Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between:

• Data Controller ("Customer", "you") — the entity that integrates the Trace SDK and determines the purposes of processing end-user data.
• Data Processor ("Trace", "we", "us") — the operator of traceclick.io, processing data on behalf of the Customer.

This DPA applies when Trace processes personal data of end users on the Customer's behalf in connection with the Service. It is designed to meet the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

• Personal Data — any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.
• Processing — any operation performed on Personal Data, as defined in Article 4(2) GDPR.
• Sub-processor — a third party engaged by Trace to process Personal Data on behalf of the Customer.
• Data Subject — an identified or identifiable natural person whose Personal Data is processed.

3.1 Subject matter

Trace processes Personal Data to provide mobile install attribution, deferred deep linking, and fraud detection services as described in the Terms of Service.

3.2 Categories of data subjects

End users who click Trace links or use apps that integrate the Trace SDK.

3.3 Types of Personal Data processed

3.4 Duration

This DPA applies for the duration of the Customer's use of the Service. Upon termination, Trace will delete or anonymize all Personal Data within 30 days, unless retention is required by law.

Trace shall:

• Process Personal Data only on documented instructions from the Customer (i.e., as configured through the API, SDK, and CLI).
• Ensure that persons authorized to process Personal Data are bound by confidentiality obligations.
• Implement appropriate technical and organizational security measures (see Section 7).
• Not engage a Sub-processor without prior notice to the Customer (see Section 6).
• Assist the Customer in responding to Data Subject requests (erasure, export) via the API and CLI.
• Assist the Customer with data protection impact assessments where required.
• Delete or return all Personal Data upon termination of the Service.
• Make available all information necessary to demonstrate compliance and allow for audits.

The Customer shall:

• Ensure a lawful basis for processing end-user data (e.g., legitimate interest or consent).
• Provide appropriate privacy disclosures to end users, including disclosure of Trace as a data processor.
• Obtain any required consent before integrating the Trace SDK (including compliance with Apple ATT and Google consent requirements).
• Respond to Data Subject requests using the tools provided (API, CLI) or by forwarding requests to Trace.
• Notify Trace of any restrictions or special requirements regarding the processing.

The Customer authorizes Trace to engage the following Sub-processors:

Trace will notify the Customer via email at least 14 days before engaging a new Sub-processor. If the Customer objects, they may terminate the Service before the new Sub-processor begins processing.

Trace maintains Data Processing Agreements with each Sub-processor that impose data protection obligations no less protective than those in this DPA.

Trace implements the following technical and organizational measures:

7.1 Data minimization

• IP addresses are hashed before storage. Raw IPs are never persisted.
• No advertising identifiers (IDFA/GAID) are collected.
• No precise geolocation is collected.

7.2 Encryption

• All data in transit is encrypted via TLS 1.2+.
• Database storage is encrypted at rest (managed by Supabase).

7.3 Access control

• Row-Level Security (RLS) policies isolate data between Customer apps.
• API key authentication is required for all data access.
• Administrative access is restricted to authorized personnel.

7.4 Audit trail

• All sensitive operations are logged to a tamper-proof, insert-only audit log.
• Audit entries include: data access, erasure requests, key rotations, and tier changes.

7.5 Data retention and anonymization

• Automatic PII anonymization after the Customer's tier-based retention window (7, 90, or 365 days).
• Unattributed clicks are purged after 7 days regardless of tier.
• GDPR erasure requests are processed within 15 minutes.

7.6 Region isolation

• Customers can pin their data to US or EU regions.
• Region enforcement at the API level rejects cross-region requests.
• Separate database instances and application servers per region.

Trace provides technical measures to assist the Customer in fulfilling Data Subject requests:

In the event of a Personal Data breach, Trace will:

• Notify the Customer without undue delay, and in any event within 72 hours of becoming aware of the breach.
• Provide details of the nature of the breach, the categories of data affected, approximate number of records, likely consequences, and measures taken to mitigate.
• Cooperate with the Customer in notifying supervisory authorities and Data Subjects as required.

Where Personal Data is transferred outside the EEA, Trace relies on:

• EU-approved Standard Contractual Clauses (SCCs) with Sub-processors.
• Region pinning (EU option) to keep data within the European Union.

Customers who require data to remain in the EU should set their app's data region to "eu" when creating the app.

By signing this DPA, you confirm that you have authority to bind your organization and that you agree to its terms. You can sign this DPA via the CLI:

This records the DPA version, your identity, and the acceptance timestamp. You can verify your DPA status at any time with trace apps dpa --status.

Trace may update this DPA to reflect changes in law or our processing activities. We will notify you of material changes via email at least 30 days before they take effect. If you do not accept the updated DPA, you may terminate the Service.

For questions about this DPA or data processing:

• Email: privacy@traceclick.io