Data processing agreement

This agreement applies when App Gravity processes personal data on your behalf, mainly merchant contact details and the text merchants send you. You are the controller; we are the processor.

What we process and why

Shop identifiers, shop names and email addresses, uninstall reasons, support messages, review text and the events your app sends, only to provide the features you use. We never sell it, and we do not use it to train AI models.

Security

Encryption in transit and at rest, encrypted access tokens with key rotation, per-tenant access checks on every query, least-privilege staff access with logged read-only views, and an audit log of sensitive actions.

Sub-processors

The current list is on the sub-processors page.

Your rights and requests

Export or delete your organization's data at any time from Settings, Data and privacy. Merchant redaction requests forwarded through the SDK are handled automatically. Other requests: support@appgrav.com.

Breaches

We notify you without undue delay, and within 72 hours, of a breach affecting your data.

Transfers

Transfers outside the EU and UK rely on the Standard Contractual Clauses.