Terms of service

1. The service

Dropplink gives you branded links, deep links, install and event attribution, website visit tracking and reports, through the dashboard, our SDKs and our APIs (the “service”). We may improve and change the service; we won't remove a core feature you pay for without telling you first.

2. Your account

• You must be a business, or act for one, and be able to enter into this agreement. Dropplink isn't for personal or household use.
• Give us accurate details and keep them up to date.
• Keep passwords, SDK secrets and server keys safe. Server keys belong on your servers only, never in an app or website.
• You're responsible for what your team members and anyone using your keys do in your account. Tell us at once if you think an account or key has been misused.

3. Plans and billing

• Paid plans are billed in advance for each billing period, through our payment provider. Its terms apply to the payment itself.
• Plans renew automatically until you cancel. Cancelling stops the next renewal; you keep access until the end of the period you've paid for.
• Prices exclude taxes, which are added where they apply. Fees already paid aren't refundable, except where the law says otherwise or we say so in writing.
• We may change prices for future periods with at least 30 days' notice. If a payment fails and isn't fixed, we may limit the account after telling you.

4. Acceptable use

You must not use Dropplink to:

• Send us sensitive data in events, properties, user ids or links: health information, financial account or card numbers, government ids (such as Aadhaar, PAN, passport or social security numbers), passwords, precise location, biometric data, or data about children.
• Send plain email addresses or phone numbers anywhere except identify's email and phone fields, which hash them on the device.
• Track people unlawfully, or in a way your own privacy policy doesn't allow.
• Create links for phishing, malware, spam, scams, or content that is illegal or infringes someone's rights.
• Break, overload or probe the service, get around its limits, or access another brand's data.
• Resell the service, or use it to build a competing product, without our written agreement.

5. Your responsibilities for your users' data

You decide what Dropplink collects about the people who use your app and website, and why. You are the controller (data fiduciary) of that data, and we process it for you. So you must:

1. Have a lawful basis for the attribution and tracking you turn on, and collect consent where the law requires it.
2. For visitors and users in the EU and the UK, get consent before Dropplink stores anything on, or reads anything from, their device. The ePrivacy Directive and UK PECR require this for attribution, and the analytics exemptions don't cover it. In practice:
   • On websites, load the script with consent: 'required' (data-consent="required") and call dropplink.grant() only when the visitor accepts in your cookie banner, and dropplink.revoke() if they withdraw.
   • In apps, call initialize only after the user consents. setTrackingEnabled(false) stops events and identify, but install attribution and deep links keep working, so on its own it isn't enough where consent is needed for attribution.
3. Publish a privacy policy that tells your users what is collected, names Dropplink (Dropp) as your provider for attribution and deep links, and links to our privacy policy.
4. Make accurate store disclosures: Google Play's Data safety section and Apple's App Privacy labels, for the SDK features you use.
5. Honour your users' requests (access, deletion, opt-out), using our deletion API or by asking us.
6. Not use Dropplink in apps or websites directed at children under 13 (16 in the EU and UK) with identify turned on, and get any parental consent your local law requires.

6. Our responsibilities

• Provide the service with reasonable skill and care, and keep it secure as described on our security page.
• Use your data and your users' data only to provide the service to you: never for other brands, never to build cross-brand profiles, never to sell it or market to your users.
• Process your users' data only on your instructions, as set out in the DPA.
• Tell you about a breach affecting your data without undue delay and within 48 hours of becoming aware of it.

7. Data processing addendum

Our Data processing addendum (DPA), including its annexes and the Standard Contractual Clauses it incorporates, forms part of these terms and applies whenever we process personal data for you. If the DPA and these terms conflict on personal data, the DPA wins.

8. Your data

You own the data you and your users send to Dropplink. You give us the rights we need to host, process and show it to you to provide the service. We may use aggregated, de-identified measurements of how the service performs (such as request volumes and error rates) to run and improve it, never in a way that identifies you or your users.

9. Suspension

We may disable a link, a key or an account straight away if it's used for phishing, malware, spam or other abuse, if it puts the service or other people at risk, or if the law requires it. We'll tell you why, unless the law or security stops us, and restore it once the problem is fixed. For anything less urgent, we'll give you notice and a chance to fix it first.

10. Ending the agreement

You can close your account at any time. We can end this agreement with 30 days' notice, or at once if you seriously break these terms. When it ends, you can ask us to export your data in the 30 days after, and we then delete it as the DPA sets out.

11. Warranties

Attribution is an estimate: links can be blocked, stores and browsers limit what can be measured, and some matches are probabilistic. We provide the service “as is” and, as far as the law allows, give no other warranties, express or implied.

12. Liability

• Neither of us is liable for indirect or consequential loss, or for lost profits, revenue or data, as far as the law allows.
• Each party's total liability under this agreement is limited to the fees you paid us in the 12 months before the claim.
• These limits don't apply to your payment obligations, to a party's fraud, or to anything the law doesn't allow to be limited.
• You'll cover our costs from claims caused by data you send us in breach of section 4 or 5.

13. Governing law

These terms are governed by the laws of India. Disputes go to the courts at Gurugram, Haryana, India, unless the law of your country gives you a right to go to court there.

14. Changes to these terms

We may update these terms. For a significant change we'll tell you by email or in the dashboard at least 30 days before it takes effect. If you don't agree, you can close your account before then. Questions: [email protected].