Privacy Policy Template for Mobile Apps

In this Policy, the following capitalized terms shall have the meanings set out below, and shall apply whether used in the singular or the plural.

"Applicable Law" means all laws, regulations, binding codes and mandatory requirements of any competent authority in [Jurisdiction] or elsewhere that apply to the processing of Personal Data by the Company, as amended from time to time.

"Personal Data" means any information relating to an identified or identifiable natural person, including any information that can be used, directly or indirectly, alone or in combination with other information, to identify, locate or contact that person, or that is otherwise treated as personal information under Applicable Law.

"Device" means any smartphone, tablet, wearable or other electronic equipment on which the Application is installed or through which the Application is accessed.

"Device Data" means technical and operational information relating to a Device and its interaction with the Application, including Device model, operating system and version, unique identifiers, language settings, network information, and Application version.

"Location Data" means information that identifies or approximates the geographic position of a Device, whether derived from satellite positioning, wireless network data, cellular tower data, Internet Protocol address or other signals.

"Advertising Identifier" means a resettable, non-permanent identifier assigned to a Device by its operating system or platform provider and used for advertising, measurement and related purposes.

"Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, storage, adaptation, retrieval, use, disclosure, transfer, restriction, erasure and destruction.

"Service Provider" means any third party engaged by the Company to process Personal Data on its behalf or to supply services in support of the Application, including hosting, analytics, payment processing, customer support, advertising and communications providers.

"Platform Provider" means the operator of the application store or operating system through which the Application is distributed or on which it runs, being [Platform Provider Names].

"Account" means the registered User profile created to access features of the Application, together with all associated data and settings.

This Policy shall be interpreted in accordance with its plain meaning. Headings are for convenience only and do not affect interpretation. The words "including" and "includes" shall be read without limitation. References to legislation or regulatory requirements include them as amended or replaced.

This Policy applies to all Personal Data processed by the Company through or in connection with the Application, including data collected when you install the Application, create an Account, use its features, make purchases, contact customer support or otherwise interact with the Company through the Application.

This Policy does not apply to websites, applications, products or services operated by third parties, including Platform Providers, advertisers, social networks or other services that may be linked to or accessible through the Application. Such third parties process Personal Data under their own privacy policies, and the Company is not responsible for their practices. You are encouraged to review those policies before providing information to them.

The Company's processing of Personal Data relating to its own employees, contractors, job applicants and business-to-business contacts, and Personal Data collected through channels other than the Application, is governed by separate notices, except to the extent expressly stated in this Policy.

Where the Company processes Personal Data on behalf of another business in connection with the Application, that processing shall be governed by the relevant agreement with that business, and this Policy shall apply only to the extent the Company acts as controller.

The Application may be subject to additional terms, including [Terms of Use or End User License Agreement Name]. In the event of a conflict regarding the handling of Personal Data, this Policy shall prevail to the extent permitted by Applicable Law.

The Application is intended for use in [Permitted Territories]. If you access the Application from outside those territories, you do so on your own initiative and are responsible for compliance with local laws, and you acknowledge that your Personal Data may be processed as described in this Policy.

The Company collects Personal Data directly from you, automatically through your use of the Application, and from third parties. The categories of Personal Data processed depend on the features you use and the permissions you grant.

Information you provide directly includes: identification and contact details such as your name, username, email address, telephone number and postal address; Account credentials; profile information such as date of birth, photograph and preferences; content you submit through the Application; and communications you send to the Company, including support requests, feedback and survey responses.

Information collected automatically includes: Device Data; Internet Protocol address; log data such as access times, pages or screens viewed, features used and referring sources; session and usage information; and information collected through cookies, software development kits and similar technologies.

Information relating to transactions includes: purchase history, subscription status, product identifiers, transaction dates and amounts, and limited payment-related information provided to the Company by Platform Providers or payment processors, as further described in this Policy.

Information obtained from third parties may include: information from Platform Providers, authentication or social login providers if you elect to use them, advertising and analytics partners, fraud-prevention services and publicly available sources, in each case to the extent permitted by Applicable Law and the relevant third party's terms.

