Privacy Policy

Last updated 5 November 2026 · Effective 5 November 2026

1. Two different roles

This is the most important thing to understand about how Apprvd.app handles personal data, because it changes who is responsible for what.

• For your workspace account, we are the controller. That means the people at your organisation who sign in, and your billing relationship with us.
• For your end users’ data, we are a processor. Analytics identifiers, device tokens and app events belong to you. We only touch them to run the product on your instruction. You decide why and how they are processed; we do not use them for our own purposes, ever, and we do not sell them or use them to train models.

If you are an end user of an app that uses Apprvd.app, we are not your point of contact: the operator of that app is. Ask them, and they can instruct us on your behalf.

2. Data we hold as controller

Payment card details are entered directly with Stripe and never reach our servers. We see only the subscription status and the last-four/brand that Stripe reports.

3. Data we process as processor

On your instruction, Apprvd.app processes:

• Aggregate analytics from your Google Analytics property: read through Google’s Analytics Data API and kept in our database so dashboards load without waiting on Google: totals such as active and new users, event counts, retention and funnel step counts, broken down by date, platform, country, app version and device brand. Google Analytics returns no individual users or events through these reports, and we store none from it.
• Device push tokens: read from the Firestore collection you nominate, matched to the audience you defined, and used to send the notification you composed or approved, including one drafted in an AI tool you connected. They are not retained after the send.
• First-party tracker events (if you install our SDK): event name, your user identifier, a device identifier, event parameters, timestamps, and the platform, app version and SDK version they were sent from. These are individual events, stored in our database; they are what push audiences are built from, and how a new release is compared with the one before.
• An identity map: which device ids and Firebase app instance ids belong to which of your user ids, so one person counts once and can be deleted as one.
• Audience definitions and send history: the cohorts you build and a record of what was sent, when, to how many, and how many opened.
• Bank statements you upload (Finances): each transaction’s date, amount, currency, the bank’s description and the counterparty’s name, which can name people you pay, such as employees. We keep the transactions, not the file, and of the account number only its last four characters. A PDF statement is sent to the Google Gemini API to be read into transactions; a CSV is read by our own code. Deleting a statement deletes its transactions.

The identifiers involved are the ones your app supplies. If you send us direct identifiers such as email addresses in event parameters, they will be stored as sent; we recommend you do not.

4. Credentials and encryption

Your Google OAuth refresh token, and any third-party source credentials you add (for example Mixpanel or RevenueCat keys), are encrypted at rest with AES-256-GCM using a key held in our application environment and not in the database. They are decrypted only in memory, to make the API call you asked for. All traffic to Apprvd.app is over TLS. Tokens you create for your own AI tools are stored only as a SHA-256 hash and can't be read back.

5. Sub-processors

We use the following providers. We will give notice before adding a new one, so you can object.

If you connect your own AI tool to Apprvd.app, the answers it asks for go to that tool's provider under your agreement with them; that provider is not our sub-processor. Individual end users' data is only included for a token you created with that option ticked. What that tool drafts, sends or publishes is recorded with the member and token that did it, and a send or publish you approve there is your instruction to us.

6. International transfers

Where personal data leaves the EEA or UK, we rely on the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism, together with the safeguards each provider offers. Copies are available on request.

7. How long we keep things

• Account data: for as long as your workspace exists, then deleted within 30 days of closure.
• Tracker events: deleted automatically, a month at a time, once they are older than 12 months. Tell us if you want a shorter window.
• The identity map: until you delete the app, or the person. A deletion request for one person removes their tracker events and identity entries from our database; deleting them in your own Google Analytics property stays with you.
• Assistant conversations: those in the assistant panel are private to the member who had them; questions asked on an app's home are shared with the members of that workspace. Both are deleted once untouched for as long as tracker events are kept. Only the panel looks up one of your end users: the answer is given in the conversation, but the look-up's raw result is never stored.
• Aggregate analytics: refreshed hourly, and dropped once nothing has asked for them in 7 days.
• Configuration and send history: until you delete the app or workspace. Deleting an app deletes its experiments, funnels, cohorts, events and send history with it.
• Waitlist emails: until launch, or sooner if you ask; then deleted unless you sign up.
• Invoices: retained as long as tax law requires, as Romanian tax and accounting law requires.
• Logs: no longer than 30 days.

8. Cookies

Apprvd.app sets strictly necessary cookies: a session cookie so you stay signed in, a short-lived cookie protecting the Google connection flow against cross-site request forgery, and one remembering your answer to the analytics question below.

Only if you accept, apprvd.app and platform.apprvd.app load Google Analytics, which sets _ga cookies to count visits, see which pages and features are used, and measure how fast pages load. Decline and nothing from Google Analytics loads at all. One answer covers both sites; we run no advertising cookies.

9. Your rights

If you are in the EEA or UK you have the right to access, correct, delete, restrict or object to processing of your personal data, and to receive it in a portable format. Where we rely on legitimate interests you may object at any time. Write to support@apprvd.app and we will respond within one month.

For end-user data we hold as a processor, contact the operator of the app instead; we will act on their instruction. You also have the right to complain to your local supervisory authority, in our case the National Supervisory Authority for Personal Data Processing (ANSPDCP) in Romania.

10. Security

Access to production data is limited to people who need it. Credentials are encrypted at rest, traffic is encrypted in transit, and machine endpoints authenticate with signatures or per-source keys rather than session cookies. No system is perfectly secure; if a breach affects your personal data we will notify you and, where required, the supervisory authority, without undue delay and within 72 hours of becoming aware.

11. Automated decision-making

Apprvd.app does not make automated decisions producing legal or similarly significant effects about individuals. The statistics it computes (conversion rates, significance tests, cohort membership) are decision support for you, not decisions about your users.

12. Changes

We will post changes here and update the date above. For material changes affecting your rights we will give notice by email.

13. Children

Apprvd.app is a business tool for people aged 18 or over, and we do not knowingly collect personal information from anyone younger. If we learn that we have, we will delete it as soon as we can. Write to us if you think a child has given us any.

14. Google user data

When you connect a Google account, Apprvd.app asks for the permissions below. It uses them only to show you your own apps’ data and to send the notifications you compose or approve.

• Your Google account email (openid, email): shows which account a project is connected through.
• Firebase projects (firebase.readonly): lists your projects and the apps registered in them, and finds each one’s Google Analytics property.
• Google Analytics (analytics.readonly): reads the aggregate reports described in section 3.
• Firebase Cloud Messaging (firebase.messaging): sends the push notifications you compose or approve.
• Firestore (datastore): reads the device token collection you nominate and, if your server records them, its push counts. Google offers no narrower permission for this. We never write to your Firestore.

We store your Google refresh token encrypted (section 4) and the aggregate analytics answers (section 7). Device tokens are not retained after a send. These aggregates reach the Google Gemini API when you use the assistant, and your own AI tool if you connect one (section 5). We do not sell Google user data, use it for advertising, or use it to train AI models.

Removing a Google connection in Apprvd.app deletes the stored token and revokes the grant at Google, unless another connection still uses that Google account. You can also revoke access at any time from your Google Account’s permissions page. Deleting an app deletes its stored analytics.

Apprvd.app’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

15. Contact

Controller: S.C. LIFESTYLE MOSAIC STUDIOS S.R.L., str. Harmanului, nr. 44, bl. 3, sc. D, ap. 8, Brasov, Romania. Privacy contact: support@apprvd.app.

Business customers who need a signed Data Processing Agreement can request one at the same address.