Last updated: October 31, 2026
1. PARTIES
This Data Processing Agreement (the "Agreement") is entered into between:
The Data Controller ("you", "your"): The legal entity owning the application using iaptic services.
The Data Processor ("we", "our", "us"): Iaptic SAS, a company registered in France under SIRET number 88837387500010, with its registered office at 128 rue La Boétie, 75008 Paris, France.
2. DEFINITIONS
In this Agreement, unless the context requires otherwise:
- "Service" means the iaptic.com platform and associated services.
- "Personal Data" means any information relating to an identified or identifiable natural person.
- "End User" means any user of the Data Controller's application.
- "GDPR" means the General Data Protection Regulation (EU) 2016/679.
3. PURPOSE OF PROCESSING
The purpose of data processing under this Agreement is strictly limited to the operation of the Service, specifically for:
- (a) validating in-app purchases;
- (b) managing subscriptions;
- (c) analyzing transaction statistics; and
- (d) providing technical support.
The categories of data processed include information about the initial download of your application, transaction states, device information, and request logs. The exact scope of processing depends on your specific requirements as the Data Controller.
4. DATA LOCATION AND SUB-PROCESSORS
Where data is stored
Personal data is stored and processed on servers located in Germany, in data centers operated by Hetzner, within the European Union.
Sub-processors
We engage the following sub-processors:
| Sub-processor | Established in | Purpose |
|---|---|---|
| Fovea — Souad El Merhebi (sole proprietorship, reg. no. 3003139) | Lebanon | Technical operation |
| Hetzner Online GmbH | Germany | Hosting and infrastructure |
| Apple Distribution International Ltd. | Ireland | iOS and macOS purchase validation |
| Google Ireland Limited | Ireland | Android purchase validation |
| Microsoft Ireland Operations Limited | Ireland | Windows purchase validation |
| Stripe Payments Europe, Limited | Ireland | Payment processing |
| Cloudflare, Inc. | United States | Communications protection |
| Functional Software, Inc. (Sentry) | United States | Service monitoring and error reporting |
| Mailgun Technologies, Inc. | United States | Transactional email |
| Groq, Inc. | United States | AI-assisted insights (team plans) |
Transfers outside the European Union
Personal data is stored on our infrastructure in Germany. Some of our sub-processors nevertheless access or process personal data from outside the European Union. Where personal data is transferred outside the EU, we rely on an adequacy decision of the European Commission or on appropriate safeguards under Article 46 GDPR, as set out below.
Fovea (Lebanon). Fovea's staff access our systems from Lebanon in order to operate the Service. Lebanon does not benefit from an adequacy decision under Article 45 GDPR, so this access constitutes a transfer within the meaning of Chapter V GDPR. It is governed by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, concluded between Iaptic SAS and Fovea. Which module of those clauses applies depends on Iaptic's role for the data concerned: controller for its own billing data, your processor for your end users' data. Personal data remains stored on our infrastructure in the European Union, and Fovea does not retain copies of customer or end-user data beyond what is strictly necessary for the operation of the Service.
United States. Sentry processes error and diagnostic information, which may include request metadata, in the United States. Cloudflare protects communications with the Service, and Mailgun delivers transactional email through its European Union region; both are established in the United States. Stripe, contracted through Stripe Payments Europe, Limited (Ireland), may transfer personal data to Stripe, LLC in the United States. Groq processes personal data in the United States to generate AI-assisted insights when that feature is used. For each of these providers, transfers rely on the EU-U.S. Data Privacy Framework and/or the Standard Contractual Clauses.
European Union. Apple, Google, Microsoft, Hetzner and Stripe Payments Europe, Limited are contracted through their European establishments and process personal data primarily within the European Union under our instructions. Where these providers transfer personal data onward to other countries, those transfers are covered by their own safeguards, such as their EU-U.S. Data Privacy Framework certifications or the Standard Contractual Clauses.
Changes to sub-processors
This list is the authoritative record of our sub-processors. We will update this page before engaging a new sub-processor that processes customer data, and will notify customers by email at least thirty (30) days before the change takes effect. You have the right to object to such a change on reasonable data-protection grounds.
5. SECURITY MEASURES
We implement and maintain appropriate technical and organizational security measures, including:
Access Control: System administrator access is strictly limited, following the principle of least privilege. Administrators connect over SSH with key-based authentication; password logins are disabled. Databases are only reachable from our private network.
Encryption: The Service is available over TLS (HTTPS), and our SDKs use it by default. Account passwords are stored as salted bcrypt hashes.
Redundancy: Data is duplicated across multiple data centers to ensure data integrity and availability. Account and configuration data are also backed up weekly to separate backup storage, with backup history retained for two weeks.
6. DATA RETENTION
We retain active data for the duration of our contractual relationship. Accounts inactive for more than two years will be automatically flagged for deletion. Following service termination, we retain data for 90 days to allow for data export requests, after which all personal data is either deleted or anonymized in compliance with GDPR requirements.
7. DATA SUBJECT RIGHTS
We acknowledge that End Users have specific rights under the GDPR, including access, rectification, erasure, and data portability. As the Data Processor, we will assist you in fulfilling these rights by providing necessary technical measures. All requests from End Users should be directed through you as the Data Controller, and we will respond to your requests within 30 days.
8. DATA BREACH NOTIFICATION
In the event of a personal data breach, we will notify you without undue delay and within 48 hours of becoming aware of the breach. Notification will be sent via secure email and will include:
- The nature of the breach
- The likely consequences
- The measures taken or proposed to address the breach We will fully cooperate in any investigation and remediation efforts.
9. CONFIDENTIALITY
Persons authorised to process personal data on our behalf are bound by confidentiality obligations.
10. AUDIT AND COMPLIANCE
You have the right to audit our compliance with this Agreement once per year, subject to reasonable notice and at your expense. We will provide the technical documentation needed to demonstrate our compliance.
11. TERMINATION
Upon termination of services, we will:
- Provide a mechanism for data export
- Issue a verifiable deletion certificate
- Maintain confidentiality obligations
- Retain only data required by law
12. LIABILITY
Our liability under this Agreement is subject to the limitations set forth in our Terms and Conditions. We maintain professional liability and cyber-risk insurance coverage appropriate to the services we provide.
13. FINAL PROVISIONS
This Agreement is governed by French law and subject to the exclusive jurisdiction of the Paris courts. Any modifications to this Agreement require mutual written consent and version control.
14. CONTACT INFORMATION
For data protection matters:
Data Protection Officer
Email: [email protected]
Address: 128 rue La Boétie, 75008 Paris, France
For technical support:
Email: [email protected]