Unless the Application expressly requests it and a lawful basis exists, the Company does not intentionally collect special categories of Personal Data, such as information revealing health, racial or ethnic origin, religious belief, biometric identifiers used for identification, or sexual orientation. If the Application offers features requiring such data, the Company will provide a supplemental notice and, where required, obtain your explicit consent. [Description of any sensitive data features, if applicable].

Where the Company derives inferences, segments or profiles from the Personal Data described above, such derived data shall also constitute Personal Data and shall be handled in accordance with this Policy.

The Application may request access to certain functions, sensors and data on your Device. Access is controlled through the permission settings of your Device's operating system, and the Company will request such permissions only when relevant to a feature of the Application.

Permissions that the Application may request include, depending on the Device and the features offered: [camera]; [microphone]; [photo library or media storage]; [contacts]; [calendar]; [push notifications]; [Bluetooth and nearby devices]; [network state and connectivity]; and [other permissions]. The purpose of each permission shall be presented to you at the time of the request or in the Application's settings.

Granting a permission is generally optional. However, if you decline or later revoke a permission, certain features of the Application may be unavailable, may function with reduced capability, or may not function at all, and the Company shall have no liability for any resulting limitation.

You may grant, review or withdraw permissions at any time through your Device settings. Withdrawal of a permission will not affect the lawfulness of Processing carried out prior to withdrawal. Uninstalling the Application will stop further collection of Device Data through the Application, but will not by itself delete data already held by the Company.

The Company accesses data stored on your Device, such as photographs or contacts, only to the extent necessary to provide the feature you have requested and, unless otherwise stated in the Application at the time of access, does not retain such data after the feature has been performed.

The Company implements technical measures designed to restrict the Application's access to Device resources to those that are necessary. You acknowledge that modifying the operating system of your Device in an unauthorized manner, including by rooting or jailbreaking, may compromise these access controls and security, and the Company shall not be responsible for resulting risks to the fullest extent permitted by Applicable Law.

The Application may collect Location Data where location-based features are enabled. Location Data may be collected as precise location, derived from satellite positioning and wireless signals, or as approximate location, derived from your Internet Protocol address or network information.

The Company collects precise Location Data only where you have granted the relevant permission through your Device. Depending on the feature, collection may occur only while the Application is in use or, where expressly disclosed and permitted by you, also while the Application operates in the background.

The Company uses Location Data to provide and personalize location-dependent features, display nearby content or services, enable security and fraud prevention, comply with regional restrictions, perform analytics, and, where you have agreed, deliver location-based communications or advertising. [Additional location-based purposes].

Location Data may be disclosed to Service Providers acting on the Company's behalf, such as mapping, hosting and analytics providers, and, where you have consented or Applicable Law permits, to advertising partners. The Company does not sell precise Location Data, except as expressly disclosed to you and permitted by Applicable Law.

You may disable location services at any time through your Device settings or, where available, through the Application's settings. Disabling location services may prevent you from using certain features. Approximate location may still be derived from your Internet Protocol address for security, compliance and service delivery.

Location Data is retained for the period specified in the section of this Policy governing retention, or for [Location Data Retention Period], whichever is shorter, unless a longer period is required by Applicable Law or necessary for the establishment, exercise or defense of legal claims. Where practicable, Location Data is aggregated, truncated or anonymized after that period.

The Company uses analytics, diagnostic and crash reporting tools, including tools provided by third parties, to understand how the Application is used, to measure performance, to identify and correct errors, and to improve the Application and its security.

Such tools may collect Device Data, Application version, interaction events, screen views, session duration, feature usage, performance metrics, memory and battery state, network conditions, Advertising Identifiers and pseudonymous User identifiers.

When the Application experiences a crash, error or unexpected termination, a crash report may be generated and transmitted to the Company or its Service Providers. A crash report may contain stack traces, the state of the Application at the time of failure, Device Data and, in limited cases, identifiers that permit association with your Account. The Company does not intentionally include content of your communications in such reports.

The Company's analytics Service Providers may process data solely on the Company's instructions and in accordance with their contractual obligations, except where a Service Provider acts as an independent controller as disclosed in its own privacy policy. The current analytics and crash reporting providers are [Analytics and Crash Reporting Providers].

