Mobile App Privacy Disclosures

This document supplements the Tanqory Privacy Policy (platform/privacy-policy.md) and the Tanqory Cookie Policy (platform/cookie-policy.md) and explains the data practices specific to the Tanqory merchant mobile applications for iOS and Android (each, the "App"). It is the reference document for the Apple App Store privacy information presented in App Store Connect and for the Google Play Data Safety information presented in the Google Play Console. Where this document and the Privacy Policy address the same subject, this document governs only as to the mobile-app-specific details described below; the Privacy Policy governs in all other respects. Defined terms not defined here have the meaning given in the Privacy Policy.

1) Scope

1.1 This document applies to the native Tanqory merchant applications published for Apple iOS (implemented in Swift) and Google Android (implemented in Kotlin). It does not apply to the Tanqory web administration console, to customer-facing storefronts rendered by the Tanqory commerce engine, or to third-party applications that integrate with Tanqory.

1.2 The App is a business-to-business tool intended for use by merchants and their authorized personnel in operating a Tanqory store. It is not directed to consumers acting in a personal capacity and is not directed to children (see Section 11).

1.3 This document is read together with the Privacy Policy and the Cookie Policy. Data transfers among the Tanqory group entities (Tanqory Inc. and Tanqory OÜ) and the list of subprocessors are governed by the Privacy Policy and the Data Processing Addendum referenced therein.

2) Data collected in the App

The categories of data the App may collect or process, and the purpose of each, are as follows. Collection of certain categories depends on features the merchant chooses to use and on operating-system permissions the user grants.

• Account and authentication data — account identifiers, email address, authentication tokens, and session data, including federated sign-in via Google. Purpose: account access, authentication, and security.
• Usage and analytics data — in-app events, screens viewed, feature interactions, and derived usage metrics. Purpose: measuring feature usage and improving the App.
• Device and diagnostic identifiers — device model, operating-system version, application version, language and region settings, and technical identifiers generated by analytics and integrity services. Purpose: app functionality, diagnostics, and anti-abuse.
• Advertising identifier — the iOS Identifier for Advertisers (IDFA) and the Android Advertising ID (AAID), used only as described in Section 5. Purpose: advertising conversion and attribution measurement.
• Images submitted for editing — images a user supplies to in-app image-editing features. Purpose: image background removal and related editing (see Section 10).
• Payment metadata — limited transaction metadata processed in connection with payments. Full payment-card data is collected and processed by Stripe, Inc. and is not stored by Tanqory. Purpose: payment processing, including Apple Pay and Google Pay.
• Crash and error diagnostics — crash reports, error events, stack traces, and associated technical context, in pseudonymized form. Purpose: stability and defect remediation.

3) Apple App Store Privacy ("Nutrition Labels")

3.1 Apple requires each App Store listing to declare its data practices using the App Privacy framework. That framework classifies declared data into three groupings: Data Used to Track You, Data Linked to You, and Data Not Linked to You. "Tracking," as Apple defines it, means linking data collected in the App with third-party data for advertising or sharing the data with a data broker.

3.2 Because the App uses the Google Ads on-device conversion measurement SDK for advertising conversion and attribution (see Section 5), the App declares data in the Data Used to Track You grouping. The category applicable to that grouping is Identifiers (the advertising identifier).

3.3 The following Apple data categories are expected to apply to the App, subject to confirmation of the final per-category mapping:

• Identifiers (including the advertising identifier) — Used to Track You and Linked to You.

• Usage Data — Linked to You.

• Diagnostics — generally Not Linked to You where submitted in pseudonymized form.

• Purchases — Linked to You.

• Contact Info (email address) — Linked to You.

• User Content (images submitted for editing) — Linked to You.

  3.4 The authoritative App Store privacy label is maintained in App Store Connect. The label and this document must be kept consistent; any change to the App's data practices requires updating both. The App Store privacy label will be submitted in App Store Connect and kept consistent with this document.

4) Google Play Data Safety

4.1 Google Play requires each listing to complete a Data Safety form that discloses (a) the data the App collects, (b) the data the App shares with third parties, (c) the security practices applied, including whether data is encrypted in transit, and (d) whether users can request deletion of their data.

4.2 The analogous Google Play data categories expected to apply to the App are: Personal info (email address); Financial info (payment metadata, with full card data handled by Stripe); App activity (in-app actions and usage); App info and performance (crash logs and diagnostics); Device or other IDs (including the advertising identifier); and Photos (images submitted for editing). The App declares that data is encrypted in transit and that users may request data deletion through the path described in Section 12.

4.3 The authoritative Data Safety declaration is maintained in the Google Play Console and must be kept consistent with this document. The Data Safety form will be submitted in the Play Console and kept consistent with this document.

5) App Tracking Transparency (ATT) and advertising identifiers

5.1 The App uses the Google Ads on-device conversion measurement SDK to measure advertising conversions and attribution. This service is active in production.

5.2 On iOS. Because access to the IDFA for this purpose constitutes tracking under Apple's policy, the App presents the system App Tracking Transparency (AppTrackingTransparency) prompt and accesses the IDFA only if the user grants permission. If the user declines, the App does not access the IDFA, and conversion measurement that depends on the IDFA does not occur. The user may change this choice at any time in Settings → Privacy & Security → Tracking, where the user may also disable tracking requests for all apps.

