Last updated: October 19, 2026
Exiber (“Exiber”, “we”, “us”) is part of the UNIK group. This policy explains how we process personal data:
- on our website, exiber.com; and
- through Streaming Ads, our technology for serving and measuring digital advertising, which operates on the domains streamads.exiber.com and adx.exiber.com.
1. Who is responsible for your data
The controller of the personal data described in this policy is Exiber Servicos Eletronicos LTDA, CNPJ 24.377.646/0001-50, Rua Flórida, 256, Cidade Monções, São Paulo – SP, 04565-000, Brazil.
Data Protection Officer (Encarregado, under Brazil’s LGPD): Eduberto Kakimoto Neto – privacidade@exiber.com.
For any question or request about privacy, write to privacidade@exiber.com.
2. Streaming Ads (our advertising technology)
2.1 How it works
Agencies and advertisers use Streaming Ads to show interactive and video ads on websites and apps, bought through advertising platforms such as Google Display & Video 360. When one of these ads is shown to you, your browser loads the ad (code, images and video) from streamads.exiber.com and sends measurement events about that ad to adx.exiber.com.
Exiber does not decide who sees an ad. The advertiser and the advertising platform choose the audience, under their own policies.
2.2 What data we process
- Measurement events. When an ad is shown or used, it sends a request to adx.exiber.com with the type of event, the identifier of the ad (campaign and creative) and a random number that prevents caching. Examples of events: ad loaded, ad viewable, video started or reached 25%, 50%, 75% or 95% of its length, sound turned on or off, mouse over the ad, interaction with the ad, and click. We store only the event type, the ad identifier and the time of the event. We do not store your IP address, your browser information or any identifier of you or your device with these events. Each event is stored individually; our clients receive only aggregated reports.
- Video player settings. Video ads use an open-source player (dash.js) that may save in your browser’s local storage the video and audio quality and the audio track settings used last, so that the next video starts at a suitable quality. This information contains no identifier, is not sent to Exiber and is only reused for 6 minutes.
- Technical request data. Like any website, our servers receive the information your browser sends with every request: IP address, browser and operating system (user agent), the address of the page where the ad appears (referrer), the address requested and the date and time. Our cloud provider records this data in access logs that we use only for security, abuse prevention and troubleshooting. These logs are deleted automatically after 30 days.
- Clicks. When you click an ad, you are taken to the advertiser’s website, usually through a click-tracking link of the advertising platform or of the advertiser’s own ad server. We record only that a click happened on that ad.
- Contextual content. Some ads show contextual information, such as the weather in a city chosen by the advertiser. Our servers fetch this information per city; it does not use your location.
2.3 What we do not do
Streaming Ads does not:
- set or read cookies, or store any identifier on your device (the only information an ad may keep in your browser is the video player setting described in 2.2);
- use advertising IDs or other device identifiers;
- use fingerprinting or any other technique to recognize your browser or device across websites, apps or visits;
- take part in cookie matching or ID syncing;
- build profiles, target ads based on your interests or make automated decisions about you;
- access your precise location, camera or microphone;sell personal data.
How to opt out. If your browser sends the Global Privacy Control (GPC) signal, our measurement pixel does not record any event from the ads shown to you. GPC is a browser setting that stays on until you turn it off: it is on by default in some browsers, such as Brave and DuckDuckGo, and can be turned on in others, such as Firefox, or with an extension (see globalprivacycontrol.org). Ads are still shown, but nothing is recorded.
2.4 Third-party content in ads
Depending on the campaign, an ad served by Streaming Ads may also load content from third parties chosen by the advertiser or the agency, such as font services (Google Fonts, Adobe Fonts), the advertiser’s ad server (for example, Google Campaign Manager 360) or other measurement and verification providers. These third parties receive the technical data that your browser sends to them (such as IP address and user agent) and process it under their own privacy policies. The advertiser’s website that you reach after clicking an ad is governed by the advertiser’s privacy policy.
2.5 Purposes and legal bases
- Showing ads and measuring campaigns (counting impressions, viewability, video completion, interactions and clicks), and providing reports and billing to our clients. Data: measurement events and the technical request data needed to deliver the ad. Legal basis: our legitimate interest in providing ad delivery and measurement services to our clients (GDPR art. 6(1)(f); LGPD art. 7, IX).