Where Applicable Law requires, the Company will obtain your consent before enabling analytics that are not strictly necessary for the operation of the Application, and will provide a means of withdrawing that consent through the Application settings or your Device settings, as available.

The Company aggregates or de-identifies analytics data wherever practicable. De-identified or aggregated data that cannot reasonably be used to identify you is not Personal Data, and the Company may use and disclose it for any lawful business purpose, provided that it does not attempt to re-identify such data.

The Application may offer digital goods, subscriptions, premium features or other items for purchase within the Application ("In-App Purchases"). In-App Purchases are generally processed by the relevant Platform Provider or a third-party payment processor, and not directly by the Company.

The Company does not ordinarily receive or store your full payment card number, bank account number, security code or equivalent payment credentials. Such details are collected and processed by the Platform Provider or payment processor under its own terms and privacy policy, which you should review before completing a purchase.

The Company receives and processes limited transaction data in connection with In-App Purchases, including a transaction identifier, product or subscription purchased, price, [currency], date and time, subscription status and renewal or cancellation information, a User or Account identifier, and, where applicable, indications of payment success, failure, refund or chargeback.

The Company uses transaction data to fulfill and verify purchases, activate entitlements, manage subscriptions, provide customer support, process refunds where applicable, prevent fraud and abuse, maintain accounting and tax records, comply with legal obligations, and analyze purchasing patterns.

Where the Company processes payments directly or through a payment processor engaged by it, such processor may collect payment credentials and billing details as a Service Provider or independent controller, as disclosed at the point of payment. [Name of Payment Processor].

Transaction records are retained for the period required by Applicable Law relating to accounting, tax, consumer protection and dispute resolution, being not less than [Transaction Record Retention Period], notwithstanding any deletion of your Account.

Refund, cancellation and billing matters are governed by the terms of the relevant Platform Provider and by [Terms of Use or End User License Agreement Name], and requests relating thereto may need to be directed to the Platform Provider.

The Application and its Service Providers may use Advertising Identifiers, cookies, software development kits, pixels, tags, device fingerprinting signals and similar technologies (together, "Tracking Technologies") to recognize your Device, measure Application performance and deliver, measure and personalize advertising.

The Company may display advertising within the Application, and may permit third-party advertising partners to collect or receive Advertising Identifiers, Device Data, Location Data, usage information and inferences in order to deliver interest-based advertising, which means advertising selected on the basis of your activity across the Application and, where applicable, across other applications and services over time.

The Company may also share certain data with advertising and attribution partners to measure the effectiveness of advertising campaigns, determine whether an installation or purchase resulted from an advertisement, and prevent advertising fraud. The principal advertising and attribution partners are [Advertising and Attribution Partners].

You may limit interest-based advertising by resetting or disabling the Advertising Identifier through your Device settings, by declining tracking requests presented by the operating system, or by using the preference controls offered in the Application, where available. Where Applicable Law requires consent for such Tracking Technologies, the Company will obtain it before activating them.

Opting out of interest-based advertising will not eliminate advertising from the Application, but advertisements displayed may be less relevant to you. Because the Company does not control third-party technologies, certain third parties may continue to collect data in accordance with their own policies.

The Company does not respond to browser-based "do not track" signals where such signals are not supported by the Application, except to the extent required by Applicable Law. The Company does not knowingly use Tracking Technologies to serve interest-based advertising to Users identified as children.

The Company processes Personal Data only where it has a valid legal basis under Applicable Law. The principal purposes of Processing, and the corresponding legal bases, are described in this section.

Performance of a contract: the Company processes Personal Data to create and administer your Account, provide the Application and its features, process In-App Purchases, deliver requested services, provide customer support and communicate with you regarding your use of the Application.

Legitimate interests: the Company processes Personal Data to maintain and improve the Application, conduct analytics and diagnostics, ensure security, detect and prevent fraud and misuse, enforce its terms, conduct business planning, and, where permitted, market its own products and services, in each case where such interests are not overridden by your rights and interests.

Consent: where required by Applicable Law, the Company processes Personal Data on the basis of your consent, including for certain permissions, precise Location Data, non-essential Tracking Technologies, interest-based advertising and marketing communications. You may withdraw consent at any time, without affecting the lawfulness of Processing based on consent before its withdrawal.

