Privacy Policy.
VRA is an independent, buyer-funded rating agency. Our business model does not rely on collecting or selling data about our readers. This policy explains, in plain language, what we collect when you use our registry, API, newsletter, and research tools — and what we do and don't do with it.
Summary & principles.
Three commitments frame everything below:
- Buyer-funded, not data-funded. We do not monetize reader data. VRA is supported by buy-side subscriptions, not by advertising, retargeting, or the sale of personal information.
- Minimal collection. We ask for no more than we need to run the registry, deliver research to subscribers, and keep our systems operating safely.
- Checkability. You can ask what we hold about you, correct it, or have it deleted. We'll respond within a reasonable time.
Information we collect.
We collect three narrow categories of information:
Information you give us
- Account & subscription data — name, work email, employer, job role, billing details — when you subscribe to VRA Insights or register for API access.
- Correspondence — messages, questions, audit requests, and disputes sent to us directly.
- Newsletter signups — email address, opt-in timestamp, and the page you signed up from.
Information collected automatically
- Request metadata — IP address, user-agent, referrer, URL, and timestamp. Used for logs, security, and aggregate analytics.
- Device hints — locale, screen size where provided by the browser, to render the registry correctly.
- Cookies & local storage — see § 06 and the full cookie policy.
Information we are given by third parties
- Payment metadata from our payment processor (we do not store full card numbers).
- Single-sign-on attributes if you authenticate through a corporate identity provider.
How we use it.
We use the information we collect to:
- Operate the public registry, API, and subscriber dashboards.
- Authenticate subscribers and enforce access control.
- Deliver research, briefings, downgrade alerts, and the newsletter you asked for.
- Bill subscriptions and respond to billing inquiries.
- Investigate abuse, fraud, scraping, and other misuse of the service.
- Measure aggregate usage of the registry (e.g., "how many searches were run on the Lotame supplier page?") in a way that does not identify individual readers.
- Comply with legal obligations where we must.
Legal basis.
Where European data-protection law applies, we rely on:
- Contract — to provide the registry, API, and subscription services you've signed up for.
- Legitimate interests — to secure the service, prevent abuse, and measure aggregate usage. We balance these interests against your rights in each case.
- Consent — for non-essential cookies, newsletter delivery, and optional research communications. You can withdraw consent at any time.
- Legal obligation — where we're required to retain records (e.g., tax, accounting).
Sharing & disclosure.
We share information only in these limited cases:
- Service providers — hosting, email delivery, payment processing, error monitoring, and customer support, bound by written contracts that restrict their use of the information.
- Corporate subscribers — if you use VRA through your employer's subscription, your organization's admin may see account-level usage metadata. They do not see the content of your personal correspondence with us.
- Legal — to comply with valid legal process, or to protect rights, property, and safety.
- Business transfer — if VRA is acquired or reorganized, information may transfer as part of that transaction; successors inherit the obligations of this policy.
We do not share supplier data with other suppliers. We do not share subscriber lists with the rated suppliers, ever.
Cookies & local storage.
We use a small number of cookies and browser-local storage entries. They fall into two buckets:
Strictly necessary
Keep the registry usable and remember the choices you've made. Set whether or not you accept non-essential cookies.
- vra_consent — records your cookie-consent choice. Stored locally; not sent to our servers.
- vra_session — authenticates subscribers against their account.
Analytics (non-essential)
If you accept, we set a first-party identifier used solely to measure aggregate readership of the registry and research. You can reject these in the banner or change your decision any time from the footer.
Full details are in the cookie policy.
Analytics & third parties.
We keep the third-party surface intentionally small:
- Hosting & logs — standard server logs for operations and security.
- Fonts — loaded from Google Fonts over HTTPS. Google receives the request metadata inherent to any web-font fetch; we share no additional data with them.
- Email delivery — transactional and newsletter emails are delivered through a reputable ESP bound by our data-processing agreement.
- Payments — processed by a PCI-DSS-compliant processor; we do not store primary account numbers.
The public registry.
The VRA Registry is public by design. It lists rated audience segments, their current VRA Grade, rating history, and methodology metadata. The registry does not contain personal information about readers or subscribers. Supplier identifying information is published in the public interest as part of our rating function, and is protected as editorial speech.
Supplier sample data.
When a rated supplier submits a sample file for assessment, that file may contain identifiers (hashed emails, device IDs, or pseudonymous audience keys). We process this data strictly to compute the VRA Grade for that supplier's segment. We do not re-use supplier sample data for any other purpose, do not combine it with reader data, and return or destroy it under the terms of our supplier data-processing agreement.
Your rights.
Depending on where you live, you may have the right to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Delete your information, subject to limited legal exceptions.
- Port your information to another service in a common, machine-readable format.
- Object to, or restrict, certain processing.
- Withdraw consent where processing is based on consent.
- Lodge a complaint with your local data-protection authority.
To exercise any of these rights, email privacy@verifiedaudiences.com. We'll respond within 30 days.
Retention & security.
We keep subscriber information while your account is active, plus a short archival window to honor cancellations and meet records obligations (typically up to 7 years for billing). Server logs rotate on a rolling basis, usually within 90 days. Newsletter data is retained while you remain subscribed and for a limited period thereafter to honor unsubscribes.
We apply reasonable technical and organizational safeguards — encrypted transport, access controls, least-privilege defaults, audit logging. No system is perfectly secure; we notify affected readers and regulators as required if something goes wrong.
International transfers.
VRA operates primarily from the United States. If you access the service from outside the US, your information will be transferred to and processed in the US under appropriate safeguards, including Standard Contractual Clauses where required.
Children.
VRA is a business-to-business research service directed at buy-side advertising, measurement, and ad-tech professionals. The service is not intended for children under 16, and we do not knowingly collect information from them.
Changes to this policy.
We update this policy when our practices change. Material changes will be posted here and, where appropriate, emailed to active subscribers. The "Effective" date at the top reflects the current version.
Contact.
Questions or requests: privacy@verifiedaudiences.com.
Postal: VerifiedAudiences.com, Privacy Office, 228 Park Avenue S, PMB 99328, New York, NY 10003, USA.