Privacy Policy

Last updated: October 7, 2026

SPO.expert ("we," "our," or "us") operates the website at spo.expert, the client dashboard at dashboard.spo.expert and the measurement tag served from nodexpath.com (together, the "Service"). This policy explains what data the Service processes, why, for how long, and who else is involved. The Service is built to work with as little personal data as possible, and this page describes exactly what that means in practice.

1. The Short Version

  • The measurement tag collects data about ad impressions, not about people. It sets no cookies, carries no device or user identifiers, and we do not record the IP address or browser of anyone who loads it.
  • The website sets no cookies and runs no analytics. There is no contact form: to reach us, message our LinkedIn page.
  • The client dashboard uses only the cookies needed to keep an authorized user signed in.
  • Data is hosted in Germany. Three service providers help us run the Service — Hetzner (hosting), Cloudflare (network security) and OpenAI (the AI analyst) — plus Google Workspace for email. We never sell data.

2. Who We Are and How to Reach Us

The Service is operated by SPO.expert — Roman Sarychev, Lisbon, Portugal. For anything related to this policy or your data, email [email protected] or message our LinkedIn page.

3. The Measurement Tag (nodexpath.com)

3.1 What it is

Our clients — supply-side platforms, ad exchanges, ad networks and demand-side platforms — place a 1×1 pixel tag in their ad-serving flow. It is requested once per ad impression, either from the client's own servers or from the HTML of the served ad, and it reports that impression's supply chain to us.

3.2 What it carries

The tag's parameters describe the advertising transaction, not the person who saw the ad:

  • the tag version and the client's account ID;
  • the bid request (auction) ID;
  • the name of the partner that sent the impression and, where known, the publisher's name;
  • the site domain or app bundle the ad ran in, and the app-store listing URL for apps;
  • an inventory-partner domain (used for CTV inventory);
  • the bid price and the client's advertiser ID;
  • the IAB SupplyChain object — the list of sellers (seller domains and IDs) the impression passed through.

Any other parameter sent with the request is discarded on arrival. The tag is not designed to carry personal data, and clients must not include any in its parameters.

3.3 What it does not collect

  • It sets no cookies and reads none.
  • It carries no device identifiers, user identifiers, or any other identifier of the person who saw the ad.
  • We do not store the IP address, browser or any other characteristic of the device that loaded the tag — neither in our database nor in our server logs (see section 6).

3.4 Whose data it is

Impression data belongs to the client that fires the tag. We process it on that client's behalf and under our agreement with them, solely to analyze and verify the client's supply paths. We do not combine it with data about individuals, and we do not use it for advertising or profiling. Each client remains responsible for the notices and permissions its own ad serving requires; the tag adds no data collection about the viewer to it. Where the data we process for a client includes personal data, our Data Processing Addendum applies.

4. Client Accounts and the Dashboard

4.1 Account data

When a client authorizes people to use the dashboard, we store the details needed to run their accounts: name, work email address, role and company.

4.2 Cookies

Signing in sets two strictly necessary cookies: one that keeps the session alive and one that protects it against cross-site request forgery. They expire after a set period or when the user signs out. The dashboard sets no analytics, advertising or third-party cookies.

4.3 Sign-in protection

To block password-guessing attacks, the sign-in endpoint keeps a short-lived count of attempts per network address and per account. The count lives in memory for a few minutes and expires automatically; when a block is triggered, the event is recorded in the application log (section 6).

4.4 The AI analyst

When a user asks the AI analyst a question or runs one of its reports, the question and the relevant supply-path data from that client's account — seller names and IDs, domains, app bundles, and aggregated impression and revenue figures — are sent to OpenAI to generate the answer. User names and email addresses are not sent. OpenAI processes this data as our service provider (see section 7); under OpenAI's API terms, data sent through the API is not used to train OpenAI's models.

5. The Website (spo.expert)

The website is a set of static pages. It sets no cookies, runs no analytics or tracking scripts, and has no contact form — nothing you type on this site is stored anywhere. If Cloudflare, our network provider, suspects automated traffic, it may set a short-lived security cookie; it contains no personal data and is deleted automatically.

Contacting us. To get in touch, message our LinkedIn page. Messages sent on LinkedIn are processed by LinkedIn under its own privacy policy; we read them there and keep them only for as long as the conversation needs. If you email us, we keep the correspondence in our business mailbox (Google Workspace) for as long as the business relationship requires.

The website may link to other sites. We are not responsible for their privacy practices.