Legal obligation: the Company processes Personal Data to comply with Applicable Law, including accounting, tax, regulatory, law enforcement and court requirements, and to respond to lawful requests from public authorities.

Establishment, exercise or defense of legal claims, and protection of vital interests: the Company may process Personal Data where necessary to protect its rights, property or safety, or those of Users or others, and to establish, exercise or defend legal claims.

Where a legal basis is described using terminology that differs from Applicable Law, the Company shall rely on the closest equivalent basis recognized under Applicable Law. Where you are required to provide Personal Data to use certain features, failure to provide it may prevent the Company from providing those features.

The Company does not disclose Personal Data to third parties except as described in this Policy, as permitted by Applicable Law, or with your consent.

Service Providers: the Company discloses Personal Data to Service Providers that perform functions on its behalf, including hosting and cloud infrastructure, analytics and crash reporting, payment processing, customer support, communications, security and fraud prevention, and advertising services. Such Service Providers are authorized to use Personal Data only as necessary to perform their services and are required to implement appropriate confidentiality and security obligations.

Platform Providers and advertising partners: Personal Data may be made available to Platform Providers in connection with distribution and purchases, and to advertising and attribution partners as described in this Policy.

Corporate transactions: if the Company is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets or similar transaction, Personal Data may be disclosed or transferred to the counterparties and advisers involved and to the successor entity, which shall be entitled to use it in accordance with this Policy or as notified to you.

Affiliates: the Company may disclose Personal Data to its affiliated entities, [Affiliate Names], for purposes consistent with this Policy.

Legal and protective disclosures: the Company may disclose Personal Data where it believes in good faith that disclosure is required by Applicable Law, legal process or a governmental request, or is necessary to enforce its agreements, protect the rights, property or safety of the Company, Users or the public, or investigate fraud or security matters.

With your direction: the Company may disclose Personal Data to other third parties where you direct or consent to such disclosure, including where you choose to share content or use integrated third-party features.

The Company may disclose aggregated or de-identified data to third parties without restriction. The Company does not sell Personal Data for monetary consideration, except as expressly disclosed in this Policy or as otherwise notified to you in accordance with Applicable Law.

The Company and its Service Providers may process and store Personal Data in countries other than the country in which you reside, including [Countries or Regions of Transfer], where data protection laws may differ from, and may offer a lower level of protection than, those of your place of residence.

Where Applicable Law restricts the transfer of Personal Data across borders, the Company shall transfer Personal Data only where a lawful transfer mechanism is in place, which may include a determination of adequate protection, standard contractual terms approved or recognized by a competent authority, binding corporate rules, your explicit consent, or another mechanism recognized by Applicable Law.

The Company requires recipients of transferred Personal Data to provide a level of protection consistent with this Policy and Applicable Law, including through contractual commitments and appropriate technical and organizational measures.

By using the Application, and to the extent permitted by Applicable Law, you acknowledge that your Personal Data may be transferred to and processed in jurisdictions outside your country of residence as described in this Policy, and, where required, you consent to such transfer after having been informed of the associated risks.

Government authorities, courts and law enforcement agencies in jurisdictions to which Personal Data is transferred may be entitled to access such data under local laws. The Company shall challenge or limit such access only to the extent required by Applicable Law and reasonably practicable.

You may obtain further information regarding the transfer mechanisms relied upon by the Company by contacting the Company at [Privacy Contact Email].

The Company retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting or reporting requirements, resolve disputes, enforce its agreements and protect the security of the Application, unless a longer retention period is required or permitted by Applicable Law.

Unless otherwise stated in this Policy, Account Personal Data is retained for the duration of your Account and for a period of [Post-Account Retention Period] following its closure or deletion. Other categories of Personal Data are retained for the periods set out in the following: Device Data and analytics data for [Analytics Retention Period]; crash reports for [Crash Report Retention Period]; and customer support records for [Support Records Retention Period].

You may request deletion of your Account at any time through [In-App Account Deletion Path], or by submitting a request to [Account Deletion Contact Email]. The Company may require verification of your identity before processing a request, and may require you to authenticate through the Account concerned.

