Mediaura, Inc., an Indiana corporation (“Mediaura,” “we,” “us,” or “our”), operates Mediaura Signal, a marketing measurement platform, and the website located at mediaura.io. Aura is the Analyst Assistant within Mediaura Signal. This Privacy Policy explains how we collect, use, store, share, and protect information when you use our platform, website, and related services (collectively, the “Services”). Mediaura Signal is used by organizations in several industries, including restaurant and hospitality, healthcare and behavioral health, and B2B.

Where your organization has a signed agreement with Mediaura, that agreement, and any Business Associate Agreement (“BAA”) between us, governs how we process your organization’s data. This Policy describes our practices generally and does not modify those agreements.

1. Information We Collect

1.1 Information You Provide

Account & Contact Information: Name, email address, company name, phone number, job title, and industry when you request a demo, create an account, or contact us.
Platform Credentials: Authentication tokens, OAuth credentials, and API keys for third-party platforms your organization authorizes us to connect to (for example, Google Analytics, Google Ads, Meta Ads, CRM systems, point-of-sale systems, loyalty platforms, foot traffic providers, and weather data services).
Billing Information: Payment details processed by our third-party payment processor. We do not store full credit card numbers or bank account numbers on our servers.

1.2 Information Collected Through the Platform

When a client organization authorizes Mediaura Signal to connect to its systems, we may access and process the following categories of data, depending on the services engaged and the platforms connected:

Marketing & Advertising Data: Campaign performance metrics, ad spend, conversion signals, impression and click data, and tracking configurations from advertising platforms such as Google Ads and Meta Ads.
Point-of-Sale (POS) & Transaction Data: Transaction-level records including timestamps, ticket totals, item-level detail, order type (dine-in, takeout, delivery), and location identifiers from POS systems such as Toast, Square, or similar platforms.
Loyalty & Customer Engagement Data: Loyalty program enrollment data, reward redemption records, visit frequency, and customer engagement metrics from platforms such as Thanx, Punchh, or similar systems. This data may include hashed or pseudonymized customer identifiers.
Foot Traffic & Visitation Data: Aggregated visitation patterns, trade area demographics, competitive visitation benchmarks, and location analytics from providers such as Placer.ai or similar platforms.
Contextual & Environmental Data: Weather data, local event calendars, and other contextual signals used as control variables in measurement models.
Demographic & Market Data: Publicly available or commercially licensed demographic, psychographic, and market data used for site selection analysis, trade area evaluation, and competitive benchmarking. This data is obtained from third-party licensed data providers and public sources such as U.S. Census Bureau data.
First-Party Customer Data: For features such as customer matching and transaction attribution, we may process customer records that the client provides or that originate from its authorized platforms.
Website Event Data: Page, click, campaign, and conversion events captured by the Mediaura Signal tag on a client’s website, as described in Section 6.4.
Healthcare Marketing Data: For healthcare and behavioral health clients, website interaction data, conversion events, and inquiry, intake, and admission records. In healthcare deployments, this data is handled as Protected Health Information (“PHI”) under the client’s BAA, as described in Section 6.

1.3 Information Collected Automatically on mediaura.io

Website Usage: IP address, browser type and version, device information, operating system, pages visited, referring URLs, and session duration when you visit mediaura.io.
Cookies & Similar Technologies: We use essential cookies for site functionality and analytics cookies to improve our website. See Section 12 for more detail.

2. How We Use Information

We use the information we collect to:

Provide, operate, maintain, secure, and improve Mediaura Signal and the Services.
Connect to, ingest data from, and analyze data across the platforms a client has authorized.
Build and refine measurement models, including causal inference models, media mix models, and attribution models.
Generate reports, dashboards, attribution analyses, and tracking audits for the client.
Conduct site selection analyses, trade area evaluations, and competitive benchmarking using a combination of client data and third-party licensed or publicly available data.
Communicate with you about your account, provide technical support, and send service-related updates.
Process billing transactions and send related financial information.
Detect, prevent, and address technical issues, security incidents, and fraudulent activity.
Comply with applicable legal obligations and enforce our agreements.

We process client data to provide Mediaura Signal to that client. We may also create de-identified and aggregated data from it. We may use de-identified and aggregated data for any lawful purpose, including improving statistical models that draw on data across clients. De-identified and aggregated data does not identify any individual, client, or client affiliate, and we do not attempt to re-identify it.

We do not sell client data or share it for cross-context behavioral advertising.

Your data is never used to train a generative AI model, such as a language model or synthetic data generator, without your written consent.

3. Authorized Platform Access

Mediaura Signal connects only to the third-party platforms and accounts a client explicitly authorizes. We access these platforms using OAuth 2.0 tokens, server-to-server API credentials, or other credentials the client provides during onboarding, at a read-only access level wherever the platform offers one.

