Data Processing Agreement

Last updated 25 October 2026 · Art. 28 GDPR · Auftragsverarbeitungsvertrag

In short

Your apps' users are your users. For the data the SDK and your sources send about them, you decide and Apparent processes it for you. This agreement says how. It's part of the Terms: it applies as soon as you use Apparent, with nothing to sign. If you need a signed copy, write to hello@apparent.fyi.

1. Who's who

You, the customer, are the controller. The processor is Ahmed Ashour, trading as Apparent, Reichsgasse 17, 40217 Düsseldorf, Germany ("Apparent", "we"). Your own Apparent account (your sign-in address, your plan) isn't covered here: for that Apparent is its own controller, as the Privacy page says.

2. What Apparent does with the data

• Purpose: to show you how your apps are doing: pages, alerts, the weekly email, the phone app, exports, the command line and MCP answers you ask for.
• What it does: receives, stores, counts, combines into daily totals, shows, sends to you, exports and deletes.
• Whose data: people who use your apps, people who buy in them, and people who review them in the stores.
• Which data: the SDK's random install id and your own user id if you set one; the events your app sends, with their properties and times; crashes and errors your app catches (message, type, the first lines of the stack); platform, system and app version, phone model, language, region setting and time zone; the country (worked out from the internet address, which isn't stored); purchases and refunds from RevenueCat; events from Mixpanel if you connect it; store reviews with the reviewer's name as the store shows it.
• How long: as long as your account exists, then as in section 9.

3. Only on your instructions

Apparent uses the data only to run the service for you and never for anything of its own: it's never sold, never shared, never combined with another customer's and never used to train AI models. Your instructions are the Terms, this agreement and what you do in Apparent: the apps you add, the sources you connect, what your app sends, and erasing a person. If we think an instruction breaks data protection law, we tell you. If the law makes us do something else with the data, we tell you first, unless the law forbids it.

4. Confidential

Apparent is run by one person, who keeps the data confidential. Anyone who ever helps and can see the data commits to confidentiality in writing first.

5. Kept safe

Apparent protects the data as Art. 32 GDPR asks, with the measures in Annex 2. It may improve them, never weaken them.

6. Other companies (sub-processors)

You allow Apparent to use the companies in Annex 1. Each is bound by a data protection agreement with duties like these, and Apparent answers to you for them. Before a new one starts handling your data, we email you at least 30 days ahead and update the list. You can object within that time for a reason to do with data protection. If we can't solve it, you can end your plan before the change and get back the unused part of what you paid in advance.

7. Outside the EU

Your data is stored in the EU, on a server in Germany. It only leaves the EU through the companies in Annex 1, and only with the safeguard named there (Art. 44 ff. GDPR).

8. Helping you

• Your users' requests: you can erase a person with all their installs on the Connect page (and they stay erased, also when Mixpanel is read again), and export events and people as CSV. Anything else, we help with on request.
• Security, breaches, assessments: we help you with Art. 32 to 36 GDPR, with what we know about Apparent.
• A breach: if your data is ever exposed, we tell you without undue delay, at the latest 48 hours after we learn of it, with what we know then and what we're doing about it.
• Proof: we answer your questions and give you what you need to show this agreement is kept.
• Audits: you, or an auditor you choose who's bound to confidentiality, may check, with reasonable notice, during working hours, at your cost, and normally at most once a year. Written answers come first; an inspection on site if they aren't enough.

9. Keeping and deleting

• Single events are kept for 180 days. Daily totals and each person's first and last day stay as long as your account.
• Server logs are kept at most 30 days. Backups are kept 14 nights.
• Delete your account (Connect page or the phone app) and its data is gone from the server at once and from every backup within 30 days.
• If a trial or a plan ends without a new one, the data is kept 30 days so you can come back, then deleted, from backups within 30 more days.
• You can download all of it, any time until then.

10. The rest

Liability is as in the Terms; Art. 82 GDPR stays as it is. If this agreement and the Terms ever disagree about personal data, this agreement wins. German law applies. Changes work like changes to the Terms: an email first.

Annex 1: Sub-processors

Not on this list: Paddle.com, which sells the plans as its own controller and never sees your users' data, and the sources you connect (App Store Connect, Google Play, RevenueCat, Mixpanel, ad networks), which are your own providers.

Annex 2: Security measures

• Separate: every customer has a database of its own, in its own process. Nothing is shared between customers.
• Access: the server only takes SSH keys; its firewall lets in nothing but SSH and a private network. The dashboard is reached only through Cloudflare's encrypted tunnel or that private network.
• Sign-in: one-time codes by email, no passwords; repeated tries are limited. Personal tokens can only read.
• Encrypted: traffic is encrypted on the way (HTTPS). Access keys to your sources are encrypted with a key of your own.
• Less data: no internet addresses kept with events; the SDK uses a random id unless you set your own, and it can wait for your users' consent before it sends anything.
• Abuse: each app's intake has a limit a minute; a new SDK key stops the old one at once.
• Kept up: security updates install themselves; the app runs as its own user without special rights.
• Backups: nightly copies, kept 14 nights on the server and on Apparent's own computer in Germany, plus Hetzner's server backups for 7 days.
• Logs: kept at most 30 days.