Privacy Policy

Effective date: 8 August 2026

This Privacy Policy explains how Mahhala Inc. ("Mahhala", "we", "us", "our") collects, uses, shares and protects personal information in connection with Ads.Mahhala, our advertising network, and the website at ads.mahha.la (together, the "Services").

Two different groups of people are covered here, and we have deliberately kept them separate rather than blurring them into one "user":

• Account holders — advertisers running campaigns and publishers selling ad space. You sign in, we know who you are, and most of this policy is about the information you give us.
• People who see our ads — visitors to publisher websites across the network. You never signed up for anything. What we process about you is limited, we do not know your name, and section three is written for you.

Ads.Mahhala is separate from the mahha.la marketplace, which has its own privacy policy. Both are operated by Mahhala Inc.

Summary

• We do not sell personal information.
• Our ads set no cookies and build no cross-site profile of anyone. See the Cookie Policy.
• Advertisers see campaign performance as counts and totals, never as a list of the people who saw or clicked an ad.
• We do process IP addresses and user-agent strings to deliver ads, prevent fraud, and measure conversions. That is personal data, and it is described honestly below.
• Account holders can export or delete their data from account settings.
• Card details never touch our servers. Stripe handles payments.

1. Information we collect from account holders and prospective ones

Account and business information. Your name, email address, password (stored only as a salted hash — we never see it), and your company name. Publishers and advertisers also provide the business details needed to invoice or pay them, including tax identifiers and billing addresses where applicable.

Campaign and inventory content. Everything you create in the dashboard: campaigns, budgets, targeting settings, ad creatives and their copy and imagery, conversion pixels, properties and ad zones.

Billing information. Invoices, payments, credits and refunds. Payment card data is collected and stored by Stripe, our payment processor, on Stripe's own systems — we receive only a token, the last four digits, and the card brand. For publisher payouts we use Stripe Connect, and Stripe collects the identity and bank details required by law directly from you.

Security and account-activity records. To keep accounts safe and to meet our audit obligations we record sign-ins and sign-in failures, two-factor and passkey enrolment, trusted devices, active sessions, API key creation and use, and significant actions taken in the account (who changed a budget, who approved a payout). These records include the IP address and user-agent of the device that acted, and the approximate location we derive from the IP address. You can see your own sessions and devices under Settings → Security.

Support correspondence. If you write to us, we keep the correspondence so we can answer it and improve.

Anti-bot signals. Where enabled, Google reCAPTCHA runs on the sign-in and registration forms. Google's processing for that purpose is governed by the Google Privacy Policy.

Waitlist requests. If registration is closed when you visit, we offer a waitlist form. It collects your email address and, optionally, which side of the network you were interested in (running ads or selling ad space). We use it for one thing: to tell you when registration reopens. It is not an account, we do not add it to marketing lists, and asking us to remove you removes the whole record.

2. How we use account-holder information

• To provide the Services: your account, your campaigns, your inventory, your reporting.
• To bill you, pay you, and keep accurate financial records.
• To secure accounts: detecting credential stuffing, enforcing two-factor authentication, and recognising trusted devices.
• To review ad creatives against our content policies before they go live.
• To communicate with you: verification and password-reset emails, security notices, invoices and payment reminders, team invitations, and replies to your messages. Marketing email is opt-in and separately unsubscribable.
• To comply with legal, tax and accounting obligations, and to establish or defend legal claims.

Our legal bases are: performance of a contract (running your account and campaigns), legal obligation (tax, accounting, sanctions and fraud-prevention duties), legitimate interests (securing the platform, preventing abuse, and improving the Services), and consent where we ask for it, such as marketing email.

3. Information we process when an ad is shown

This section is about people who see our ads on publisher websites, and it is the part most worth reading closely.

We do not set cookies to deliver or measure ads. An ad reaches a page either server-to-server — where the publisher's own server fetches it and renders it, and your browser never contacts us — or through a small JavaScript tag that requests and displays the ad without writing anything to your browser's storage. There is no advertising identifier for us to follow you with.

What our servers record when an ad is served, seen, or clicked:

What we do not do. We do not attach your name or email to any of this. We do not combine it with the mahha.la marketplace's data about shoppers. We do not build an interest profile, we do not sell or share this data with data brokers, and we do not let advertisers see individual rows — advertisers see aggregate counts and totals for their own campaigns.

Targeting is contextual. Ads are matched to the page and the audience the publisher has declared — the site's content category, the placement, the country, the device type — not to a profile of you as an individual.

