Metys — CTV Advertising Measurement
Effective: April 2026 · Last updated: April 12, 2026
Metys (“we”, “us”, “our”) operates metys.co and provides CTV (Connected TV) advertising measurement solutions. Our technology helps advertisers and media agencies understand whether CTV ad campaigns drive real engagement on their websites.
This Privacy Policy describes what personal data we collect, how we use it, how long we retain it, who we share it with, and what rights you have. It applies to:
Metys participates in the IAB Europe Transparency & Consent Framework (TCF) and complies with its Specifications and Policies.
In the context of our measurement solutions, Metys acts as a data controller for the processing of hashed identifiers and measurement metadata. When processing data on behalf of an advertiser under a data processing agreement, we may also act as a data processor.
Under the California Consumer Privacy Act (CCPA/CPRA), Metys functions as a service provider processing data on behalf of our business customers.
Our measurement technology operates through two lightweight tracking pixels — an impression pixel embedded in CTV ad creatives (via VAST tags) and a site pixel deployed on advertiser websites (via tag managers).
| Data element | Description |
|---|---|
| Hashed IP address | The viewer’s IP address is received at the Cloudflare network edge and immediately hashed using SHA-256. The raw IP address is discarded at the edge and is never stored in, or transmitted to, our backend systems. |
| User agent string | Used to classify device types (CTV, mobile, desktop) and filter invalid traffic. |
| Timestamp | Date and time of the impression event (UTC). |
| Campaign identifiers | Campaign ID, publisher ID, creative ID. |
| Context label | Content genre (e.g. Drama, Sports, News), based on IAB Content Taxonomy 3.1. |
| Data element | Description |
|---|---|
| Hashed IP address | Identical hashing process — raw IP never leaves the network edge. |
| User agent string | Device classification and invalid traffic filtering. |
| Timestamp | Date and time of the page visit (UTC). |
| Page URL and domain | The specific page visited on the advertiser’s website. |
| Session ID | Randomly generated, non-persistent. Not linked to any user account or device. |
Metys does not collect, store, or process any of the following: raw (unhashed) IP addresses beyond the network edge · cookies or device-stored identifiers · device fingerprints · advertising IDs (IDFA, GAID) · names, email addresses, or user-provided information · login credentials · browsing history beyond the advertiser’s own website · purchase, financial, or payment data · precise geolocation coordinates · special categories of personal data.
We never combine, enrich, or cross-reference the personal data we process with additional data sources with the goal of identifying individual end users. All outputs are aggregated, campaign-level statistics.
We do not use this data to serve, select, or personalise advertisements. We do not build individual user profiles.
| Legal basis | Applies to |
|---|---|
| Consent (Art. 6(1)(a)) | Where a CMP operating under the IAB TCF transmits a valid consent signal. |
| Legitimate interest (Art. 6(1)(f)) | Where consent is unavailable (e.g. CTV environments without a CMP). See our Legitimate Interest Claim. |
| Contract performance (Art. 6(1)(b)) | Customer account data necessary to deliver contracted services. |
| Data category | Maximum retention |
|---|---|
| Hashed IPs, impression/visit records, user agents | 365 days |
| Aggregated campaign reports (no personal data) | Duration of customer relationship |
| Customer account information | Duration of contract + legal requirements |
| Invalid traffic patterns | Indefinitely (aggregated, non-personal) |
We do not sell, rent, or trade personal data.
| Recipient | Purpose |
|---|---|
| Customers | Aggregated campaign reports only. Never personal data or hashed identifiers. |
| Cloudflare, Inc. | Infrastructure. IP hashing at the edge. DPA with EU Standard Contractual Clauses. |
| Law enforcement | Only where legally compelled. |
| Corporate transactions | In event of merger/acquisition, subject to same privacy commitments. |
IP hashing completes at the Cloudflare edge before data is transmitted. For transfers outside the EEA/UK, we rely on Cloudflare’s DPA and EU Standard Contractual Clauses, plus supplementary technical measures (TLS 1.3, pseudonymisation, access controls).
Metys does not use cookies, localStorage, IndexedDB, advertising IDs, or any device storage. Our disclosure: metys.co/.well-known/deviceStorage.json.
Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), complaint to supervisory authority.
Note: Because we only process hashed IPs, we may need additional information to locate your records.
Know/access, delete, correct, opt out of sale/sharing. Metys does not sell or share personal information. We do not engage in cross-context behavioural advertising.
Contact: privacy@metys.co. Response within 30 days.
Edge-level IP hashing, TLS 1.3, encryption at rest, access controls. No method is 100% secure.
Not directed at children under 16. We do not knowingly collect data from children.
Material changes will update the date at the top of this page.