Upon verification of a deletion request, the Company shall delete or de-identify Personal Data associated with the Account within [Deletion Period], subject to the exceptions in this section. Deletion of an Account is irreversible. You will lose access to all content, entitlements, subscriptions and In-App Purchases linked to the Account, and the Company shall have no obligation to restore them or to refund amounts paid, except as required by Applicable Law.

The Company may retain certain Personal Data after Account deletion where necessary to comply with legal obligations, maintain transaction and tax records, prevent fraud, resolve disputes, enforce its terms, or establish, exercise or defend legal claims. Such data shall be restricted to those purposes and deleted when no longer required.

Deleting the Application from your Device or terminating a subscription with a Platform Provider does not delete your Account or Personal Data held by the Company. Backup copies may persist for a limited period in the ordinary course of operations before being overwritten, and shall remain protected during such period.

Data held by third parties, including Platform Providers and independent controllers, is subject to their retention policies, and you should contact them directly regarding deletion.

The Company implements and maintains technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, taking into account the nature of the data, the risks of Processing and the state of the art.

Such measures include, as appropriate: encryption of data in transit and, where appropriate, at rest; access controls based on the principle of least privilege; authentication safeguards; network and application security monitoring; logging; vulnerability management; secure development practices; personnel confidentiality obligations and training; and business continuity and recovery procedures. [Additional Security Measures or Certifications].

The Company requires Service Providers to implement security measures appropriate to the risk and to process Personal Data only in accordance with the Company's documented instructions and contractual commitments.

You are responsible for maintaining the confidentiality of your Account credentials and for the security of your Device, including by using strong credentials, keeping Device software updated and not sharing access. You must notify the Company promptly at [Security Contact Email] if you suspect unauthorized access to your Account.

No method of transmission over the internet or method of electronic storage is completely secure. Accordingly, while the Company strives to protect Personal Data, it cannot guarantee absolute security, and, to the fullest extent permitted by Applicable Law, the Company disclaims liability for unauthorized access resulting from circumstances beyond its reasonable control.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, the Company shall notify affected Users and competent authorities where and to the extent required by Applicable Law, and within the time limits prescribed thereby.

The Application is not directed to children, and the Company does not knowingly collect Personal Data from children. For the purposes of this Policy, a "child" means any individual below the minimum age at which they may lawfully consent to the processing of their Personal Data or enter into a binding agreement for online services under Applicable Law, being [Minimum Age] years of age or such other age as Applicable Law prescribes.

By creating an Account or using the Application, you represent and warrant that you are at least the minimum age required to do so, or that you have obtained the verifiable consent of a parent or legal guardian where Applicable Law permits use by minors with such consent.

If the Company becomes aware that it has collected Personal Data from a child without the required verifiable parental or guardian consent, it shall take reasonable steps to delete such data and, where appropriate, terminate the associated Account as promptly as practicable.

The Company does not knowingly serve interest-based advertising to children, does not knowingly sell or share the Personal Data of children for advertising purposes, and does not knowingly permit children to make In-App Purchases without the authorization of a parent or guardian.

Parents and legal guardians who believe that a child has provided Personal Data to the Company may contact the Company at [Children's Privacy Contact Email] to request access to, correction of or deletion of such data. The Company may require reasonable verification of the requester's identity and authority.

Parents and guardians are encouraged to use parental controls provided by Device manufacturers and Platform Providers to restrict downloads, purchases, permissions and tracking by children.

Subject to Applicable Law and to the conditions and exceptions it provides, you may have certain rights regarding your Personal Data, which may include: the right to be informed about Processing; the right of access to the Personal Data we hold about you; the right to rectification of inaccurate or incomplete data; the right to erasure; the right to restrict or object to Processing; the right to data portability; the right to withdraw consent; the right to opt out of certain disclosures, targeted advertising or sales of Personal Data; and the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

You may exercise these rights by submitting a request through [In-App Privacy Request Path] or by contacting the Company at [Privacy Contact Email] or [Postal Address for Privacy Inquiries]. Requests should contain sufficient information to allow the Company to identify you and understand the request.

