Privacy Policy
Last updated: 7 September 2026
This Privacy Policy explains how LopoRail ("we", "us", "our") collects, uses, shares and protects personal information in connection with LopoRail (https://loporail.com) and the LW Rail Ads (AutoAdOS) advertising platform that operates on it. It applies to visitors to our website, advertisers and their representatives, and any other users of our services, worldwide.
1. Who we are (data controller)
- Operator: LopoRail
- Registered address:
- VAT/GST identification:
- Contact for privacy matters: [email protected]
For visitors in the UK, the applicable legislation is the UK GDPR and the Data Protection Act 2018; in the EU/EEA, the GDPR (Regulation (EU) 2016/679). Jurisdiction-specific disclosures for other regions are set out in Section 10.
2. Personal information we collect
Information you give us (advertisers)
- Contact details you supply at checkout or in your account: name, email address, company name.
- Billing details you supply or that your payment provider shares with us for invoicing: billing address, VAT number.
- Campaign materials: creative images, landing-page URLs, and campaign parameters (target countries, dates, budgets).
- Correspondence: messages you send us (e.g. about a campaign or a complaint).
Information collected automatically (ad delivery & measurement)
We serve and measure advertising using privacy-preserving techniques that avoid building individual profiles:
- Impression and viewability counts. When an ad is displayed and (for "viewable" measurement) when at least 50% of the ad remains in view for at least 1 second, we count the event in aggregate. Counts are deduplicated per browser per 30-minute window using an irreversibly salted hash of request attributes; we do not store raw IP addresses, device identifiers, cross-site identifiers, or advertising cookies for this purpose.
- Click counts. Clicks on ads pass through our measurement redirect and are counted in aggregate with the same deduplication approach.
- Approximate location (country level). To target advertising by country we derive a country from edge/CDN geo headers or your browser settings. We never store this against an individual; it is used per-request and stored only as an aggregate count dimension.
- Server logs. Our hosting provider processes standard request logs (including IP addresses) for security and abuse prevention, retained per provider policy. These logs are not used for advertising.
- Moderation and safety records. When you post community content we run automated safety screening. We keep minimised records (a category/score, detector keys and your account reference) — not the raw content and not your IP address; a short matched excerpt is kept for up to 30 days then deleted. Permanent account actions are always taken by a person, never automatically. See the Content Standards for more.
Information from payment providers
When you pay through our supported providers (card/Stripe, PayPal, WooCommerce), the payment provider processes your payment details under its own privacy policy. We receive confirmation of payment status and limited transaction references; we never see full card numbers.
3. What we use it for, and our legal bases
| Purpose | Data | Legal basis (UK/EU) |
|---|---|---|
| Ad delivery and country targeting (per-request) | Country/region signal | Legitimate interests (Art. 6(1)(f)) — delivering the service |
| Billing measurement of campaigns | Salted-hash deduped counts | Legitimate interests — contract performance and fraud prevention |
| Managing advertiser accounts and campaigns | Contact, billing, campaign data | Contract (Art. 6(1)(b)) |
| Invoicing, VAT/tax compliance | Billing data | Legal obligation (Art. 6(1)(c)) |
| Transactional service emails (order, approval, reports, renewal reminders, invoices) | Contact details | Contract; legitimate interests |
| Security, abuse and fraud prevention | Server logs, flags | Legitimate interests; legal obligation |
| Responding to enquiries and complaints | Correspondence | Legitimate interests |
We do not carry out automated decision-making with legal effect, and we do not sell or rent personal information. We do not use personal information for cross-context behavioural advertising.
4. Cookies and similar technologies
Our advertising measurement is designed to work without advertising or tracking cookies. Some strictly necessary cookies (e.g. login session, security) may be set by the platform. Details of all technologies used are in our Cookie Policy. Where third-party embedded features or future optional analytics are introduced, we will seek consent where required before use.
5. Sharing and international transfers
We share personal information only with:
- Payment processors (e.g. Stripe, PayPal) — to take payments and prevent fraud.
- Email delivery — transactional service messages are sent from our platform through our hosting provider's mail service.
- Hosting provider — this website is hosted on infrastructure that may be located outside your country; data may therefore be transferred internationally.
