This policy explains what 1LX Online processes when people use the advertising marketplace, add publisher sites, connect optional analytics or manage a USDT account.
Account contact details, publisher site information, advertising materials, campaign settings, support messages and wallet addresses or transaction references that you choose to use. Seed phrases and private keys must never be provided to 1LX.
A verified site owner may grant only the Google Analytics read-only scope. 1LX accesses the selected property name and web stream URL to confirm that it belongs to the verified site, then reads aggregate active-user, session, page-view, country and page-title metrics. We do not request edit access, advertising audiences, demographic data or visitor-level identifiers. We do not publish the Google property identifier, OAuth token or visitor-level data.
A verified site owner may separately grant only the Search Console read-only scope. 1LX validates the selected property against the verified site and reads aggregate clicks, impressions, click-through rate, average position, pages and search queries. We do not request Search Console edit access or visitor-level identifiers, and connected data is never presented as a guarantee of search ranking.
1LX sends OAuth and Google API requests only over HTTPS with certificate validation. OAuth authorization uses a short-lived, single-use state value and PKCE to protect the authorization flow. The Google refresh token is encrypted at rest with authenticated encryption and a unique random nonce; its encryption key is stored separately from the database in protected server configuration. Access is restricted to the authenticated publisher who owns the verified site and authorized administrators. Tokens are not exposed in public marketplace pages, analytics snapshots or application logs.
Google user data is used only to provide the publisher-requested site verification, aggregate reporting and content recommendations inside 1LX. It is not sold, used for targeted or personalized advertising, used to determine creditworthiness, or used to train generalized artificial-intelligence or machine-learning models. We do not transfer Google user data to third parties except infrastructure processors needed to operate the requested feature or when required by law. 1LX use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Placement reporting uses privacy-minimized impression and click events. Anonymous daily browser and unique-click identifiers rotate and are stored only as placement-scoped hashes. Raw IP addresses are not stored in placement analytics. Limited network and security logs may be processed to prevent abuse, diagnose errors and protect accounts.
Essential session and security cookies keep users signed in, protect forms and remember necessary interface state. 1LX does not require third-party advertising cookies for placement measurement.
USDT deposits and withdrawals may require wallet addresses, amounts, transaction identifiers, approval evidence and finality status. Blockchain transactions are public by design. Payment actions remain subject to the active platform gates and user-controlled wallet approval.
We use information to provide accounts, verify site ownership, classify eligible inventory, measure delivery, prevent fraud, support users, meet legal obligations and improve reliability. We do not sell personal information or use connected analytics to build individual advertising profiles.
Information is shared only with infrastructure, security, email, analytics or payment providers needed for the requested feature, or when legally required. Optional Google Analytics and Search Console access is governed by the separate consent shown during each Google OAuth flow.
Google OAuth tokens are kept only while the publisher keeps the relevant connection active. Disconnecting Google Analytics or Search Console from the publisher workspace revokes that Google credential and deletes its stored connection token and associated optional analytics snapshots. Other records are retained only as long as needed for site verification, reporting, account security, accounting, moderation and dispute purposes. You may update account information and request access, correction or deletion through the contact page, subject to legal and ledger-retention duties.
Questions about privacy or consent can be sent through the public contact page. Include the account email and the site domain concerned; never send passwords, seed phrases or private keys.