The Company may need to verify your identity before responding, and may request additional information for that purpose. Where a request is made through an authorized agent, the Company may require proof of authorization and may verify your identity directly. The Company may decline requests that it cannot verify.

The Company shall respond to valid requests within [Response Period] of receipt, or within the period prescribed by Applicable Law, whichever is shorter. That period may be extended where permitted by Applicable Law, in which case the Company shall inform you of the extension and the reasons for it.

The Company may refuse or limit a request, in whole or in part, where permitted by Applicable Law, including where the request is manifestly unfounded, excessive or repetitive, where compliance would adversely affect the rights of others, reveal confidential or privileged information, or where the Company is required or permitted to retain the data. The Company shall provide the reasons for any refusal where required.

The Company shall not discriminate against you for exercising your rights. Exercising certain rights, such as erasure or objection, may limit or prevent your use of the Application. The Company may charge a reasonable fee, or refuse to act, only where Applicable Law permits, including for manifestly unfounded or excessive requests, and the fee shall be [Fee Amount, if any].

If you are dissatisfied with the Company's response, you may lodge a complaint with the competent supervisory or data protection authority in [Jurisdiction]. The Company encourages you to contact it first so that it may seek to resolve your concern.

This Policy, and any dispute, claim or controversy arising out of or relating to it or to the Processing of Personal Data by the Company, whether contractual or non-contractual, shall be governed by and construed in accordance with the laws of [Governing Law Jurisdiction], without regard to its conflict of laws principles.

The Parties shall first attempt in good faith to resolve any dispute informally. You agree to give written notice of the dispute to the Company at [Notice Address or Email], describing the nature of the claim and the relief sought, and the Company and you shall negotiate for a period of [Informal Negotiation Period] following receipt of such notice before commencing formal proceedings.

Subject to the following clause and to any mandatory provision of Applicable Law, any dispute not resolved informally shall be finally resolved by [binding arbitration administered by [Arbitration Institution] in accordance with its rules / the courts of [Court Jurisdiction]], with the seat or venue in [City], and the language of the proceedings shall be English. The number of arbitrators, where applicable, shall be [Number of Arbitrators].

To the extent permitted by Applicable Law, you agree that disputes shall be resolved only on an individual basis, and not as a plaintiff or class member in any purported class, collective, consolidated or representative proceeding.

Nothing in this Policy shall limit any rights you may have under Applicable Law that cannot be waived by agreement, including the right to lodge a complaint with a competent supervisory authority or to bring proceedings before a court where mandatory consumer protection law grants you that right.

Any claim arising out of or relating to this Policy must be commenced within [Limitation Period] after the cause of action arose, to the extent permitted by Applicable Law, failing which it shall be permanently barred.

To the maximum extent permitted by Applicable Law, the Company's aggregate liability arising out of or relating to this Policy shall be limited as set out in [Terms of Use or End User License Agreement Name], and nothing in this Policy excludes liability that cannot lawfully be excluded.

If any provision of this Policy is held invalid or unenforceable, that provision shall be limited or severed to the minimum extent necessary, and the remaining provisions shall continue in full force and effect.

The Company may amend, update or replace this Policy from time to time in order to reflect changes in its practices, the Application, technology, Applicable Law or business operations. The amended Policy shall take effect on the date stated in it or, if no date is stated, on the date of its publication.

The Company shall publish the updated Policy within the Application and at [Policy URL], and shall revise the "Last Updated" date at the beginning of this Policy.

Where an amendment is material, including any change that expands the categories of Personal Data collected, the purposes of Processing or the categories of recipients in a manner adverse to you, the Company shall provide notice by [in-Application notice, email or push notification] not less than [Notice Period] before the amendment takes effect, unless a shorter period is required by law or necessary for legal or security reasons.

Where Applicable Law requires your consent to a material change, the Company shall seek such consent before applying the change to Personal Data already collected.

Your continued use of the Application after the effective date of an amended Policy constitutes your acknowledgment of and, to the extent permitted by Applicable Law, agreement to the amended Policy. If you do not agree with the amendment, you must cease using the Application and may request deletion of your Account in accordance with this Policy.

Prior versions of this Policy are available upon request from the Company at [Privacy Contact Email] for a period of [Prior Version Availability Period].