5.3 On Android. The App uses the Android Advertising ID (AAID). The user may reset the AAID or opt out of personalized advertising in Settings → Privacy → Ads, including "Delete advertising ID" and "Opt out of Ads Personalization," after which conversion measurement that depends on the AAID is limited accordingly.

5.4 Use of advertising identifiers is also addressed in the Privacy Policy and the Cookie Policy. Declining ATT on iOS or deleting the advertising ID on Android does not affect the core functionality of the App.

6) Analytics

6.1 The App uses Google Analytics for Firebase (GoogleAppMeasurement) for app-usage analytics and Sentry for in-app error and crash telemetry. Sentry telemetry is pseudonymized.

6.2 Analytics processing of this kind is treated as non-essential. Where consent is required by applicable law for non-essential analytics, the App obtains consent through the in-app consent mechanism, and analytics that depend on that consent are not performed until consent is given. Analytics data is used to understand feature usage, to diagnose defects, and to improve the App. Subprocessor relationships for these services are disclosed under the Privacy Policy.

7) Push notifications

7.1 The App sends push notifications using Firebase Cloud Messaging (FCM) on Android and the Apple Push Notification service (APNs) on iOS. To deliver notifications, the App registers a device push token with the relevant service.

7.2 Push notifications are optional. The user may disable them at the operating-system level — on iOS in Settings → Notifications → [App], and on Android in Settings → Apps → [App] → Notifications — and, where provided, within the App's own notification settings. Firebase App Check is used to attest device integrity and to reduce abuse of backend resources; it does not deliver marketing content.

8) Device permissions

The App requests the following operating-system permissions. Each permission is optional, and denying it limits only the related feature, not access to the App as a whole.

• Camera — used for barcode scanning and for capturing photos within the App. Denying it disables barcode scanning by camera and in-app photo capture.
• Photo library — used to select images for in-app editing or upload. Denying it disables selection of images from the device library.
• Notifications — used to deliver push notifications as described in Section 7. Denying it disables push notifications.
• Biometric — used for biometric authentication as described in Section 9. Denying it requires the user to authenticate by other supported means.

9) Biometric authentication

9.1 The App supports biometric sign-in using Face ID and Touch ID on iOS and the Android biometric framework. The biometric match is performed entirely on the device by the operating system. Tanqory does not receive, transmit, collect, or store any biometric identifier or biometric template; the App receives only a success-or-failure signal from the operating system and uses the device's built-in biometric mechanism solely as a convenience unlock.

9.2 Because Tanqory does not collect, capture, or store biometric identifiers or biometric information — the App relies only on the operating system's on-device biometric unlock — the collection, written-notice, written-consent, and retention-schedule obligations of the Illinois Biometric Information Privacy Act (740 ILCS 14) and comparable United States state biometric-privacy laws are not triggered by the App's use of the operating-system biometric unlock.

10) Images and AI processing

10.1 When a user uses the in-app AI image background-removal feature, the user-supplied image is transmitted to PhotoRoom SAS (France, European Union), which performs the background-removal processing on its servers. This processing is not performed on the device. Use of this feature is at the user's election.

10.2 The App also allows users to search and insert stock images sourced through Unsplash and Pexels. Such images are provided and licensed under the respective terms of those services, and the user is responsible for using inserted images consistent with those licenses.

10.3 The App includes Google ML Kit barcode scanning. Barcode detection is performed primarily on the device. Some barcode-scanning paths may transmit data off the device; where they do, only the minimal scan data needed is transmitted.

10.4 Further detail on AI-related processing, including data handling and provider obligations, is set out in the AI Data Usage Policy (data-protection/ai-data-usage-policy.md).

11) Children

11.1 The App is a business-to-business merchant tool. It is not directed to children and is not intended for use by children. The App does not knowingly collect personal information from children. Tanqory's position on children's data is set out in the COPPA Compliance Statement (data-protection/coppa-compliance-statement.md).

12) Account and data deletion

12.1 Both the Apple App Store and the Google Play Store require an in-app path for account deletion (and Google additionally requires a web-accessible deletion route). An in-app account-deletion path is not yet implemented in the App as of the effective date. It must be built before the App is submitted to, or remains compliant with, the Apple App Store and Google Play Store. The intended design: a merchant initiates deletion from the account or settings area; the App confirms identity; the request enters the Data Deletion Request workflow (Section 12.2). The deletion will remove account-profile and app-usage data and, subject to Section 12.2, data not under a legal-retention obligation. The in-app deletion path and the precise data categories deleted versus retained will be documented here upon implementation.

12.2 A merchant may also submit a deletion request through the process described in the Data Deletion Request procedure (user-rights/data-deletion-request.md). Certain data may be retained where retention is required to comply with legal, tax, accounting, or fraud-prevention obligations, as described in the Privacy Policy.

13) Changes and contact

13.1 Tanqory may update this document to reflect changes in the App, in third-party services used by the App, or in applicable law or app-store requirements. Material revisions will be published with a revised effective date and version number.

13.2 Questions about this document or about the data practices of the App may be directed to privacy@tanqory.com. Updates are posted at https://legal.tanqory.com/.