A client may revoke access to any connected platform at any time by revoking credentials in the third-party platform’s own settings or by contacting us at [email protected].

We access only the data necessary to deliver the Services the client has requested and do not access platforms, accounts, data scopes, or permission levels beyond the scope of the client’s authorization.

4. Measurement Models & Derived Data

A core function of Mediaura Signal is producing measurement results from the data a client provides and authorizes us to access. This section explains how we handle that process.

4.1 Model Inputs & Outputs

Our models may use a combination of marketing data, transaction data, loyalty data, environmental signals, and other authorized inputs to produce estimates such as return on ad spend, channel contribution, incrementality, and scenario views. These outputs are statistical estimates, and as between Mediaura and the client, the client owns the outputs generated from its data.

4.2 Aggregation

Measurement results are generally reported at aggregate levels (for example, by location, channel, campaign, or time period). Where individual-level data is used as a model input, it is processed under the client’s agreement and, for healthcare clients, the BAA.

4.3 De-identified and Aggregated Data Across Clients

We create de-identified and aggregated data from client data and use it for benchmarking, methodology development, model training and validation, product development, and improvement of Mediaura Signal, including statistical models that draw on data across clients. This data does not identify any individual, client, or client affiliate. Our right to use de-identified and aggregated data is perpetual and irrevocable and continues after a client’s subscription ends. Where client data contains PHI, de-identification follows the client’s BAA.

5. Data Security

We maintain an information security program with administrative, physical, and technical safeguards appropriate to the data we process. It includes:

Encryption: Data is encrypted in transit and at rest using industry-standard methods.
SOC 2: SOC 2 Type 2 examination underway with an independent CPA firm.
Access Controls: Access to production systems holding client data is limited to personnel with a business need, granted on a least-privilege basis, reviewed periodically, and revoked promptly on role change or separation.
Credential Management: Third-party API credentials and service account keys are stored in dedicated secrets management infrastructure (for example, AWS Secrets Manager) and are never stored in application code, version control, or unencrypted configuration files.
Security Testing: We conduct regular vulnerability assessments, penetration testing, and security audits of our infrastructure and application layer.
U.S. Processing: Client data is stored and processed only in United States regions of our cloud infrastructure provider.
Incident Response: We maintain an incident response plan. If we confirm a security incident involving client data, we notify the affected client as provided in our agreement with that client and applicable law.

6. Healthcare Data & HIPAA

Mediaura Signal is built for HIPAA-regulated organizations. Business Associate Agreement included. For healthcare and behavioral health clients, the following additional safeguards apply.

6.1 Business Associate Agreement

We execute a BAA with a healthcare client before any data is transmitted to Mediaura. The BAA is part of the subscription, not a priced option. If you are a healthcare organization or a business associate that needs to engage us as a subcontractor, contact [email protected] to arrange a BAA before onboarding.

Programs subject to 42 C.F.R. Part 2 sign a Part 2 schedule to the BAA before deployment.

6.2 PHI Safeguards

Healthcare workloads run in a separate Amazon Web Services account with hardened network boundaries, encryption in transit and at rest, and least-privilege access.
Administrative actions and cross-tenant access are written to a dedicated security audit log.
Personnel with access to production systems holding client data receive security and HIPAA training and are bound by written confidentiality obligations.
We use and disclose PHI only as the BAA and applicable law permit.

6.3 De-Identification

Where we create de-identified data from PHI, we do so in accordance with 45 C.F.R. § 164.514 and the client’s BAA. Data properly de-identified under HIPAA is no longer PHI. We do not attempt to re-identify de-identified data.

6.4 Website Event Collection in Healthcare Deployments

In healthcare deployments, Mediaura Signal collects website events as follows. Signal’s tag refuses to read password, payment card, and health-related form fields, so their contents never leave the visitor’s browser. Whatever it does send travels over TLS to a dedicated collection service, where identifiers are hashed with a key unique to your organization before anything reaches the analytics platform. In healthcare deployments, all of it is handled as PHI under our BAA.

The tag recognizes sensitive fields by pattern, so it excludes the fields it recognizes as sensitive rather than every possible sensitive value.
The tag sets a pseudonymous visitor identifier. That identifier is hashed at collection and handled as PHI under the BAA.
The page path, click identifiers, campaign parameters, and user agent are retained.
Network infrastructure in front of the collection service keeps security logs that record visitor IP addresses. These logs are encrypted, retained for 90 days, and handled as PHI under the BAA.
Measurement results for healthcare clients are reported at aggregate levels and are not used for decisions about individual patients.

6.5 Aura, the Analyst Assistant

Aura works inside the platform under the same BAA as everything else. It doesn’t do math: every figure comes from the statistical engines, and Aura explains what they found. Prompts and responses are not sent to the developer of any language model.