- Professional advisers and authorities — where required by law, or to establish/defend legal claims.
Where personal information is transferred outside the UK/EEA, we rely on adequacy regulations and/or the UK International Data Transfer Agreement / EU Standard Contractual Clauses, together with supplementary technical measures.
6. Retention
- Advertiser account and billing records: up to 7 years after the last transaction (tax and accounting requirements).
- Campaign records and aggregate delivery statistics: up to 3 years, then deleted or anonymised.
- Security logs: per hosting provider defaults (typically 30–90 days).
- Correspondence: up to 2 years after resolution.
7. Your rights
Subject to applicable law, you have the right to: access your personal information; rectify inaccuracies; erase data (where we have no overriding legal obligation to retain it); restrict or object to processing based on legitimate interests; port data you provided to us; and withdraw consent where processing is consent-based. To exercise any right, email [email protected]; we respond within one month (extendable for complex requests).
Self-service: you do not need to email us to get your data — you can download a copy of everything we hold about you at any time in your account, and you can delete your account there. Deleting your account anonymises your personal details and is not recoverable (records we must keep by law are retained in the minimum the law requires).
If you are in the UK you may complain to the Information Commissioner's Office (ico.org.uk); in the EEA, to your national supervisory authority. Please contact us first so we can try to resolve matters quickly.
8. Children
The services and the advertising platform are not directed to children under 16 (or under 13 in the US). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
9. Security
We apply technical and organisational measures appropriate to risk, including transport encryption (TLS), access controls, hashed identifiers for measurement (never raw IPs), and least-privilege administration of the platform.
10. Region-specific disclosures
United Kingdom & European Economic Area
You have the rights described in Section 7. Our lawful bases are listed in Section 3. Controllers and representatives are identified in Section 1. German-language provider identification (Impressum) is available at Legal Notice.
United States
We honour Global Privacy Control (GPC) browser signals as a valid opt-out where applicable. We do not "sell" or "share" personal information as defined by the California Consumer Privacy Act (CCPA/CPRA), the Virginia CDPA, the Colorado CPA, the Connecticut CTDPA or the Utah UCPA, because our measurement uses de-identified, aggregate counts and we disclose no personal information to third parties for cross-context behavioural advertising. California residents may request disclosure of the categories of personal information collected (Section 2) and deletion, subject to legal exemptions, via [email protected]. We do not knowingly collect data from children under 13 (COPPA). Email notices we send are transactional (CAN-SPAM compliant); you can stop non-essential emails via the links provided in each message.
Canada (PIPEDA / CASL)
We process personal information with appropriate consent or as permitted by law, and we identify ourselves and provide contact details in every message we send. Emails we send are transactional relationship messages under CASL (service and billing information). You can unsubscribe from optional summaries at any time using links in the message or by contacting [email protected].
Brazil (LGPD)
The legal bases in Section 3 correspond to the legal hypotheses of Art. 7 LGPD (including consent, contract performance, legitimate interests and compliance with legal obligation). You may request confirmation of processing, access, correction, anonymisation, portability and deletion via [email protected].
Australia (Privacy Act 1988 / APPs)
We handle personal information in accordance with the Australian Privacy Principles, including open and transparent management, access and correction rights, and restrictions on overseas disclosure consistent with Section 5.
Singapore / Malaysia (PDPA)
We obtain consent before collecting, using or disclosing personal information (or rely on statutory exceptions such as contract performance), and we implement reasonable security arrangements (Section 9).
South Africa (POPIA)
We process personal information lawfully and minimally, with the operator accountability and security safeguards described above, and you may request access to, correction of, or deletion of your personal information via [email protected].
Japan (APPI) and Switzerland (revFADP)
We process personal information within the purposes notified in this policy, keep records of cross-border transfers as required, and honour requests for disclosure, correction and cessation via [email protected]. Our Swiss–EU transfer arrangements follow the revised FADP requirements.
11. Changes to this policy
We may update this policy to reflect changes in law or our services. The "Last updated" date above shows the current version. Material changes will be highlighted on this page, and where appropriate notified to registered advertisers by email.
12. How to contact us
LopoRail — — [email protected]