- Security, fraud and abuse prevention, and troubleshooting. Data: technical access logs. Legal basis: legitimate interest (GDPR art. 6(1)(f); LGPD art. 7, IX) and compliance with legal obligations (LGPD art. 7, II).
2.6 How long we keep the data
- Measurement events, which do not identify you: for as long as needed for campaign reports, billing and audits with our clients.
- Technical access logs: 30 days, then deleted automatically.
2.7 Where the data comes from
All data described in this section is collected automatically from your browser when an ad served by our technology is shown on a website or app you visit. We do not obtain data about you from other sources.
3. Our website (exiber.com)
- Contact forms. When you fill in a form, we receive the information you enter (such as name, e-mail, company and message). We use it to answer you and to manage our business relationship. Legal basis: steps taken at your request before entering into a contract, and our legitimate interest (GDPR art. 6(1)(b) and (f); LGPD art. 7, V and IX). Fields marked as required are needed to answer you; if they are not filled in, we cannot reply. The other fields are optional. We send marketing e-mails only with your consent, which is optional and does not affect our answer, and you can unsubscribe at any time.
- Cookies. The website uses cookies that are necessary for it to work and for security, and, if you allow them in the cookie banner, cookies for analytics (Google Analytics, through Google Tag Manager), advertising (Meta Pixel) and marketing automation (RD Station). You can change your choice at any time and you can also block or delete cookies in your browser settings.
- Hosting and security. Our website providers process your IP address to deliver the website and protect it against attacks.
- How long we keep website data. Contact and business relationship data: while we are in contact or have a business relationship with you, and afterwards only for as long as required by law (for example, tax and accounting rules) or needed to defend our rights. Marketing data: until you unsubscribe or withdraw your consent. Cookies: for the period set for each cookie, or until you delete them in your browser.
4. Who we share data with
- Service providers acting on our behalf: Google Cloud and Firebase (hosting, processing and storage for Streaming Ads); Webflow and Cloudflare (website hosting and security); RD Station (website forms and marketing e-mails).
- Advertisers and agencies: only aggregated campaign reports, which do not identify individuals.
- Public authorities: when required by law or by a court order.
We do not sell personal data.
5. International transfers
Streaming Ads data is processed and stored on Google Cloud in the United States. Our website providers may also process data outside Brazil and the European Economic Area. These transfers rely on the safeguards in our providers’ data processing terms, such as standard contractual clauses (GDPR art. 46; LGPD art. 33, II) and, where applicable, the EU-U.S. Data Privacy Framework. You can ask for more information or a copy of these safeguards at privacidade@exiber.com.
6. Security
All our domains use encrypted connections (HTTPS). Access to data is restricted to authorized personnel, and we rely on the security controls of our infrastructure providers.
7. Your rights
Under the LGPD (art. 18) and, where applicable, the GDPR (arts. 15 to 22), you can ask us to confirm whether we process your data, and to access, correct, anonymize, block, delete or port it. You can also ask which parties we share it with, object to processing based on legitimate interest, restrict processing and withdraw consent at any time. Withdrawing consent does not affect processing carried out before the withdrawal. Where we ask for your consent (marketing e-mails and non-essential cookies on our website), you may refuse it: the only consequence is that you will not receive those e-mails, or that those cookies will not be used.
To exercise these rights, write to privacidade@exiber.com. We will reply within the deadlines set by law.
The measurement events we store do not identify you. In most cases we will therefore not be able to link them to you (GDPR art. 11).
You can also file a complaint with a data protection authority: in Brazil, the ANPD (gov.br/anpd); in the European Economic Area, the authority of your country (list of authorities); in the United Kingdom, the ICO (ico.org.uk).
8. Children
Our technology is not directed at children and we do not knowingly collect data from children. Advertisers are responsible for making sure their campaigns follow the rules on advertising to children.
9. Changes to this policy
We may update this policy. The date at the top shows when it was last changed. Material changes will be highlighted on this page.
10. Contact
Exiber Servicos Eletronicos LTDA – Rua Flórida, 256, Cidade Monções, São Paulo – SP, 04565-000, Brazil – privacidade@exiber.com