Data ProcessingAgreement

This Data Processing Agreement (“DPA”) forms part of the agreement between you (the “Controller”) and ROASSensor (the “Processor”) for use of the Service. It applies wherever we process personal data on your behalf, and it takes effect automatically when you connect a data source, so there is nothing to sign.

Terms not defined here carry the meaning given in our Terms of Service and Privacy Policy. Where this DPA conflicts with those documents on a question of data processing, this DPA governs.

You are the Controller: you decide which ad networks and revenue sources to connect and for what purpose. We are the Processor: we act only on your documented instructions, and connecting a source in your workspace is such an instruction.

For our own business records (your account, billing, and support history), we act as a Controller in our own right, and that processing is described in the Privacy Policy rather than here.

We process personal data in order to provide the Service: syncing spend and revenue from the platforms you authorize, reconciling the two, attributing installs and revenue to campaigns and creatives, presenting the result in your dashboard, and, where you configure it, sending conversion events and postbacks to the ad platforms and endpoints you choose.

Processing lasts as long as your account is active. When you disconnect a source, delete your account, or the agreement ends, the retention and deletion terms below apply.

The personal data we process on your behalf is limited to what the Service needs to compute attribution. Depending on the sources you connect, it may include:

• Pseudonymous identifiers: visitor, session and click ids collected by the tracking snippet or SDK, the iOS identifier for vendor (IDFV), click ids passed to us by ad networks, and push notification tokens if you turn on uninstall measurement.
• Mobile advertising identifiers: Google Advertising ID, IDFA and App Set ID are hashed with SHA-256 before storage; we do not store them in the clear.
• Hashed contact identifiers: email addresses and phone numbers are normalized and hashed before they enter our tracking tables; we do not store them in the clear.
• Device and technical data: App Tracking Transparency status, operating system and version, device model, app version, country, user agent, referrer, and page or screen viewed. IP addresses are processed when a request arrives and stored only as a salted hash.
• Transaction data: order identifiers, amounts, currency, and refund status received from your payment processor, app store or subscription platform, or reported by your server.

The data subjects are the visitors, app users, and customers of the Controller. We do not knowingly process special categories of personal data, and the Service should not be used to send us any.

We process personal data only on your documented instructions, including for international transfers, unless required otherwise by law, in which case we will tell you before processing, unless that law forbids it.

We ensure that personnel authorized to process personal data are bound by confidentiality, and we limit access to those who need it to operate or support the Service.

We do not sell personal data, and we do not use the data we process on your behalf to build or improve products for anyone else. Aggregated, de-identified statistics that cannot reasonably be linked back to you or any data subject are the only exception.

We maintain technical and organizational measures appropriate to the risk, including: encryption in transit (TLS) between your apps and websites, our servers and the platforms you connect; hashing of advertising identifiers (Google Advertising ID, IDFA and App Set ID), email addresses and phone numbers before storage, and storage of IP addresses only as a salted hash; credentials for connected platforms that are write-only through our API, so that once saved they are never sent back to a browser; revocable access, since disconnecting a source deletes its stored credential; role-based access control within a workspace; and access to production systems limited to the personnel who need it to operate and support the Service.

Credentials for connected sources are used only for what you configure: reading spend and performance data and, where you turn it on, sending conversion events and audiences to that platform. By default we only read from a connected ad account. For Apple Search Ads, if the API key you connect has Apple’s API Account Manager role, an Owner or Manager of your workspace can instruct us, through the Apple Search Ads Manager, to create, copy, pause, enable or delete campaigns, ad groups and keywords, change budgets, bids and target cost per acquisition, and add negative keywords, and can create rules that make some of these changes on a schedule once an Owner or Manager turns them live. We make these changes only on those instructions, and each one is recorded in Settings → History. We do not create, edit, pause or delete campaigns, ads or budgets on any other platform.

You give general authorization for us to engage sub-processors to provide the Service, for example cloud hosting, email delivery, error monitoring, and payment processing.

Every sub-processor is bound by written terms imposing data-protection obligations no less protective than those in this DPA, and we remain responsible to you for their performance. We will give you notice of any intended addition or replacement of a sub-processor, and you may object on reasonable data-protection grounds.

Where you configure it, we transmit personal data to third parties you choose: conversion events to Meta, Google Ads and TikTok; audiences of hashed identifiers to Meta, Google Ads and TikTok; install, in-app event and purchase postbacks to AppLovin, Unity Ads and Mintegral; and webhooks or forwarded store notifications to endpoints you specify. These transfers are made on your instructions, and each recipient processes the data under its own terms with you; they are not our sub-processors.

Postbacks to ad networks never contain raw advertising identifiers or IP addresses, and you can withhold sale values from any platform. Pausing or removing a partner, postback or webhook stops further transfers to it.

We may process and store personal data in countries other than your own. Where we transfer personal data out of the EEA, the UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards such as the Standard Contractual Clauses, together with any additional measures the transfer requires.

Taking into account the nature of the processing, we will assist you with appropriate technical and organizational measures in responding to requests from data subjects exercising their rights of access, rectification, erasure, restriction, portability, or objection.

Where a data subject contacts us directly about data we process on your behalf, we will not respond substantively; we will refer them to you, and tell you promptly.

Erasure for an individual can be requested at any time and is described on our Data Deletion page.

We will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, and will provide the information you reasonably need to meet your own notification obligations.

Notification is not an acknowledgement of fault or liability.

We will make available the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits conducted by you or an auditor you mandate.

To keep audits proportionate, we may satisfy a request by providing existing documentation or third-party reports where these reasonably answer it. Audits are at your expense, during business hours, subject to confidentiality, and no more than once a year unless required by a supervisory authority or following a breach.

Disconnecting a source deletes that source's stored access token and stops further syncing; spend already synced stays in your reports so historical ROAS does not change. Deleting your account removes your profile, every connected source and its tokens, and your synced metrics.

On termination we delete or return personal data processed on your behalf, except where storage is required by law. Residual copies may persist briefly in backups and are overwritten on our normal backup rotation.

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

Questions about this DPA, or a request to execute a countersigned copy for your records? Email us at [email protected] and we'll be glad to help.