WurflRTD Privacy Policy

ScientiaMobile Inc. · 4/20/2026

ABOUT THIS NOTICE

This Privacy Notice explains how ScientiaMobile Inc. (“ScientiaMobile,” “we,” “us,” or “our”) processes personal data in connection with the WurflRTD service — a Real-Time Data module for Prebid.js that enriches programmatic advertising bid requests with device intelligence.

This Notice is addressed to two distinct audiences:

Publishers — companies and individuals who deploy WurflRTD on their websites as part of a Prebid.js header bidding configuration. If you are a publisher, Part A applies to you.

End users — people who visit websites where WurflRTD is deployed. If you are an end user, Part B applies to you.

Both parts share common sections on our identity, security practices, and how to contact us, which appear in Part C at the end of this Notice.

ScientiaMobile Inc. is a corporation incorporated in the State of Delaware, USA, with principal offices at 12110 Sunset Hills Road, Suite 600, Reston, VA 20190, USA.

Use of the WurflRTD service is subject to our Terms of Service, available at https://www.scientiamobile.com/wurflrtd-terms-of-service/.

PART A — INFORMATION FOR PUBLISHERS

A1. What Is WurflRTD and What Data Does It Process?

WurflRTD is a JavaScript module that publishers embed in their Prebid.js configuration. When an end user visits a publisher’s website, WurflRTD identifies the device being used and enriches programmatic advertising bid requests with device intelligence — including device type, make, model, operating system, and screen properties. This enrichment is passed to supply-side platforms (SSPs), demand-side platforms (DSPs), and other bidders participating in header bidding auctions on the publisher’s website.

As a publisher, you are the Data Controller for the processing that occurs on your website. ScientiaMobile acts as a Data Processor on your behalf for the device detection and beacon analytics functions described in this Notice. Where required by applicable law, publishers may request a Data Processing Agreement (DPA) from ScientiaMobile at privacy at scientiamobile dot com.

A2. What Data Does ScientiaMobile Collect From Publishers?

Account and contact data. If you register a commercial account with ScientiaMobile, we collect your name, company name, email address, billing address, and payment information. This data is used to manage your account, process payments, provide support, and communicate with you about the Service.

Domain and usage data. Regardless of whether you have a registered account, ScientiaMobile tracks usage associated with your domain via beacon signals fired by the WurflRTD module. This includes your domain name, usage volume, enrichment levels, and aggregated auction performance metrics. This data is used for usage management and service analytics. It does not include personally identifying information about your end users.

A3. Legal Basis for Processing Publisher Data

For registered account data, processing is necessary for the performance of the contract between you and ScientiaMobile (Article 6(1)(b) GDPR).

For domain and usage data collected via beacons, processing is carried out on the basis of ScientiaMobile’s legitimate interest in operating, maintaining, and improving the Service, and in measuring its performance (Article 6(1)(f) GDPR). ScientiaMobile has conducted a Legitimate Interests Assessment (LIA) in respect of this processing, available on request.

A4. How Long Do We Retain Publisher Data?

Account data is retained for the duration of your account relationship with ScientiaMobile and for up to five years following termination, as required for legal and financial record-keeping purposes.

Raw beacon data associated with your domain is aggregated and anonymized, after which it is retained for a maximum of 8 weeks for security and audit purposes. Aggregated data may be retained indefinitely for service analytics.

A5. Publisher Rights

As a Data Controller in your own right, you have rights under applicable data protection law with respect to personal data ScientiaMobile holds about you as a registered account holder. These include the right to access, correct, or delete your personal data, and the right to object to or restrict certain processing. To exercise these rights, contact us at privacy at scientiamobile dot com.

PART B — INFORMATION FOR END USERS

B1. Who Is This Section For?

This section is for people who visit websites where WurflRTD has been deployed by a publisher. You may not be aware that the website you are visiting uses WurflRTD. This Notice is intended to give you clear information about what data ScientiaMobile processes in this context and why.

B2. What Data Does WurflRTD Process About End Users?

