Data Processing Agreement

When this applies, and who is who

This agreement applies where you use Traction for business purposes and the data you put in includes personal data protected by the GDPR, the UK GDPR, or a comparable law. It forms part of the Terms of Service; where the two conflict on data protection, this document wins.

You are the controller. You decide what personal data goes into the service and why. We are the processor, acting on your instructions. Where you are yourself processing on behalf of someone else — an agency running a client's app — you are their processor and we are their sub-processor, and you confirm you have the authority to engage us.

If you need this signed as a countersigned document rather than accepted as published terms, email traction at asotraction.com and we'll arrange it.

What we process, and for how long

Subject matter and purpose: providing Traction — App Store and Google Play analysis, metadata and content generation, ad management, and the publishing actions you ask for.

Duration: for as long as your account is open, plus the retention periods in the deletion section below.

Categories of data subject: your team members and any individuals appearing in content you upload or in data we fetch on your instruction — most commonly the authors of App Store and Google Play reviews you ask us to analyse or reply to.

Types of personal data: account details (name, email, password hash, role), usage and audit records, billing identifiers held by our payment processor, credentials you add for your own third-party accounts, and whatever personal data is contained in the app content, screenshots, reviews and drafts you choose to put in.

We ask you not to put special category data — health, biometrics, political or religious views, and the rest of Article 9 — into the service. It isn't designed for it and we don't apply the extra safeguards such data requires.

We only act on your instructions

We process personal data only on your documented instructions. Your use of the product is the instruction: creating a team, connecting App Store Connect, generating copy, publishing metadata, replying to a review. The Terms and this agreement are the rest of it.

If we're ever required by law to process your data some other way, we'll tell you first unless the law forbids it.

We will tell you if, in our opinion, an instruction you give us would breach data protection law.

Everyone with access to your data is bound by confidentiality obligations that survive the end of their engagement.

How your data is protected

Described plainly, because a list of controls that isn't true is worse than a short one that is.

In transit: all traffic is served over TLS through Cloudflare, which also provides DDoS and abuse protection.

Credentials at rest: App Store Connect keys, Google Play service accounts, Apple Search Ads credentials, social tokens and two-factor secrets are encrypted with a key held outside the database, so a copy of the database alone does not surrender them. Passwords are stored only as hashes.

Access control: every team member holds a role, and every action is checked against a read / write / publish / admin permission ladder before it runs. The routes that can act outside the product — pushing to App Store Connect or Google Play, changing an ad budget, posting to a social account — sit behind the publish level specifically. Actions are recorded in an audit log the team owner can read.

Backups: taken nightly, verified on write, and copied to encrypted offsite storage using a key we hold rather than one held by the storage provider.

Diagnostics: error reports are stripped of passwords, tokens, keys, cookies and request bodies before they leave our systems.

Staffing: Bytefig LLC is a small company and administrative access to production is limited to the people who operate it. Infrastructure is company-controlled rather than run from a third-party managed platform, and physical access is limited to those same people.

We keep these measures under review, and may change them as long as the level of protection isn't reduced.

Sub-processors

You give us general authorisation to use the sub-processors listed on our Sub-processors page, each of which is bound by data protection terms no weaker than these. We remain responsible to you for what they do.

Before adding or replacing one, we'll update that page and notify customers who have asked to be told. You have 30 days to object on reasonable data protection grounds; if we can't resolve the objection, you may terminate the affected part of the service and receive a refund of any prepaid, unused fees.

Third-party services you connect yourself — App Store Connect, Google Play Console, Apple Search Ads, RevenueCat, Mixpanel, Google Analytics, Instagram, TikTok — are not our sub-processors. We call them with your credentials, at your instruction, and your relationship with them is your own.

Where your data goes

Bytefig LLC is established in the State of Texas, United States and personal data is processed in the United States. Some sub-processors process data elsewhere.

Where data is transferred out of the EEA, the UK or Switzerland to a country without an adequacy decision, the transfer relies on the European Commission's Standard Contractual Clauses (Module Two, controller to processor), together with the UK International Data Transfer Addendum or the Swiss amendments as applicable. Those clauses are incorporated into this agreement by reference and prevail over it if they conflict.

Helping you meet your own obligations

Requests from individuals. The product lets you read, correct, export and delete the data in your account directly, which will answer most access, rectification, portability and erasure requests without us. Where it doesn't, we'll help — email traction at asotraction.com. If someone contacts us directly about data you control, we won't respond to them on the substance; we'll refer them to you and tell you.

Breaches. If we become aware of a personal data breach affecting your data, we'll notify you without undue delay, with what we know about what happened, who and what is affected, the likely consequences and what we're doing about it — and follow up as we learn more. Reporting to a supervisory authority within 72 hours is your obligation as controller; our job is to get you the facts in time to meet it.

Impact assessments. We'll give you the information you reasonably need for a DPIA or a prior consultation, to the extent it concerns our processing and isn't available to you already.

Deletion and return

You can export your data at any time while your account is open. Do that before you close it.

On termination, or on your written request, we delete your personal data within 30 days, except where law requires us to keep something — invoices and tax records, most obviously, which our payment processor retains under its own obligations.

One honest caveat about backups. Deleting data from the live service does not reach into backups already taken. Those are retained on a rolling window of up to 30 days and are then destroyed, so deleted data can persist in encrypted backup storage for that period. During it, the data stays encrypted, isn't used for anything, and is only ever restored as a whole system in a disaster. Most vendors' agreements are silent on this; it's stated here because it's true and it affects how you answer an erasure request.

Showing our work

We'll make available the information reasonably needed to show we meet these obligations, and will contribute to audits carried out by you or an auditor you appoint.

In practice, please start by asking us — a written response, our current sub-processor list and a description of our measures will resolve nearly everything. An on-site audit is available where a supervisory authority requires one or following a breach affecting your data: at most once a year, on 30 days' notice, during business hours, under confidentiality, and without access to other customers' data.

Liability and changes

Each party's liability under this agreement is subject to the limitations and exclusions in the Terms of Service. Nothing here limits a data subject's rights, or either party's liability to a supervisory authority.

If data protection law changes in a way that makes these terms insufficient, both parties will make the amendments needed to comply. We'll post material changes here with an updated date, and tell customers who've asked to be notified.

Questions, signature requests and privacy correspondence: traction at asotraction.com.