staff.

4. Information we do not collect

We never receive or store your full card number or security code. Card details are entered into fields hosted by PayPal and go directly to PayPal, and we do not save cards for later use.

We do not ask for or store your crypto wallet address. Blockchains are public, however, so anyone who has a transaction hash can see the sending address on a block explorer.

We do not offer Sign in with Google and we do not access data in your Google account (see section 9).

The sign-up flow does not ask for identity documents, dates of birth or phone numbers. If we ever ask you to verify your identity or business, we will use what you send only for that check and keep it as described in section 12.

5. How we use your information

To create and manage your account, verify your email address and keep your account secure.

To run your campaigns: submitting them to our advertising network partners, checking creatives against our advertising rules, syncing status and statistics, charging campaign spend to your wallet and pausing campaigns when your balance runs low.

To process payments: confirming card payments with PayPal, matching crypto transfers to your top-up, preventing double credits, handling refunds and chargebacks, and producing invoices on request.

To provide support, including through Jarvis, our automated assistant (see section 6).

To send service emails: email verification codes, password-reset codes, a one-time welcome email and, when needed, important notices about our service or this policy. We do not send marketing newsletters, and our emails contain no tracking pixels or tracked links. If you submit our contact form, we use your details to reply and to discuss Taroviser services with you.

To measure and improve our website and our own advertising, for example how many visitors sign up, log in or make a deposit after seeing or clicking one of our ads on Google (see section 8).

To prevent abuse and fraud, enforce our Terms of Service and Acceptable Use Policy, and meet our legal, accounting and tax obligations.

6. Jarvis, our automated assistant

Support and optimisation requests in the dashboard are answered first by Jarvis, our automated assistant, which uses a third-party AI service provider. To answer, Jarvis receives the recent messages in your conversation, files you attach when they are reviewed, and a snapshot of your account: your account ID, name, email, company, country, wallet balance, and your campaigns (including archived ones) with their settings, landing page URLs and recent statistics.

When you ask, Jarvis can make changes to your own campaigns, such as creating campaigns or changing bids, budgets, targeting or campaign status. These changes are applied through the same account-scoped functions as the dashboard, which act only on campaigns that belong to your account, and they take effect without a person reviewing them first. Jarvis is instructed to ask for your confirmation before larger changes, such as a very large bid increase, removing all target countries or committing most of your balance, and it cannot delete campaigns. Replies are checked automatically against your real account data before they are posted, and conversations are passed to our team when a person is needed.

We also use the AI service to help our team diagnose technical errors. To do this it can read error records and other files on our servers, such as logs and internal reports, which may contain account IDs, email addresses, support messages, campaign names, ad text and URLs, as well as the archived records described in section 12, which include contact and login details of people who used our earlier website.

If you contact our support team on Telegram, we may link the chat to your account using the Telegram username on your account or the account email address you give us in the chat. Replies may be prepared with Jarvis's help; in that case Jarvis receives your recent Telegram messages and, if the chat is linked to an account, that account's name, email, balance and recent campaigns, and changes you ask for, such as creating or pausing campaigns, may be applied to your account. Images you send us for use as ads are stored on our servers at a public link. We keep a log of these chats, including usernames and message excerpts.

7. How we share information

Advertising network partners. To deliver your campaigns we send our advertising network partners the campaign information they need: campaign name, ad format, pricing model, landing page URL, bids, budgets, targeting and creatives, and, for conversions, the click ID and payout amount. We do not give partners your name, email, company or billing details, although the campaign name, landing page and creatives you choose may identify your brand to them.

Payment providers. PayPal processes card payments under its own privacy policy. Crypto top-ups go straight to wallets controlled by Taroviser; to confirm them we query public blockchain services using only our own receiving addresses.

Service providers. We use Google (Google Workspace to send and receive email; Google Analytics, Google Tag Manager and Google Ads for analytics and advertising measurement), Cloudflare (network delivery and security), a third-party AI service provider (for Jarvis), and Telegram, which we use for internal staff notifications. These notifications can include your email address and the reason when a support case is escalated, error details, and campaign performance summaries for your account. These providers process data to provide their services to us. Google also uses information collected by its tags under its own policies (see section 8).

Legal and business reasons. We may disclose information when the law requires it or to protect our rights, our users or the public, and as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply.

We do not sell your personal data.

8. Cookies, analytics and advertising

Necessary cookies. A sign-in cookie keeps you logged in to the dashboard. It stays valid for up to 30 days after your last activity and is removed when you sign out. Short-lived security cookies protect the sign-in process.

Analytics and advertising tags. Our website and dashboard load Google Tag Manager, which runs Google Analytics 4 and Google Ads tags on every page. These record page views, clicks, form submissions, sign-ups, logins and deposits, and may set cookies such as _ga, _ga_<ID>, _gcl_au and _gcl_aw. If you accept, the Google Ads tag may also let Google include your browser in audiences so that Taroviser ads can be shown to you on other sites (ad personalisation). Our Google Ads set-up also includes tags for enhanced conversions, which can send Google a one-way hashed copy of an email address you enter in our sign-up or login forms.

Your choice. The first time you visit, we ask whether you accept analytics and advertising cookies, and your choice is saved in your browser's local storage. For visitors in the European Economic Area, the United Kingdom and Switzerland, Google's tags do not use cookies or user data until you accept. Elsewhere, they run with cookies from your first page view until you decline. If you decline, Google Tag Manager still loads, but Google's tags are told not to use analytics or advertising storage or user data (Google Consent Mode) and may send only limited signals without cookies, such as that a page was viewed. You can change your choice at any time with the Cookie settings link at the bottom of our website.