Conversion measurement. If an advertiser installs our conversion pixel on their own website, and you take an action there such as completing a purchase, the advertiser's site reports that action to us. We match it back to an earlier click by comparing the IP address and user-agent string, within an attribution window that defaults to 28 days and can be shortened by the advertiser. If they match, the advertiser learns that one conversion followed one of their ads. They do not learn who you are from us.

Our legal basis for this processing is legitimate interests — operating an advertising network that publishers depend on for revenue, billing advertisers accurately, and preventing click fraud. We consider this proportionate because the data is limited to what delivery and billing require, it is not used to profile individuals, no identifier is stored on your device, and it is retained for a limited period. You can object to this processing (see section 7). Where local law requires consent for this kind of processing, we rely on the publisher whose site you are visiting to obtain it, and we require them by contract to do so.

4. How we share information

We do not sell personal information, and we do not share it with data brokers or advertising exchanges outside our own network.

We share information only:

• With service providers who process it on our behalf under contract and on our instructions: our cloud hosting and database providers, Stripe for payments and payouts, and our transactional email provider. They may not use it for their own purposes.
• Between the two sides of a transaction, in aggregate. A publisher sees what their inventory earned; an advertiser sees what their campaign delivered. Neither sees the other's account data, and neither sees individual people.
• Where you direct it — for example, inviting a colleague onto your account.
• For legal reasons: to comply with a law, regulation, subpoena or valid legal process; to enforce our terms; or to protect the rights, property or safety of Mahhala, our users, or the public.
• In a business transfer: if we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction. We will give notice before your information becomes subject to a different privacy policy.

5. Retention

We keep information for as long as it is needed for the purpose it was collected for:

• Account and campaign records — for the life of the account, and afterwards where we must retain them (financial records are typically kept for seven years to meet tax and accounting obligations).
• Ad-delivery and tracking records — retained in aggregated form for reporting. Row-level records containing IP addresses are kept only as long as needed for attribution, billing reconciliation and fraud investigation, and are then aggregated or deleted.
• Security and audit records — retained per our SOC 2 obligations, then purged on a schedule.
• Waitlist requests — kept until registration reopens and we have written to you, or until you ask us to remove you, whichever comes first.

When an account is closed, we anonymise the personal details of the people on it while retaining the business's billing and tax records, which we are legally required to keep. This is deliberate: we cannot delete an invoice we are obliged to hold.

6. Security

We protect information with encryption in transit, hashed passwords, two-factor authentication and passkey support, scoped API keys, strict tenant isolation so one account cannot read another's data, least-privilege database credentials, and an audit log of significant actions. No system is perfectly secure, but we treat these as baseline rather than optional.

If you believe you have found a vulnerability, please write to support@ads.mahha.la rather than disclosing it publicly, and we will work with you.

7. Your rights and choices

Account holders can, from within the dashboard:

• Access and export — download a copy of your data under Settings → Data Export.
• Correct — update your account and business details in settings.
• Delete — close your account, which anonymises your personal details subject to the retention rules above.
• Manage security — review and revoke active sessions and trusted devices.
• Unsubscribe — from any marketing email, without affecting service notices.

Depending on where you live, you may also have the right to object to or restrict processing, to data portability, to withdraw consent, and to lodge a complaint with your local data protection authority. If you are in the EEA or UK, you may complain to your national supervisory authority.

If you saw one of our ads and want to exercise a right over the delivery records described in section 3, write to support@ads.mahha.la. Be aware of the honest limitation: because we hold no identifier for you, we usually cannot find "your" records from an email address alone. You can tell us the IP address and approximate time and we will search on that basis. You can object to this processing at any time, and the most effective practical controls are your browser's tracking protections and a VPN.

We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act, and we do not process sensitive personal information to infer characteristics. We do not knowingly serve ads targeted to children.

8. International transfers

We operate from the United States, and our service providers may process information in the United States and elsewhere. Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK Addendum.

9. Children

The Services are for businesses and are not directed to children. You must be 18 or older to hold an account. We do not knowingly collect personal information from children, and we do not permit advertisers to target children through the network.

10. Changes to this Policy

We may update this Policy. When we make material changes we will revise the effective date above and, for account holders, notify you by email or in the dashboard. Continued use after a change takes effect constitutes acceptance.

11. Contact us

Mahhala Inc.

Privacy questions, requests and complaints: support@ads.mahha.la