Privacy policy

This policy explains how AppMetis handles personal data when you use appmetis.com, connect your app store accounts, buy a plan or contact us. It also covers the public developer details and reviews in our market data, and what you can do about them.

Who we are

AppMetis is an app intelligence service for the Apple App Store and Google Play, operated from India and serving customers worldwide. In this policy, "AppMetis", "we" and "us" mean the operator of appmetis.com.

We decide why and how the personal data in this policy is used, so we are the controller under the EU and UK General Data Protection Regulation (GDPR) and the data fiduciary under India's Digital Personal Data Protection Act 2023 (DPDP Act). The exception is personal data inside the store reports and reviews you connect, which we process for you as your processor.

Personal data we collect

Data you give us or create

• Account details. Your name, email address and password (stored only as a one-way hash). You can also add an avatar and set your timezone, theme and notification preferences.
• Workspace and team details. The workspaces you belong to, their members and roles, and the invites you send or receive.
• Billing details. Your plan, invoices, billing name and address, an optional GST or VAT number and transaction references from our payment providers. We never see or store full card numbers or UPI PINs.
• Usage data. The pages and features you use, your searches, saved searches and lists, the exports you make and the quota counters that track your plan limits.
• Technical logs. Your IP address, browser user agent and the time of each request, used for security, rate limits and abuse prevention.
• Connected store credentials. The App Store Connect API key or Google Play service account you provide, encrypted at rest with AES-256-GCM and never shown again after you save it.
• Connected store data. Downloads, revenue, proceeds, subscriptions, ratings and reviews from your store accounts, and the review replies you send through AppMetis.
• Support and contact messages. Your name, email address, company, topic and message, and the IP address it came from.
• Data removal requests. What you asked us to mask or correct, how we verified the request and what we did.
• Emails we send. Which emails we sent you, such as verification, alert, report and billing emails, and whether they were delivered.

You need a name, email address and password, or Sign in with Google, to create an account. Everything else is optional or created as you use AppMetis.

Data we receive from others

• Google. If you use Sign in with Google, Google shares your name, email address and profile picture. We never see your Google password, and we do not keep tokens that give access to your Google account.
• Payment providers. Razorpay and PayPal tell us whether a payment succeeded, failed, was refunded or was disputed.
• Cloudflare. Cloudflare tells us which country a request comes from and whether it passed bot checks.

Public app, developer and review data

Most of AppMetis is market data about apps, not people, taken from public App Store and Google Play listings. Some of it relates to people:

• Developer details. Store listings show the developer name, legal name, website, email address, phone number, postal address and country, and many solo developers publish their own name and contact details. We collect these exactly as the stores publish them and work out a country and city from the published address.
• Reviews. Public reviews show the reviewer's display name as the store shows it. We keep a recent sample of reviews for each app.

We do not buy contact lists or collect contact details from private or login-protected sources.

Why we use it. Our customers use this data for business-to-business market research and to find companies to sell to or partner with. We rely on legitimate interests, ours and our customers', in understanding the app market, and we have weighed them against yours. Developers publish these details so that people can contact them, we show nothing beyond what the stores publish, full contact details are visible only to customers on plans that include them, and anyone can ask us to mask or correct their details.

Your choices. Developers can ask us to mask contact details, correct wrong details or claim their developer profile on our data removal page. If you wrote a review and want it hidden on AppMetis, email us with the subject line "Privacy" and a link to the app. You can also object to this processing at any time, free of charge.

How customers use it. Customers who export contact details decide how they use them and must follow anti-spam and privacy laws. Our terms of service forbid using the data for spam.

How we use personal data and why

Where we rely on legitimate interests, we have balanced them against your rights, and you can object at any time.

Under India's DPDP Act, we rely on the consent you give when you sign up or message us, on your having given us the data voluntarily for a specific purpose, or on legal requirements. You can withdraw consent at any time, although we may then be unable to keep providing the service.

You can turn off alert and digest emails in your notification settings or with the unsubscribe link in each email, but we still send emails needed to run your account, such as password resets and billing notices.

We do not make decisions with legal or similarly significant effects on you based only on automated processing.

Cookies and analytics

Essential cookies sign you in, remember your price region and keep the site secure. Analytics cookies from Google Analytics 4 and Microsoft Clarity, and Google Tag Manager, which loads our analytics tags, load only if analytics is switched on and you allow it in the cookie banner. Our cookie policy lists every cookie.

Who we share personal data with

We share personal data only with the people and companies below, and only as much as they need. We do not sell your personal data.