6.6 Breach Notification

In the event of a breach of unsecured PHI (as defined under 45 C.F.R. § 164.402), we notify the affected client as required by the BAA and 45 C.F.R. § 164.410, without unreasonable delay and no later than sixty (60) calendar days after discovery.

7. Data Retention & Deletion

Client Data: Retained for the duration of the client’s subscription. Clients can export their data for 30 days after their subscription ends, after which it is deleted on Mediaura’s retention schedule. Copies in archival or disaster recovery backups are deleted as those backups expire in the ordinary course.
PHI (Healthcare Clients): Returned or destroyed in accordance with the client’s BAA.
De-identified and Aggregated Data: Retained, as described in Section 4.3.
Account & Contact Information: Retained for the duration of the relationship and as needed afterward for legitimate business and legal purposes.

We may retain data longer where required by law.

8. Data Sharing

We do not sell client data. We share information only in the following circumstances:

Service Providers & Subprocessors: With vendors who help us operate the platform (for example, cloud hosting and infrastructure services), under written contracts that restrict their use of the data. Subprocessors that handle PHI do so under a business associate agreement.
At a Client’s Direction: To platforms a client designates. For retail, restaurant, and B2B clients, Signal can send verified conversions back to the client’s ad platforms and write attribution into its CRM. In healthcare deployments, those paths are off by design.
Third-Party Data Providers: We receive data from licensed third-party data providers (for example, demographic, foot traffic, and market data) for use in delivering the Services. We do not share client data with these providers.
Legal Requirements: When required by law, subpoena, court order, or governmental regulation, or when we believe disclosure is necessary to protect the rights, safety, or property of Mediaura, our clients, or the public.
Business Transfers: In connection with an actual or prospective merger, acquisition, financing, reorganization, or sale of assets, under written confidentiality obligations. Client data transfers only to a successor that takes on our agreement with that client.
With Consent: In other circumstances with prior consent.

9. Data Processing Addendum

Our subscription agreement includes a Data Processing Addendum that governs our processing of personal data that is not PHI, under which Mediaura acts as the client’s service provider or processor. PHI is governed by the BAA. Questions: [email protected].

10. Your Rights

Data we process for a client. If your information is in data we process on behalf of a client (for example, you visited a client’s website or are one of its patients or customers), that client controls your data. We forward requests about that data to the client, which decides how to respond. You may also contact the client directly.

Data we control. For information we control ourselves, such as data about visitors to mediaura.io and our own contacts, you may have rights depending on your jurisdiction, including the rights to:

Access the personal information we hold about you.
Correct inaccurate or incomplete personal information.
Request deletion of your personal information, subject to applicable legal exceptions.
Object to or restrict certain processing activities.
Receive your personal data in a structured, commonly used, machine-readable format.
Withdraw consent where our processing is based on your consent.

To exercise these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law.

11. State-Specific Privacy Rights

11.1 California (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), with respect to personal information we control:

Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collecting it, and the categories of third parties with whom we share it.
Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
Right to Correct: You may request correction of inaccurate personal information.
Right to Opt Out of Sale or Sharing: We do not sell personal information or share it for cross-context behavioral advertising as those terms are defined under CCPA/CPRA.
Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

11.2 Other U.S. State Privacy Laws

Residents of other states with comprehensive privacy laws may have similar rights under their state laws. To exercise them, contact us at [email protected]. Requests about data we process for a client are handled as described in Section 10.

12. Cookies & Tracking Technologies

On mediaura.io, we use the following categories of cookies and similar technologies:

Strictly Necessary Cookies: Required for the operation of our website. These cannot be disabled.
Analytics Cookies: Help us understand how visitors interact with our website so we can improve it. These are optional and can be disabled.

On client websites, the Mediaura Signal tag is deployed at the client’s direction and is subject to the client’s own notices and consent practices. It sets a pseudonymous first-party identifier, which is hashed at collection as described in Section 6.4.

You can manage your cookie preferences through your browser settings.

13. U.S. Processing

Mediaura Signal is offered to U.S. organizations, and client data is processed in the United States. If you access our website from outside the United States, your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

14. Children’s Privacy

Our website is not directed to individuals under the age of 18. We do not knowingly collect personal information from children through mediaura.io. If you believe we have inadvertently done so, please contact us at [email protected].

15. Third-Party Links & Integrations

Our Services may contain links to or integrations with third-party websites, platforms, and services that we do not operate. We are not responsible for their privacy practices or content.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the “Last updated” date. Changes to this Policy do not modify any signed agreement between a client and Mediaura.

17. Contact Us

If you have questions about this Privacy Policy or our data practices, or wish to exercise any of your rights, contact us at:

Mediaura, Inc.
360 Spring Street
Jeffersonville, Indiana
Email: [email protected]
Website: mediaura.io