We don't collect any data on our users other than what they need to log in and use the applicaiton.
Our icon solutions collect basic demographic information but does not attempt to identify any of the users who view our icons. The information we collect is:
In addition we also track the domain where the icon was displayed so our customers can better match our results to their own reporting.
Why do we capture this information? It allows our customers to augment their reporting if necessary and it also allows them to break down the different count metrics we collect so they can determine things like "which state has the best click-through percentage" or "is the click-through percentage better on mobile or desktop".
When our icon runs it will execute reporting "pings" which log the different actions. These log calls are standard http calls, the same as any typical website call, which provides us with the additional metrics like the type of browser being used and mobile vs desktop. We take the IP address from the request and convert that into a location. However, we do not store the IP request after it is converted so no worries there.
We simply store the data for our customers use. We do not re-sell the data. The data is stored for a period of several years and then removed unless our customers request a longer period of data retention.
The users who see the ads can not do anything with the information we collect. Since we do not identify individual users we are not able to honor things like requests for deletion and things like that.
Our customers have full access to their information collected from their icon packages. In addition to viewing the information, they can download it for use in other systems, request us to delete information or extend our retention period.
All of the data collected is stored in secured data stores. We use AWS for our cloud so these stores include a mix of S3 buckets and RDS databases. Access to this environment is restricted to only members of our company who need access in order to maintain the environments and manually access the data stored there for things like ad-hoc report requests.