DataProcessingAddendum.

1. Introduction and Scope

This Data Processing Addendum ("DPA") forms part of the agreement between Trillboards, Inc. ("Trillboards", "we", "us") and you ("Earner", "Screen Owner", "you") governing the processing of personal data in connection with audience sensing and advertising services provided through the Trillboards platform.

This DPA applies to all data processed by Trillboards display devices, including tablets, smart TVs, and connected screens enrolled in the Trillboards network.

2. Definitions

• "Audience Data" means anonymous, aggregated statistical data derived from on-device sensing, including face count, attention duration, dwell time, and demographic estimates.
• "On-Device Processing" means computation performed locally on the display device using embedded AI models. Raw sensor data is processed on the device, except for camera frames selected for cloud analysis, which are transmitted and retained as described in Section 3.
• "Aggregated Data" means statistical summaries that cannot identify any individual person.
• "Advertising Partners" means demand-side platforms, ad exchanges, and direct advertisers that purchase advertising inventory through the Trillboards platform.

3. Data Collection and On-Device Processing

Trillboards display devices use on-device AI to collect anonymous audience metrics. The following principles govern all data collection:

• Camera-based detection counts faces, estimates attention, and measures dwell time. Frames selected for cloud analysis are transmitted over TLS and held in private storage for up to 90 days; they are never published. No video is recorded.
• Audio analysis measures ambient noise levels and environment classification. No audio recordings are captured, stored, or transmitted.
• Demographic estimation (age range, gender distribution) is performed on-device using local AI models. On devices running the full sensing profile a numerical face-identity template may be computed on-device and retained for up to 90 days, solely to recognise repeat observations; it cannot be used to reconstruct an image and is never shared with a data partner.
• Apart from the frames described above, only anonymous, aggregated statistical summaries are transmitted to Trillboards servers.

4. Purpose Limitation

Audience Data collected through the platform is used exclusively for:

• Measuring advertising campaign effectiveness (impressions, attention, engagement)
• Optimizing ad delivery timing and content relevance
• Generating anonymized performance reports for advertising partners
• Improving the Trillboards platform and screen owner revenue

Trillboards does not use Audience Data for individual tracking, surveillance, facial recognition, or identification of any person.

5. Data Sharing with Advertising Partners

We share the following categories of data with advertising partners:

• Aggregated impression counts (number of viewers, not individual identities)
• Average attention duration and engagement scores
• Anonymized demographic distributions (e.g., "60% estimated age 25-34")
• Screen performance metrics (uptime, content delivery success rates)
• For screens whose owner has separately executed a Data Monetization Addendum: device-graph identifiers and other data specified in that addendum, licensed to named data partners for those partners' own purposes, this is opt-in per screen owner and not enabled by default

The data described above for advertising partners is aggregated and anonymized. Data shared under a Data Monetization Addendum is a separate, opt-in category that may include individual-level identifiers, and is not covered by that aggregation, see trillboards.com/legal/data-partners for the current list of authorized data partners.

6. Data Retention

Aggregated Audience Data is retained for 90 days. Ad impression records are retained for 400 days for advertiser billing reconciliation and contractual reporting. Camera frames selected for cloud analysis and face-identity templates are retained for 90 days. On-device sensor data that is not selected for cloud analysis is processed in real time and discarded. You may request deletion of your account and associated data by contacting privacy@trillboards.com.

7. Security Measures

Trillboards implements the following technical and organizational measures to protect data:

• All data in transit is encrypted using TLS 1.2 or higher
• All data at rest is encrypted using AES-256
• On-device processing uses sandboxed AI models with no network access to raw data
• Access to aggregated data is controlled through role-based authentication
• Regular security audits and penetration testing
• Employee access is restricted on a need-to-know basis

8. Your Rights

As a screen owner, you have the following rights regarding data processing on your devices:

• Right to disable audience sensing entirely through the Trillboards portal (revenue may be affected)
• Right to request a copy of aggregated data associated with your screens
• Right to request deletion of all data associated with your account
• Right to withdraw consent for data processing at any time
• Right to decline or withdraw from the Data Monetization Program at any time, without affecting any other Trillboards services

To exercise any of these rights, contact privacy@trillboards.com or use the controls in your Trillboards portal dashboard.

9. GDPR and CCPA Compliance

Trillboards is designed to comply with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). Because Audience Data (as defined in Section 2) is anonymous and aggregated, it generally does not constitute "personal data" under GDPR or "personal information" under CCPA. This does not extend to data shared under the Data Monetization Program (Section 5), which may include individual-level identifiers and is treated as personal information/personal data subject to the full protections of GDPR and CCPA/CPRA, including the right to opt out of sale or sharing.

10. Changes to This DPA

We may update this DPA from time to time. Material changes will be communicated via email to registered screen owners and posted on this page. Your continued use of the platform after changes constitutes acceptance of the updated DPA.

11. Contact

For questions about this Data Processing Addendum or our data practices, contact us:

Data Protection Officer: For privacy and data processing inquiries, contact our DPO at privacy@trillboards.com