OneWire News

"We may use data collected from a response to one type of advertising or information for targeting advertisements or other information through a different venue. For example, we may notice that you responded to a credit card banner advertisement and use that response to deliver a credit card-related advertisement and other information to you."

The company tracks user behavior across websites, software programs, and email to build profiles and retarget advertising across different channels and venues.

"We may sell or disclose Individual Information for a business purpose. For example, we may provide your information to service providers who perform services on our behalf or to third party advertisers. ... We may disclose or transfer Individual Information to entities wholly owned or controlled by us, in our discretion."

User data is shared broadly with publishers, third-party advertisers, service providers, and affiliated companies with essentially no limitations beyond legality.

"This Privacy Policy may change from time to time. Please check back frequently for updates. ... Additional categories of Individual Information will not be collected or used for materially different purposes without first providing you with notice (which may be by way of a change to this Privacy Policy)."

The company can change the privacy policy at any time with no direct notification to users — notice may consist solely of updating the policy text on their website.

"We store Individual Information on servers or other equipment that have security measures designed to protect against the loss, misuse, and alteration of the information under our control. We also maintain physical and procedural safeguards designed to protect Individual Information."

The policy describes storage and security but provides no information about how long data is retained or when it is deleted, suggesting indefinite retention.

"Due to the nature of the information collected, we cannot verify your identity to the degree of certainty required to fulfill requests to know the specific pieces of personal information requested because information collected from you is associated with only two semi-static identifiers. All other information collected from you does not provide a reliable method for verifying your identity."

The company claims it cannot verify user identity well enough to fulfill data access requests, which effectively makes deletion rights difficult or impossible to exercise.