WurflRTD is designed to process the minimum data necessary to perform device detection. Specifically:

HTTP request headers. When your browser makes a request to load the WurflRTD script, it sends standard HTTP headers including your User-Agent string and, on supported browsers, UA Client Hints. These headers describe your browser and device in general terms. ScientiaMobile uses this information solely to identify device characteristics such as device type, manufacturer, model, operating system, and screen properties.

IP address. IP addresses are, where required by applicable law to be treated as personal data, retained for up to 36 months for fraud detection, invalid traffic prevention, and security purposes, then permanently redacted. ScientiaMobile operates an IP Intelligence system that analyses patterns of device variability across IP addresses over time in order to detect bots, proxy networks, and other sources of invalid traffic. This analysis is carried out at the IP address level and is not used to identify individual users. Access to IP address data is restricted to authorized security personnel.

LocalStorage. LocalStorage and terminal equipment access. The storage of device capability data in your browser’s localStorage constitutes access to terminal equipment within the meaning of Article 5(3) of the ePrivacy Directive (and equivalent UK PECR rules). ScientiaMobile relies on the strictly necessary exemption for this storage, on the basis that caching device capability data in localStorage is technically necessary to deliver the zero-latency device detection function that is the core purpose of the Service — without this cache, a network request would be required on every page visit, introducing latency that would materially impair the Service. No data stored in localStorage is used for tracking, profiling, or any purpose beyond enabling device detection on return visits. Publishers deploying WurflRTD in jurisdictions where the strictly necessary exemption may not apply, or where national implementation of the ePrivacy Directive imposes additional requirements, are responsible for ensuring their own consent frameworks are configured appropriately.

Beacon data. After a page auction completes, WurflRTD fires an HTTP beacon to ScientiaMobile’s infrastructure. This beacon contains aggregated auction performance data — including CPM values, bidder identifiers, and ad unit information — along with a device identifier and a consent class value derived from the publisher’s Consent Management Platform (CMP). Beacons do not contain your name, email address, cookie identifiers, or any other directly identifying personal data.

B3. What ScientiaMobile Does Not Do

ScientiaMobile does not build profiles of individual users. ScientiaMobile does not track you across websites. ScientiaMobile does not combine device detection data with other data sources to identify you as an individual. ScientiaMobile does not sell data about end users to third parties. ScientiaMobile does not use device detection data for any purpose other than providing the Service to publishers. ScientiaMobile analyses patterns of device behaviour at the IP address level for fraud detection purposes. This analysis does not identify or profile individual users.

B4. Legal Basis for Processing End User Data

ScientiaMobile processes end user data on the basis of legitimate interest (Article 6(1)(f) GDPR). The legitimate interest pursued is the provision of device intelligence to publishers and their advertising partners for the purpose of improving the relevance and commercial performance of programmatic advertising. ScientiaMobile has conducted a Legitimate Interests Assessment (LIA) in respect of this processing. A summary is available on request at privacy at scientiamobile dot com.

Device detection using HTTP headers is an inherently low-privacy-risk activity. It relies on information that browsers transmit automatically with every HTTP request, does not identify individuals, and does not involve tracking behavior over time. ScientiaMobile is satisfied that this processing does not override the fundamental rights and freedoms of data subjects.

B5. Consent Class

WurflRTD reads a simplified consent classification value from Prebid.js’s normalized consent signals. This value — represented as an integer (0, 1, or 2) — summarizes the overall consent state of the advertising auction and is used solely for aggregated analytics. Raw consent strings, vendor consent records, and CMP data are not accessed, stored, or transmitted by ScientiaMobile.

B6. Who Controls the Processing on Publisher Websites?

The publisher whose website you are visiting is the primary Data Controller for personal data processing on that website, including data processed in connection with programmatic advertising. ScientiaMobile acts as a Data Processor on that publisher’s behalf for the device detection and beacon functions described in this Notice.

If you have questions or concerns about how your personal data is handled in connection with advertising on a specific website, you should contact that website’s publisher directly and refer to their privacy policy.

