Privacy policy

Who is responsible for your data

AdXenx is an advertising platform run by UpgradeX, a sole proprietorship registered with the RCCM in Cotonou, Benin, under number RB/ABC/24 A 117739 since 31 December 2024. It is not a company: behind the business name there is one person, SOVIMI Aziz Vorrez, a Beninese national, the operator and the publication director.

He is the data controller. He decides what is collected and why, and he is the person you deal with. There is no data protection officer: your requests reach him directly.

Registered address: Îlot 4600, Parcelle N, Zogbadjè, Abomey-Calavi, Atlantique, Benin.

Contact: [email protected] - +229 0198981541.

This policy covers both applications, adxenx.com for advertisers and publisher.adxenx.com for publishers and creators, as well as the banners served on publisher websites and apps. It applies whether you are an advertiser, a publisher, a creator, or simply someone visiting a page where one of our banners appears.

The platform does two things. It serves banner ads: the advertiser funds a budget, the banners run on publisher inventory, and the publisher earns a share of the spend their placements generate. And it hosts a creator marketplace: the advertiser books a creator for paid content, and the money is held in escrow by the platform until the work is approved.

Your account data

To open and run an account, we record your name, email address, phone number, country, language, the currency you want amounts shown in, your password and your role on the platform. The password is never kept in clear text: we keep only a hashed version, which nobody can read back.

If you are a publisher, we also record your company name, a contact email, your website address, and the payout details you give us so we can pay you.

If you are a creator, your profile holds your display name, bio, avatar, niches, languages, rate card, and the social accounts you declare: handle, follower count, engagement rate.

Those figures are declared by you. We do not connect to the social platforms to check them, and we do not present them as verified. An advertiser booking a creator is relying on a statement, not on a measurement.

What this data is for: signing you in, protecting your account, writing to you about your activity, showing amounts in your currency, and paying you.

Ad-serving data

Every time a banner is shown or clicked, the ad server writes an event. That event holds the campaign id, the creative id, the publisher placement id, the country, the city, the device type, the page the call came from (the referrer), the IP address, a flag saying whether the event was judged automated or fraudulent, and a timestamp.

Let us be plain about the IP address: it is stored in two forms, raw and hashed. The hashed form lets us compare events with each other - spotting one source producing thousands of clicks, for instance - without handling the address itself. The raw form stays available for invalid-traffic investigations and for billing disputes.

These events are used to count what the advertiser is billed for, to work out what the publisher has earned, to build the reports you see in your dashboard, and to detect invalid traffic. Anything flagged as invalid is removed from both sides: the advertiser does not pay for it, and the publisher does not earn from it.

Someone visiting a publisher's website has no account with us, and we do not try to work out who they are. We do not connect these events to a name or an email address.

Money data

We record your invoices, your payments, the movements in your wallet, your payout requests and the state of anything held in escrow. All amounts are in CFA francs (XOF).

On the ad network side: the advertiser funds a budget, serving spends it per impression (CPM) or per click (CPC) depending on the campaign goal, and the publisher receives a share of the spend their placements generate - 60% by default.

On the marketplace side: the money for a deal is held in escrow with us. It goes to the creator when the work is approved, or automatically if the advertiser does not respond in time, and it goes back to the advertiser if a dispute is resolved that way. The platform charges the advertiser 10% on top of the agreed amount, and withholds 10% from the creator at release.

Payments run through Moneroo, which handles cards and West African mobile money. We do not keep card numbers: what stays on our side is the record of the transaction - amount, status, date, reference.

The payout details that publishers and creators give us are stored with us, because we have to read them again on every payment.

These records are used to bill, to pay, to keep the books, and to answer an audit.

Deal conversations and files

On the marketplace, the advertiser and the creator talk inside the platform. We keep those messages, the attachments and the delivery links attached to the deal.

That is what keeps the deal moving, records what was promised, and settles things when they go wrong. Be aware of what that means: this is not private, end-to-end encrypted messaging. If there is a dispute over escrow, the operator can read the conversation, because that is the only way to decide who is right before releasing or refunding the money.

Deal attachments and the ad creatives uploaded by advertisers are stored with Cloudflare R2.

Cookies, local storage and usage analytics

Signing in. Your authentication tokens sit in httpOnly cookies, which page scripts cannot read. These cookies are essential: without them you cannot stay signed in. They are not used for ad targeting.

Browser local storage. We keep the "you are signed in" state there and, on the publisher side, the draft of an ad space you are part-way through adding, so you do not have to type it again. It stays in your browser; clearing the site's data removes it.

