MWM Spark Flash SDK Privacy Policy

Preamble

MWM SAS is a French simplified joint stock company with its headquarters located at 1, Cours de l'Île Seguin, 92100, Boulogne-Billancourt, France, and registered in the Nanterre trade and company register under number 513 627 299.

This SDK Privacy Policy describes how MWM SAS ("MWM," "we," or "us") processes Personal Data relating to end users ("End-Users") of mobile applications that integrate our MWM Spark Flash SDK — whether those applications were created with MWM AI or integrate the SDK directly. It supplements our Privacy Policy (the "Privacy Policy"), whose sections on international transfers (Section 6), security (Section 8), and retention (Section 9) also apply. Capitalized terms that are not defined here have the meaning given to them in the Privacy Policy.

If you have any questions about this SDK Privacy Policy, contact us at privacy@mwm.io.

1. The SDK and Integrated Applications

The MWM Spark Flash SDK (the "SDK") is a mobile software development kit for iOS and Android that developers integrate into their applications to power analytics, monetization, and app-scaling features (including dashboards made available through MWM Console). The SDK is integrated by default into applications generated with MWM AI, and is also publicly available for any developer to integrate into their own application. We refer to any application embedding the SDK as an "Integrated Application," and to the people who use Integrated Applications as "End-Users."

This SDK Privacy Policy describes what we process when you use an Integrated Application.

2. Our Role

The publisher of the Integrated Application decides which SDK features to enable and for what purposes. The publisher is the data controller (or "business") for End-User Personal Data processed through the SDK for its benefit, and the publisher's own privacy policy is the primary privacy notice that applies to your use of its application. MWM processes such data as a processor (or "service provider") on the publisher's behalf. MWM acts as an independent controller only for the limited purposes of operating, securing, and improving the SDK and its backend services, preventing fraud and abuse, metering and billing publishers, and complying with legal obligations — using de-identified or aggregated data where possible.

3. Data We Process

Data the SDK collects automatically on the device:

• an installation identifier — a randomly generated identifier that uniquely identifies a given installation of the application on your device;
• device information — operating system version, screen size, device language, and timezone;
• SDK monitoring and diagnostic events — technical events used to analyze the proper functioning of the SDK, such as crash reports and latency, error, and performance measurements;
• on iOS only: Apple's "Vendor ID" (identifierForVendor), an identifier provided by Apple that is shared across applications from the same application vendor on your device; and performance and diagnostic metrics provided by Apple's MetricKit framework.

Data the SDK enables the publisher to collect (where the publisher activates these features):

• store transaction data — Apple App Store and Google Play Store in-app purchase and subscription events (for example, product identifiers, transaction identifiers and timestamps, prices and currencies, and subscription status and renewal events). Payments are processed by Apple or Google; we do not receive your name, payment card details, or billing address through the SDK;
• usage events — in-app interactions defined by the publisher for product analytics purposes (for example, features used or screens viewed). Publishers are contractually required not to include sensitive data in these events.

Data we collect server-side:

• the IP address of the device-to-server connection; and
• approximate location (country, region, and city) derived from that IP address.

4. Purposes

We process SDK Data to: provide the SDK features and associated dashboards (including MWM Console) to the publisher; measure and improve the reliability, performance, and security of the SDK and our Services; prevent fraud and abuse; meter usage and bill publishers; comply with legal obligations; and produce de-identified, aggregated statistics.

5. What We Do Not Do with SDK Data

We do not sell End-User Personal Data. We do not use SDK Data for third-party or cross-context behavioral advertising. We do not use SDK Data to train or fine-tune artificial intelligence models. We do not combine SDK Data across different publishers' applications, except in de-identified or aggregated form.

6. Legal Bases

Where we act as a processor, the publisher of the Integrated Application is responsible for establishing a legal basis for the processing (including, where required by EU/UK ePrivacy rules, collecting your consent within the application for the storage of, or access to, identifiers on your device). Where we act as an independent controller, we rely on our legitimate interests (securing, operating, and improving the SDK and preventing fraud and abuse), the performance of our contract with the publisher, and compliance with legal obligations.

7. Identifiers Stored on Your Device

Within Integrated Applications, the SDK stores or accesses identifiers on the End-User's device (such as the installation identifier described in Section 3). Where required by applicable law, the publisher of the Integrated Application is responsible for obtaining End-User consent for such storage or access through its own consent mechanism.

8. Your Rights

You may exercise the rights described in Section 10 of the Privacy Policy. Because the publisher of the Integrated Application is the primary controller of your Personal Data, we recommend addressing your request to the publisher first (its identity and contact details appear in its own privacy policy and app store listing). If you contact us at privacy@mwm.io, we will assist and, where we act as a processor, may need to relay your request to the relevant publisher.

In any case, you may, at any time, submit a claim to the CNIL or your competent national authority (depending on your place of residence).

9. U.S. State Privacy Disclosures (Including California)

Personal Information. For End-Users of Integrated Applications, we may process the following categories of Personal Information:

• Identifiers (e.g., IP address, installation identifiers, and device identifiers such as Apple's Vendor ID);
• Commercial information (e.g., in-app purchase and subscription events, where enabled by the publisher);
• Internet or other electronic network activity (e.g., usage events and SDK monitoring and diagnostic events);
• Approximate geolocation (derived from IP address).

SDK Data; Service Provider Role. Where we process End-User Personal Information through the MWM Spark Flash SDK on behalf of the publisher of an Integrated Application, we act as a "service provider" (or "processor") under applicable U.S. state privacy laws: we process such Personal Information solely to provide our services to the publisher and for permitted business purposes, and we do not sell it or share it for cross-context behavioral advertising. End-Users should direct privacy requests to the relevant publisher in the first instance (see Section 8).

10. Children

Integrated Applications are published by our users or by third parties, and their audiences are determined by their publishers. We contractually require publishers not to enable SDK data collection in applications primarily directed at children under thirteen (13) (or any higher age required by applicable law). We do not knowingly process children's Personal Data for our own purposes.

11. Retention

We retain SDK Data in accordance with Section 9 (Information Retention) of the Privacy Policy.