Privacy Policy

1. Overview

This policy explains how Lemmonite LLC ("Adback", "we") collects, uses, and shares information when you use our website, dashboard, APIs, and SDKs (the "Service"). Adback is designed to work without device advertising identifiers (no IDFA), cross-app identifiers, or an ATT prompt.

For the personal data of your own app's end users that you process through Adback, you are the data controller and Adback acts as your processor. For account holders and website visitors, Adback is the controller.

2. Information we collect

Account and billing data

Name, work email, company, account settings, and support correspondence. Payment details are collected and processed by Stripe, our payment processor — we do not store full card numbers.

Measurement and attribution data

To attribute installs and events, we process app and campaign context and first-party signals derived from your own app and ad accounts. We do not collect IDFA, GAID/AAID, Android ID, OAID, IMEI/MEID, MAC address, installed-app lists, or precise location. Signal links can capture advertising click IDs from the network URL. We store the raw client IP address and a coarse network prefix for new click and install records to support matching and attribution debugging. We keep raw IP values out of logs, metrics, event snapshots, and remote errors.

Revenue data

Subscription and purchase events you connect from sources such as RevenueCat and Superwall, used to join revenue to campaigns.

Website and product usage

Standard log data and basic analytics needed to operate, secure, and improve the Service.

3. How we use information

• To provide, operate, and secure the Service.
• To attribute installs and events and compute measurement and reporting.
• To forward privacy-safe conversion signals to advertising networks you connect, according to the rules you configure.
• To process payments, provide support, and communicate about your account.
• To comply with legal obligations and enforce our terms.

4. Signals we forward to advertising networks

A core function of Adback is forwarding conversion signals to supported networks through their official server-side APIs. TikTok is the supported postback network today. You control the connected destination and event mapping. Each network processes the data under its own terms and privacy policy. You are responsible for ensuring you have a lawful basis and any required end-user disclosures/consents for this forwarding.

5. Sub-processors we rely on

We use trusted third parties to run the Service. Core customer-data providers include Hetzner for hosting, Cloudflare for edge link delivery and queues, and Sentry for error monitoring. Clerk provides account authentication, Stripe processes billing, and Resend delivers account email. See our DPA, or request the current list at [email protected].

6. Retention

We keep personal data only as long as needed for the purposes above or as required by law. Retention depends on the data type, account settings, contractual duties, and debugging needs. Account and billing records remain as needed for legal and accounting purposes.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing (GDPR, UK GDPR, CCPA/CPRA, and similar laws). To exercise these rights, contact us at [email protected]. If Adback processes data on your behalf as a processor, we will help you respond to your own users' requests. You may also lodge a complaint with your local data protection authority.

8. International transfers

We may process data in countries other than your own. Where we do, we use appropriate safeguards (such as standard contractual clauses) as required by law.

8A. GDPR information

See our GDPR Compliance page for role, rights, security, and transfer details. Our DPA contains the processor terms for customer end-user data.

9. Security

We use technical and organisational measures to protect personal data, including encryption of sensitive credentials, access controls, and tenant isolation. No system is perfectly secure, but we work to protect your data and respond promptly to incidents.

10. Children

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from children.

11. Changes

We may update this policy. Material changes will be reflected by updating the date above and, where appropriate, by notifying you.

12. Contact

For privacy questions or requests, email [email protected].