B7. How Long Is End User Data Retained?

Device capability data stored in your browser’s localStorage expires automatically after a period set by ScientiaMobile and is refreshed on the next page visit. No device data is retained on ScientiaMobile’s servers beyond the immediate request lifecycle.

IP addresses are, where required by applicable law to be treated as personal data, retained for up to 36 months for fraud detection, invalid traffic prevention, and security purposes, then permanently redacted.

Raw beacon data transmitted to ScientiaMobile’s servers is aggregated and anonymized, after which it is retained for a maximum of 8 weeks. Aggregated data does not identify individual devices or users and may be retained indefinitely for service analytics.

B8. End User Rights

You have rights under applicable data protection law, including the right to access personal data held about you, the right to request deletion, and the right to object to processing based on legitimate interest.

Because WurflRTD does not store data linked to individual user identities, ScientiaMobile’s ability to fulfill access or deletion requests at the individual level is inherently limited. We do not have a means of associating a beacon record or a device detection event with a specific named individual.

To exercise your rights or raise a concern, contact us at privacy at scientiamobile dot com. If you are located in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. In the EU, a list of supervisory authorities is available at https://edpb.europa.eu. In the UK, the relevant authority is the Information Commissioner’s Office at https://ico.org.uk.

B9. Automated Decision-Making and Profiling

WurflRTD does not engage in automated individual decision-making or profiling within the meaning of Article 22 GDPR. Device capability data derived from HTTP headers is used solely to enrich programmatic advertising bid requests with technical device characteristics. No decisions producing legal or similarly significant effects are made about individual users on the basis of this data. No behavioral profiles, interest profiles, or inferences about individuals are created or maintained by ScientiaMobile in connection with the Service.

PART C — INFORMATION FOR BOTH AUDIENCES

C1. International Data Transfers

ScientiaMobile is based in the United States. If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, your personal data may be transferred to and processed in the United States, which does not have the same data protection laws as your jurisdiction.

Where transfers from the EEA, UK, or Switzerland to the United States are required, ScientiaMobile will ensure they are carried out in accordance with applicable data protection law, including by implementing EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or such other lawful transfer mechanisms as may be required. Publishers who require a formal transfer mechanism in place may request a Data Processing Agreement incorporating the applicable clauses from privacy at scientiamobile dot com.

C2. Sub-processors

ScientiaMobile uses a limited number of sub-processors to operate the Service infrastructure. These currently include Amazon Web Services for cloud hosting and log storage (data protection terms available at https://aws.amazon.com/compliance/gdpr-center/), and NTT Data for network infrastructure and traffic delivery (data protection terms available at https://services.global.ntt/en-us/legal/data-privacy-and-protection). All sub-processors are bound by data protection obligations equivalent to those in ScientiaMobile’s DPA. An up-to-date list of sub-processors is available on request.

ScientiaMobile’s own website (scientiamobile.com) uses standard third-party analytics and marketing tools. These are governed by the separate ScientiaMobile website privacy policy at https://www.scientiamobile.com/privacy-policy/ and are not covered by this Notice.

C3. Security

ScientiaMobile implements appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit using TLS 1.2 or higher, access controls limiting data access to authorized personnel, IP address retention limited to 36 months followed by permanent redaction, with access to IP-bearing log data restricted to authorized security personnel, and regular internal security reviews.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, ScientiaMobile will notify affected parties as required by applicable law.

C4. Changes to This Notice

ScientiaMobile may update this Notice from time to time to reflect changes to the Service, changes in applicable law, or other operational reasons. The date at the top of this Notice indicates when it was last updated. Material changes will be communicated to registered publishers by email. The current version of this Notice is always available at https://www.scientiamobile.com/wurflrtd-privacy-policy/ .

C5. Contact

For any questions, concerns, or requests relating to this Privacy Notice or ScientiaMobile’s data protection practices, please contact:

ScientiaMobile Inc. Privacy Department 12110 Sunset Hills Road, Suite 600 Reston, VA 20190 USA. Email: privacy at scientiamobile dot com