Service providers

These providers process personal data for us under contracts that limit how they may use it.

Razorpay and PayPal also act as independent controllers for some payment data, for example to meet banking and anti-fraud rules, under their own privacy policies. The ASO assistant only needs app details such as titles, keywords and descriptions, so please do not enter other people's personal data into it.

Others

• Your workspace. Members can see each other's names, email addresses and roles, and owners and admins manage invites and billing.
• AppMetis users. Public developer and review data is shown to users as described above.
• Legal and safety reasons. We may disclose personal data when the law requires it, such as for a valid court order, or to protect the rights, property or safety of AppMetis, our users or others. Where the law allows, we will tell you first.
• Business changes. If AppMetis is sold or merged, personal data may pass to the new owner, who must keep protecting it as this policy describes, and we will tell you.

International transfers

AppMetis is operated from India, and our main servers and databases are hosted by Hetzner in Germany. Some service providers, such as Cloudflare, Google, Microsoft and PayPal, may process data in the United States and other countries. Razorpay processes payments in India.

When personal data from the European Economic Area or the United Kingdom goes to a country without an adequacy decision, we rely on the European Commission's standard contractual clauses, the UK addendum to them, or an equivalent safeguard such as a provider's certification under the EU-US Data Privacy Framework. You can ask us for details of the safeguard that applies.

How long we keep personal data

Backups are kept for 14 days, so deleted data leaves our backups within a further 14 days. We may keep data longer when the law requires it or to deal with a dispute, and we may keep statistics that no longer identify anyone.

How we protect personal data

• All traffic to and from AppMetis is encrypted with TLS.
• Passwords are stored only as hashes, and store credentials and other secrets are encrypted at rest with AES-256-GCM.
• Staff reach account data only when their role needs it, for example to answer a support request, and admin actions are recorded in audit logs.
• Admin staff must use two-factor authentication.
• We take regular backups so we can recover from failures.

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will tell you and the relevant authorities as the law requires.

Your rights

Wherever you live, you can ask what personal data we hold about you, ask us to correct it and ask us to delete your account. Your account settings include a data export and account deletion.

In the EEA and the UK

Under the GDPR and the UK GDPR you have the right to:

• access your personal data and get a copy of it
• have inaccurate or incomplete data rectified
• have your data erased
• restrict how we use your data
• receive your data in a portable format
• object to processing based on legitimate interests, including the developer and review data we show
• withdraw consent at any time, without affecting processing that happened before
• complain to a supervisory authority, such as the data protection authority where you live or work, or the Information Commissioner's Office in the UK

In India

Under the DPDP Act you have the right to:

• get a summary of the personal data we process about you, how we process it and who we have shared it with
• have your data corrected, completed, updated or erased, unless the law requires us to keep it
• have your grievances handled by us
• nominate another person to exercise your rights if you die or are unable to act

If you are not satisfied with how we handle your grievance, you can approach the Data Protection Board of India after you have used our grievance process.

In California and other US states

Depending on where you live, you may have the right to know, access, correct and delete the personal information we hold about you and to get a portable copy. We will not treat you differently for using these rights. You can use an authorised agent, and we will ask for proof of their authority. If we decline your request, you can appeal by replying to our decision.

In the last 12 months we collected identifiers (such as name, email and IP address), commercial information (such as plans and invoices), internet activity (such as usage data and logs) and professional information (such as company names), as described above, and disclosed them to the service providers listed above for business purposes. We use sensitive personal information, such as your password, only to provide the service.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. Contact details that developers publish on store listings are publicly available information, which these laws generally exclude from personal information, but you can still ask us to mask or correct them.

How to make a request

Email [email protected] with the subject line "Privacy", from your account email if you have an account, and tell us what you would like us to do. If we cannot confirm who you are, we may ask for more information. Requests are free, although where the law allows we may refuse requests that are clearly unfounded or excessive. We answer within 30 days. If a complex request needs more time and the law allows it, we will tell you within those 30 days and explain why.

Children

AppMetis is a business service and is not meant for anyone under 18. We do not knowingly collect their personal data, and if you believe a child has given us any, contact us and we will delete it.

Changes to this policy

We update this policy when our practices or the law change, and the date at the top shows the latest version. If a change materially affects how we use your personal data, we will tell you by email or in the product before it takes effect.

Contact and grievances

For questions, requests or complaints about privacy, email [email protected] with the subject line "Privacy". This address is also our grievance contact under India's DPDP Act, and we answer every grievance within 30 days. AppMetis is operated from India.