Privacy Policy

Last updated: 9 September 2026

This policy explains what data the SmartXSP platform (my.smartxsp.io) collects, why it is collected, who it is shared with, how long it is kept and how to have it deleted. It covers the people who sign in to SmartXSP (our customers' staff), the data our customers process through the platform in order to run advertising campaigns, and the data collected when a SmartXSP creative or measurement tag runs in a browser.

1. Who we are

SmartXSP is an advertising campaign management platform operated under the OursBlanc brand by:

Edge Query SAS — société par actions simplifiée with a share capital of €100,000
RCS Saverne — SIREN 851 509 315
Registered office: Lutzelhouse, Alsace, France — offices in Paris, Lyon and Luxembourg
Publication director: Olivier Schaal
General contact: hello@oursblanc.io
Privacy contact: privacy@oursblanc.io
Full legal notices: oursblanc.io/legal-mentions

Edge Query SAS is registered in the IAB Europe Global Vendor List (GVL) under Vendor ID 1338.

For data our customers upload or generate while running their campaigns, the customer is the data controller and Edge Query SAS acts as a processor on their instructions. For account data, for the operation of the platform itself and for the advertising identifiers described in section 2.3, Edge Query SAS is the controller.

2. Data we collect

2.1 Account and identification data

Name, professional email address, telephone number where provided, employer or agency, role and permissions inside the platform.
Authentication data: a hashed password, session identifiers, API tokens and, where enabled, two-factor authentication secrets.
Sign-in and activity records: timestamps, IP address and user agent of sessions, and an audit trail of the actions taken in the platform (campaign created, budget changed, creative published).

2.2 Campaign and business data

Campaigns, insertion orders, budgets, flight dates, targeting settings, audience segment definitions, product feeds and creative assets uploaded by the customer.
Commercial documents: contracts, purchase orders and invoices related to the customer's use of the platform.
Aggregated delivery and performance statistics: impressions, clicks, viewability, video completions, conversions and spend, by campaign, creative, placement, site, device and geography.

2.3 Data collected when an advertisement is served

Our ad-serving and measurement tags process the following when a campaign creative is displayed, or when a measurement tag fires on a partner website:

Technical request data: IP address, user agent, referring page URL, timestamp, language and screen characteristics.
Derived, non-identifying context: approximate location at city or region level obtained from the IP address, device type, and contextual signals such as local weather or the time of day, used to select which creative variation to display.
A device identifier stored in the _ob_uid cookie, used for frequency capping, click and conversion de-duplication, and — for our retargeting services — to build and use an advertising profile from aggregated behavioural data.

These purposes rely on the consent collected by the website operator through its Consent Management Platform, under the IAB Europe Transparency and Consent Framework (TCF):

Purpose	Legal basis (IAB TCF — Vendor 1338)
Store and/or access information on a device	Consent (Purpose 1)
Create a personalised advertising profile	Consent (Purpose 3)
Use a profile to select personalised advertising	Consent (Purpose 4)
Measure advertising performance	Consent (Purpose 7)

We do not sell personal data, and we do not knowingly process data relating to children. Reporting datasets shown in the platform are aggregated and are not used to identify a named individual.

2.4 Data obtained from Google APIs

When a customer connects a Google advertising account to SmartXSP, we store the OAuth access and refresh tokens issued by Google, the identifiers of the accounts, containers, advertisers and line items the customer designates, the campaign and creative objects we create there on the customer's behalf, and the delivery and spend figures we read back for reporting.

SmartXSP requests only the scopes needed for the modules the customer enables — Google Tag Manager container editing and publication, Display & Video 360, Campaign Manager 360 and Google Ad Manager trafficking and reporting. We do not request access to Gmail, Google Drive, Contacts, Calendar, Photos or any other personal Google service.

Limited Use disclosure

SmartXSP's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through Google APIs is used only to provide and improve the campaign management features the customer asked for; it is never sold, never transferred to third parties except as necessary to provide the service, to comply with applicable law or as part of a merger or acquisition, never used for advertising profiling of our own, and never read by humans except with the customer's explicit consent, to resolve a support request, for security purposes, or where required by law.