Server-side events. Separately, our servers send Google Analytics two events: one when you first verify your email address, and one when a deposit is credited, with the amount, currency, deposit ID and payment method. These events identify you only by an internal account ID, never by your name or email address. They are not affected by the cookie banner, and they are marked so that Google does not use them for advertising.

PayPal. Our card payment page loads PayPal's script, which may set its own cookies under PayPal's privacy policy.

For more detail see our Cookie Policy at https://taroviser.com/legal/cookies. To learn how Google uses information from sites that use its services, visit https://policies.google.com/technologies/partner-sites. You can manage ad personalisation in your Google account at https://myadcenter.google.com and opt out of Google Analytics on all websites with Google's browser add-on at https://tools.google.com/dlpage/gaoptout.

9. Google user data and Google APIs

Taroviser does not request access to your Google account and does not access, collect, store or share Google user data about the people who use our website or platform. We do not offer Sign in with Google and we never ask you for Google permissions.

Apart from the server-side Google Analytics events described in section 8, we use Google APIs only through a service account that we control, and only for Google properties and accounts that we own: the Search Console API to read aggregated search performance for taroviser.com, the Google Analytics Data and Admin APIs to read reports and settings for our own website, the Tag Manager API to manage the measurement set-up of our own website, and the Google Ads API (Keyword Planner) to research keywords for our own content and advertising campaigns. This data is aggregated or describes our own configuration, and it does not identify individual users.

We keep the results as internal reports on our own systems. Our team reviews them, and Jarvis may process them, which means they are sent to our third-party AI service provider (see section 6). A short summary of search-ranking changes may also be sent to our staff notification channel on Telegram (see section 7). We do not share this data with anyone else unless the law requires it. The service account credentials are kept on our own systems and are never used by the public website. We keep these reports only as long as we need them for these purposes, we do not sell this data, and we do not use it to profile or advertise to individuals.

Taroviser's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

10. People who see our advertisers' ads

Ads for our advertisers' campaigns are displayed through our advertising network partners, which process data about the people who view and click ads under their own privacy policies; we receive only aggregated statistics from them.

When an ad is clicked, a click ID is added to the advertiser's landing page address. If the advertiser later reports a registration or deposit to our postback URL, we receive that click ID, the event type and the payout or deposit amount and currency, and we may forward the click ID and amount to the partner that delivered the ad. These details identify an ad click, not a named person. Our application does not record the IP address or browser details of these requests, although our network provider processes them to deliver the request.

We offer advertisers an optional tracking snippet for their own websites. If an advertiser installs it, it stores the click ID and the time of the click in the visitor's browser storage on the advertiser's site, and uses it only for conversions reported within 30 days of the click. The stored ID stays in the browser until it is replaced or the visitor clears that site's data. Advertisers are responsible for telling their own visitors about this.

11. International transfers

We are based in Hong Kong. Our own servers, our service providers and our advertising network partners, including Google, Cloudflare, PayPal, Telegram and our AI service provider, may store or process data outside Hong Kong, including in the United States. We transfer data to them only for the purposes described in this policy.

12. How long we keep information

We keep account, campaign, payment and support records for as long as your account exists, and afterwards for as long as we need them for accounting, tax, legal, dispute-resolution and fraud-prevention purposes. Deleting a campaign in the dashboard archives it rather than erasing it, so that spend can still be reconciled.

Contact-form enquiries, technical logs and uploaded creative images are kept until we no longer need them.

We also hold an archived copy of the database from an earlier version of the Taroviser website, which the current platform does not use. It contains details of people who used that earlier site, such as names, email and postal addresses, phone numbers, account login details, IP addresses, browser details, contact-form messages and payment records. You can ask us to delete your records from it (see section 14).

13. How we protect information

Passwords for accounts on the current platform are stored only as salted, one-way bcrypt hashes. Email verification and password-reset codes are stored only as hashes and expire after 10 minutes, and you must verify your email address before you can sign in.

The site is served over HTTPS, the sign-in cookie is Secure and HttpOnly, the database is not exposed to the internet, staff access is limited by role, the dashboard lets each advertiser see only their own account data, and privileged staff actions such as approving deposits are recorded in an audit log.

No system is completely secure. If a breach affects your personal data, we will notify you and the authorities where the law requires.

14. Your rights and choices

In dashboard Settings you can view your profile details and change your password. On the Statistics page and each campaign page you can download your campaign statistics as CSV files.

You can ask us to access, correct or delete your personal data, to give you a copy of it, or to restrict or object to certain processing, by writing to [email protected]. We may need to verify your identity. Where the law requires us to keep certain records, such as accounting records, we will delete or anonymise the rest of the personal data we hold about you.

Where the EU or UK General Data Protection Regulation applies, we rely on these legal bases: performance of our contract with you (your account, campaigns, payments and support); our legitimate interests (security, fraud prevention, improving our service and measuring sign-ups and deposits, including the server-side events in section 8); your consent (analytics and advertising cookies, which you can decline or withdraw at any time); and our legal obligations (such as accounting and tax records).

You can decline or withdraw consent to analytics and advertising cookies as described in section 8. If you are not satisfied with our response to a request, you can complain to your local data protection authority or to the Office of the Privacy Commissioner for Personal Data, Hong Kong.

15. Children

Taroviser is only for people aged 18 or over and is not directed at children. If we learn that we hold personal data about someone under 18, we will delete it.

16. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date at the top of this page and, where a change is significant, we will tell you by email.

17. Contact us

Hygiene Software and Digital Ads Limited (Taroviser), West Wing 2/F, 822 Lai Chi Kok Road, Cheung Sha Wan, Kowloon, Hong Kong. Email: [email protected] or [email protected]. Telegram: @tarovisers.