Microsoft Clarity. We measure how people actually use the web apps: clicks, scrolling, movement from page to page, the places where people get stuck. In practice, your session in the app can be replayed by the operator to understand an interface problem. This is not needed to run the service: it is usage analytics, it rests on your consent, and you can withdraw that consent at any time.

Cal.com. Booking a demo call uses an embedded widget provided by Cal.com. It loads only if you open that page, and it receives what you type to book: name, email, chosen slot.

The legal basis for each use

Performing the contract. Running your account, serving your campaigns, counting impressions and clicks, working out earnings, holding money in escrow, paying you, sending you service emails. Without this processing there is no service.

Legitimate interest. Detecting invalid traffic and fraud, protecting the platform and accounts against abuse, and watching that everything works technically. It is also the interest of advertisers, who should not pay for bots, and of honest publishers, who should not be drowned out by those who cheat. This is what justifies keeping the IP address.

Consent. Non-essential usage analytics, meaning Microsoft Clarity. You can say no and the service works exactly the same. And you can change your mind, either way.

A legal obligation. Invoices, payments and accounting records are kept because Beninese law requires us to keep them.

Who your data is shared with

We do not sell your data and we do not hand it to data brokers. The list below is the whole list.

Moneroo - payment processing for cards and mobile money. Receives what it needs to take the payment: amount, currency, transaction reference, and the payment details you enter.

Cloudflare R2 - file storage. Receives ad creatives and deal attachments.

Microsoft Clarity - usage analytics on the web apps. Receives how you move through our pages, along with the technical information your browser sends.

Cal.com - the demo booking widget. Receives the name, email and time slot you give when booking.

Our transactional email provider - sends verification and password-reset messages, and deal and payout notifications. Receives your email address and the content of the message.

Telegram - internal operational alerts. The operator receives technical notifications there about how the platform is running. It is not a product channel: the content of your account and your conversations is not sent there as a feature.

Between users, too. An advertiser sees which placements their banners ran on and how they performed. A publisher sees what their placements generated. In a deal, the advertiser and the creator see each other's profile and their whole conversation.

Finally, we hand over data if a competent authority orders it in the form the law requires, or where it is needed to establish or defend a legal claim.

Several of these providers are based outside Benin. Part of your data is therefore stored and processed outside West Africa.

How long we keep things

Account data stays as long as the account exists. If you close your account, we delete or anonymise whatever we are not required to keep.

Invoices, payments and wallet entries are kept for the period required by Beninese accounting and tax law. We cannot erase them before then, not on request, and not because the account is closed.

Ad-serving events - impressions and clicks, with the IP address - are kept as long as they are needed for reporting, for billing, and for billing disputes, and then deleted. Aggregated statistics, which no longer point to anyone, may be kept longer.

Deal conversations and files are kept as long as they can serve to prove what was agreed and to settle a dispute over escrow.

Usage analytics data is kept by Microsoft Clarity for that service's own periods. We do not keep a copy on our side.

We are not printing an exact number of days for every category here, because we would rather state nothing than state a period we would not hold to. If you want to know what is still stored about you, write to us and we will tell you.

How it is protected

Passwords are hashed, never stored in clear text. Session tokens sit in httpOnly cookies, out of reach of page scripts. Access to production data is limited to the operator and to the providers listed above.

No system is completely safe, and we will not pretend otherwise. If you think your account has been used without your permission, write to [email protected] and we will cut off access while we look into it.

Your rights, and how to use them

You can ask for a copy of the data we hold about you, have anything wrong corrected, ask us to delete what we are not required to keep, object to processing based on legitimate interest, ask us to pause a use of your data while a disagreement is sorted out, withdraw your consent for usage analytics, and get your data back in a reusable format.

A lot of this you can do without writing to us: your profile, your contact details, your preferences and your payout details are all editable directly in the app.

For the rest, write to [email protected] from the email address on your account. If the request comes from somewhere else, we will ask you to confirm that you are the account holder, so we do not hand your data to someone else. We reply as quickly as we can, and within one month at the latest. If we cannot do what you ask, we tell you why.

If our answer does not satisfy you, you can take it to the personal data protection authority in your country. In Benin that is the Autorité de protection des données à caractère personnel (APDP).

If this policy changes

We will update this page when the platform changes: a new provider, a new piece of data collected, a new use. The date it was last updated is shown at the top of the page.

If a change really alters what we do with your data, we will tell you by email or in the app before it takes effect, not after.

Questions about this document: [email protected], or UpgradeX (AdXenx), Îlot 4600, Parcelle N, Zogbadjè, Abomey-Calavi, Atlantique, Benin.