3. Why we use this data

Purpose	Data used	Legal basis (GDPR)
Providing the platform: authentication, permissions, campaign management	Account data, campaign data	Performance of the contract
Executing campaigns on connected platforms	Campaign data, Google API tokens and objects	Performance of the contract
Serving, capping and personalising the creative shown to a browser	Request data, `_ob_uid` identifier, advertising profile	Consent (IAB TCF purposes 1, 3, 4 and 7)
Reporting and invoicing	Aggregated statistics, commercial documents	Contract and legal obligation
Security, fraud prevention, debugging	Logs, audit trail	Legitimate interest

4. Who the data is shared with

Demand-side platforms integrated with SmartXSP, for the purposes of programmatic delivery: DV360 (Google), Amazon DSP, The Trade Desk, Adform, StackAdapt and Xandr. Each operates under its own privacy policy and is responsible for its own processing.
The customer's own connected platforms — Display & Video 360, Campaign Manager 360, Google Ad Manager and Google Tag Manager. Data flows there because the customer instructed us to run their campaign on them.
Infrastructure providers acting as sub-processors: hosting by Scaleway SAS (BP 438, 75366 Paris CEDEX 08, France), managed databases, content delivery and transactional email. Servers are located in the European Union.
Nobody else. We do not sell personal data and we do not share it with data brokers.

Where a transfer outside the European Economic Area is unavoidable — for instance when a campaign is executed on a Google platform — it takes place under the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism.

5. How long we keep it

Advertising performance measurement data (TCF purpose 7): 30 days.
Advertising profile data (TCF purposes 3 and 4), including the _ob_uid cookie: 730 days.
Account data: for the life of the account, then deleted or anonymised after it is closed.
Google OAuth tokens: until the customer disconnects the integration or revokes access, at which point the stored tokens are deleted. Tokens are also deleted when an account is closed.
Campaign and creative data: for the life of the account, unless the customer deletes it sooner.
Invoices and contracts: 10 years, as required by accounting law.

6. Security

Traffic is encrypted in transit with TLS. Passwords are stored only as salted hashes. Access to production systems is restricted to named administrators, over authenticated channels, and is logged. Each customer account is isolated by application-level access control so that one customer cannot read another's campaigns, creatives or statistics. Credentials for connected platforms, including Google OAuth tokens, are stored in access-restricted storage and are used only by the server-side jobs that need them.

7. Your rights

Under the GDPR (EU Regulation 2016/679) and the French Data Protection Act, you have the right to access your personal data, to have inaccurate data corrected, to have it erased, to object to processing, to request restriction of processing, to withdraw your consent at any time without retroactive effect, and to receive a portable copy of your data.

To exercise these rights, write to privacy@oursblanc.io. If you are an employee of one of our customers, we may need to forward your request to that customer, who is the controller of their campaign data. If a complaint remains unresolved, you may refer the matter to the CNIL (www.cnil.fr) or to your own national data protection authority.

To disconnect a Google account from SmartXSP, use the integration settings inside the platform, or revoke SmartXSP's access at myaccount.google.com/permissions. Revoking access stops all further API calls; the tokens we hold become invalid and are deleted.

8. Cookies and similar technologies

On my.smartxsp.io we set only the cookies required to keep you signed in and to protect forms against cross-site request forgery. No advertising or analytics cookies are set on the platform itself.

As part of our retargeting services, we place one advertising identification cookie on the .deepsmx.com domain:

Name	Domain	Duration	Purpose
`_ob_uid`	`.deepsmx.com`	730 days	Cross-site identifier for the delivery of personalised advertising

This cookie is set only after the user's consent has been collected through the Consent Management Platform in place on the partner website, in accordance with the IAB Europe Transparency and Consent Framework. Our full technical declaration is published as deviceStorage.json and summarised in our legal notices.

9. Changes to this policy

We update this page when our processing changes, and revise the date at the top. Material changes affecting customers are announced by email to account administrators.

10. Contact

Edge Query SAS — Lutzelhouse, Alsace, France
Privacy: privacy@oursblanc.io · General: hello@oursblanc.io · Platform support: technical@smartxsp.io