GDPR Compliance

Last Updated: August 12, 2026

1. Our Commitment to GDPR

Postback is operated by Tap & Swipe, a company based in France. We are fully committed to complying with the General Data Protection Regulation (GDPR) and ensuring that all personal data is processed lawfully, fairly, and transparently.

This page describes how Postback handles data protection in the context of our mobile measurement infrastructure for app developers.

2. Data Roles

Postback as Data Processor

Postback acts as a data processor under GDPR. Our clients (app developers) integrate our SDK into their mobile apps, configure signal links and integrations, and use our dashboard to view measurement and attribution data.

• Data Controller: The app developer (our client) who determines why and how end-user data is collected and which Postback features are enabled
• Data Processor: Postback, which processes end-user data on behalf of the client to provide measurement, attribution, analytics, and client-configured integrations

What This Means

• Clients are responsible for having a valid legal basis for collecting end-user data
• Clients must inform their end users about data collection through their own privacy policies
• Postback processes data strictly according to our clients' instructions and for the purposes defined in our agreement
• We do not independently determine the purposes of end-user data processing
• Postback is not an ad network, data broker, or cross-app advertising network
• We do not sell end-user data, build cross-client user profiles, or use end-user data for Postback's own advertising or retargeting

3. Legal Basis for Processing

Client Data (Account Holders)

We process client personal data (name, email, billing information) under the following legal bases:

• Contract performance (Article 6(1)(b)): Processing necessary to provide the Service
• Legitimate interest (Article 6(1)(f)): Service improvement, security, and fraud prevention

End-User Data (via SDK)

As a data processor, we process end-user data under the legal basis established by the data controller (our client). Common legal bases used by our clients include:

• Consent (Article 6(1)(a)): End-user consent obtained through an applicable consent management flow
• Legitimate interest (Article 6(1)(f)): Marketing attribution as a legitimate business interest, with appropriate balancing tests performed by the client

It is the client's responsibility to ensure they have a valid legal basis for the data processing carried out through our SDK, signal links, API, dashboard, and any client-configured integrations. If a client enables an ad network or revenue platform integration, the client is instructing Postback to process and transmit selected data to that destination for the client's own account and purposes.

4. Data We Process

Through our SDK and platform, we process attribution-related data on behalf of our clients. This can include random install identifiers, IP address and user agent, IDFV, IDFA only when iOS already reports ATT authorization, Android advertising identifiers when available, app and operating-system metadata, device and screen characteristics, language/locale/timezone, graphics and network context, click/referrer data, Apple AdServices attribution, install lifecycle, sessions, and client-defined events. We do not collect exact GPS location, contacts, photos, microphone data, or other personal content about end users. Clients are instructed not to send raw names, email addresses, or phone numbers through event parameters or customer identifiers.

We do not combine end-user data across clients to create cross-app or cross-client profiles. End-user data is processed for the client whose app, signal link, workspace, or integration generated the data.

5. Sub-Processors

We use the following sub-processors to deliver the Service:

All sub-processors are bound by data processing agreements that ensure GDPR-compliant handling of personal data. We will notify clients of any changes to our sub-processors.

Client-configured ad networks, app stores, analytics systems, and revenue platforms are not enabled by default. When a client enables a destination such as Apple Search Ads, TikTok Ads, Meta Ads, RevenueCat, or Superwall, Postback sends data to that destination only at the client's instruction and for the client's configured account. Those destinations process data under their own terms and privacy roles, and the client is responsible for the required notices, consents, app store disclosures, and contractual permissions.

6. Data Subject Rights

How End Users Exercise Their Rights

Since Postback is a data processor, end users should exercise their GDPR rights by contacting the app developer (data controller) directly. The typical process is:

1. End user contacts the app developer to exercise a right (access, erasure, etc.)
2. App developer evaluates the request and contacts Postback if needed
3. Postback assists the app developer in fulfilling the request (e.g., deleting the end user's data from our systems)

We are committed to assisting our clients in responding to data subject requests within the timeframes required by GDPR.

To help us locate relevant records, client requests should include the app identifier, the relevant Postback install or user identifier where available, the type of request, and the date the end user submitted the request. If an end user contacts us directly, we may redirect them to the app developer as the data controller unless we can safely verify the request and the controller relationship.

Rights of Our Clients

Clients (account holders) can exercise their GDPR rights directly with us by contacting hello@postback.sh. See our Privacy Policy for the full list of rights.

7. Data Processing Agreement

A formal Data Processing Agreement (DPA) is available on request for all clients. The DPA covers:

• Scope and purpose of processing
• Categories of data processed
• Duration of processing
• Obligations of both parties
• Sub-processor management
• Data breach notification procedures
• Assistance with data subject rights
• Data deletion upon termination

To request a DPA, contact us at hello@postback.sh.

8. SDK Privacy Controls

Our SDK is designed with privacy in mind:

• No Automatic ATT Prompt on iOS: The iOS SDK never requests ATT permission; IDFA is omitted unless the host app already has authorized status
• Apple Ads Attribution: The iOS SDK uses Apple's AdServices framework, which does not require ATT permission
• Android Ad ID: The SDK respects the user's advertising ID preferences on Android
• Request Handling: Clients can ask us to delete, suppress, or export user-level data needed to honor valid GDPR rights requests
• App-Scoped Processing: Device context is processed for the client whose app generated it and is not combined into cross-client end-user profiles
• Client-Controlled Integrations: Ad network and revenue platform integrations operate only when configured by the client

Clients remain responsible for determining whether their complete app and enabled integrations require consent or updated App Store / Google Play privacy disclosures.

9. Data Retention & Deletion

Clients can request data deletion at any time by contacting us. Upon receiving a valid deletion request, we will delete the data within 30 days.

10. Security Measures

We implement the following technical and organizational measures to protect personal data:

Technical Measures

• Encryption in transit (HTTPS/TLS for all communications)
• Provider-managed database and storage encryption where supported
• API key hashing (plaintext keys are never stored)
• Network isolation and firewall rules
• Regular security updates and patching

Organizational Measures

• Access to production systems restricted to authorized personnel
• Multi-factor authentication required for all infrastructure access
• Regular security reviews
• Incident response procedures

11. International Data Transfers

When personal data is transferred outside the European Economic Area (EEA), we ensure GDPR-compliant safeguards:

• Cloudflare: Data may be processed through Cloudflare's global network and services. Transfers are covered by Cloudflare's Data Processing Addendum and Standard Contractual Clauses where applicable
• Neon: Product database data is hosted in a US region. Transfers are covered by Neon's Data Processing Addendum and Standard Contractual Clauses where applicable
• Whop: Transfers to the US are covered by SCCs and the EU-US Data Privacy Framework
• Google: OAuth data transfers are covered by SCCs and the EU-US Data Privacy Framework
• Plunk / Amazon SES: Transfers are covered by SCCs where applicable

12. Breach Notification

In the event of a personal data breach:

1. We will notify affected clients without undue delay and no later than 72 hours after becoming aware of the breach
2. Notification will include the nature of the breach, categories of data affected, approximate number of records, likely consequences, and measures taken
3. Clients (as data controllers) are responsible for notifying their end users and the relevant supervisory authority as required by GDPR Articles 33 and 34

13. Contact

For any questions about our GDPR compliance or data protection practices:

Email: hello@postback.sh
Entity: Tap & Swipe
Location: France

For complaints, you may also contact the French data protection authority:

CNIL (Commission Nationale de l'Informatique et des Libertés)

• Website: https://www.cnil.fr/fr
• Address: 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07, France