6. Server Logs

Like every web server, ours keep a technical log of requests, used only for security, abuse prevention and troubleshooting:

  • Tag domain (nodexpath.com): the log records the requested URL (that is, the tag parameters listed in section 3.2), the time, the method, and the response status and size. It records neither the IP address nor any request header (browser, referring page, language) of the caller — it contains no personal data.
  • Website, dashboard and API domains: the log records the time, the page or endpoint requested, the response status and size, and a truncated IP address — the last part is removed, so it points to a network, not a device. No request headers are recorded: no browser type, no referring page, no proxy headers.
  • Application logs: when the sign-in protection described in section 4.3 blocks an attempt, the event is recorded with its network address. Beyond that, the application logs contain no data about individuals.

Web server logs are kept on our own server only, are never included in backups, and are deleted automatically after at most 14 days. Application logs are short-lived as well: they are replaced at each deployment of the Service, so a record of a blocked sign-in attempt lives for days, not months. The server also keeps standard security logs of attempts to reach its administrative interface; they concern administrators and attackers, not users of the Service.

All our domains are served through Cloudflare's network, which processes full connection data — including IP addresses — at its edge in order to block attacks before they reach us. We do not receive or store those connection logs.

7. Service Providers

We share data only with the providers below, under data processing terms that allow them to use it solely to provide their service to us, and only to the extent needed for the stated purpose:

  • Hetzner Online GmbH (Germany) — hosts our servers and our encrypted backups in its Falkenstein, Germany data center.
  • Cloudflare, Inc. (United States; global network) — provides network security and routing for all our domains, and processes connection data for that purpose.
  • OpenAI (contracting entity for EEA customers: OpenAI Ireland Ltd.; data is processed in the United States) — generates AI analyst answers from the data described in section 4.4, only when a client uses the AI analyst.
  • Google (Google Workspace) — provides our business email.
  • LinkedIn — handles messages sent to our LinkedIn page under its own privacy policy.

Two further tools serve only our own operations and receive no data about users or clients: Resend (delivers monitoring alerts to us) and BetterStack (checks that the website is up).

We update this list before we start using a new provider, so it always reflects who actually processes data for us. Beyond that, we disclose data only when the law requires it, to protect our rights or the security of the Service, or — with notice to the affected clients — as part of a merger, acquisition or sale of assets.

8. Where Data Is Processed

Our servers and backups are located in Germany, in the European Union. Cloudflare, OpenAI and Google may process data outside the EU, including in the United States. Such transfers rely on the European Commission's Standard Contractual Clauses or, where the provider is certified, the EU–U.S. Data Privacy Framework.

9. Why We Process Data and on What Legal Basis

  • Providing the Service to our clients — processing impression data and running client accounts under our agreement with each client (performance of a contract).
  • Security and reliability — server logs, sign-in protection and backups (our legitimate interest in keeping the Service secure and available).
  • Answering people who contact us — handling your message and the steps that follow (our legitimate interest, or steps taken at your request before entering into a contract).
  • Legal obligations — where the law requires us to keep or disclose data.

We do not use data for advertising, profiling or automated decisions about individuals, and we never sell it.

10. How Long We Keep Data

  • Impression data — for as long as the client's account is active, then deleted within 90 days after the agreement ends, unless the agreement says otherwise.
  • Account data — for the life of the account, then deleted within 90 days.
  • Web server logs — at most 14 days. Application logs — replaced at each deployment of the Service, typically within days.
  • Backups — encrypted backups are rotated automatically; a copy of deleted data can remain in them for up to 12 months before it is overwritten.
  • Correspondence — for as long as the business relationship requires.

11. Security

All connections to the Service are encrypted (TLS). Our servers accept administrative access by key only and sit behind a firewall and request rate limits; Cloudflare filters attacks before they reach us. The tag is served from its own domain so that it cannot reach the dashboard or the API. Backups are encrypted before they leave the server. Most importantly, we keep the data footprint small: what we do not collect cannot be lost. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If a security incident affects personal data, we notify the affected clients without undue delay.

12. Your Rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to receive it in a portable format, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. You can also complain to your data protection authority (in Portugal, the CNPD). We answer requests within one month.

To exercise any of these rights, email [email protected]. If your request concerns data we process on behalf of one of our clients, we will pass it to that client or help them respond.

13. Children

The Service is not intended for individuals under the age of 16, and we do not knowingly collect personal information from children. If we learn that we have, we will delete it promptly.

14. Changes to This Policy

We may update this policy from time to time. Material changes are announced by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after a change constitutes acceptance of the revised policy.

15. Contact