Data Processing Addendum

Version 1.0 · Effective 14 October 2026

This Data Processing Addendum ("DPA") is concluded between:

• Voidhash s.r.o., ID No. (IČO) 23738944, registered office at Chudenická 1059/30, Hostivař, 102 00 Prague 10, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 432083 ("Voidhash", "we"); and
• the customer that has accepted the Voidhash Terms of Service or signed an order form referring to them ("Customer", "you").

It sets out the terms on which Voidhash processes personal data on the Customer's behalf when providing the Service, as required by Article 28 of Regulation (EU) 2016/679 (the "GDPR") and other Applicable Data Protection Law. The clauses on the processor's obligations follow the structure of the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/915.

1. Conclusion, scope and structure

1.1 Part of the Terms. This DPA forms part of, and is incorporated by reference into, the Voidhash Terms of Service at https://voidhash.com/legal/terms (the "Terms"). It is concluded at the moment the Customer accepts the Terms when creating an account, without any further signature. Accepting the Terms also constitutes acceptance of this DPA, including the Standard Contractual Clauses incorporated under Section 14 and Annex IV where they apply.

1.2 Signed copy. A Customer on an Enterprise plan may request a countersigned copy of this DPA from legal@voidhash.com. A signed copy has the same content as this DPA unless the parties expressly agree otherwise in an order form or a written amendment.

1.3 Scope. This DPA applies to the processing of Customer Personal Data by Voidhash in providing the hosted Service. It does not apply to:

(a) personal data for which Voidhash is a controller, such as data about Customer's account users, billing contacts and support correspondence, which Voidhash processes under its Privacy Policy at https://voidhash.com/legal/privacy;

(b) open-source software (including the Voidhash SDKs and the self-hostable Community edition) that the Customer runs on its own infrastructure without Voidhash having access to personal data. If Voidhash personnel access a self-hosted or customer-cloud deployment at the Customer's request (for example during support), this DPA applies to that access.

1.4 Customer affiliates. Where personal data processed in the Customer's account is controlled by the Customer's affiliates, the Customer enters into this DPA on their behalf as well, warrants that it is authorised to do so, and remains the single point of contact for Voidhash.

1.5 Annexes. The following annexes form part of this DPA:

• Annex I — Description of the processing (field-level)
• Annex II — Technical and organisational measures
• Annex III — Subprocessors
• Annex IV — International transfer mechanisms
• Annex V — US State Privacy Laws Addendum

2. Definitions

2.1 Capitalised terms not defined in this DPA have the meaning given in the Terms. The terms "controller", "processor", "data subject", "personal data", "processing", "personal data breach" and "supervisory authority" have the meaning given in the GDPR, and corresponding terms in other Applicable Data Protection Law are to be read accordingly.

2.2 In this DPA:

(a) "Applicable Data Protection Law" means, to the extent applicable to the processing, the GDPR; Czech Act No. 110/2019 Coll., on the Processing of Personal Data; laws implementing Directive 2002/58/EC (including § 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications); the UK GDPR and the UK Data Protection Act 2018 ("UK Data Protection Law"); the Swiss Federal Act on Data Protection of 25 September 2020 ("FADP"); and the US State Privacy Laws defined in Annex V.

(b) "Customer Personal Data" means personal data contained in Customer Data or Customer Content that Voidhash processes on behalf of the Customer as processor (or subprocessor) in providing the Service, as described in Annex I.

(c) "End User" means an individual who uses an application, website or other product of the Customer into which the Customer has integrated the Service.

(d) "Instructions" has the meaning given in Section 4.2.

(e) "Subprocessor" means any processor engaged by Voidhash that processes Customer Personal Data. Voidhash's employees and individual contractors acting under Voidhash's direct authority (Article 29 GDPR) are Voidhash personnel, not Subprocessors.

(f) "Customer Integration" means a third-party service or endpoint that the Customer connects to the Service using its own account, credentials or configuration, in particular Apple (App Store Server API, App Store Connect, Apple Push Notification service), Google (Google Play Developer API, Cloud Pub/Sub, Firebase Cloud Messaging), the Customer's own Stripe account, webhook endpoints, AI agents or tools that the Customer connects to the Service, and third-party paywall components that send data to endpoints chosen by their publisher.

(g) "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data while processed by Voidhash or its Subprocessors.

(h) "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by Commission Implementing Decision (EU) 2021/914, in the module identified in Annex IV.

(i) "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0) issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.

(j) "Restricted Transfer" means a transfer of Customer Personal Data to a country outside the European Economic Area ("EEA") that is not covered by an adequacy decision, or an equivalent transfer under UK Data Protection Law or the FADP.

(k) "Anonymised Data" means data that no longer relates to an identified or identifiable natural person, taking into account all means reasonably likely to be used to identify a person (Recital 26 GDPR).

(l) "Business Day" means a day that is a working day in the Czech Republic.

3. Roles of the parties

3.1 Customer as controller. As regards Customer Personal Data, the Customer is the controller and Voidhash is the processor.

3.2 Customer as processor. Where the Customer processes Customer Personal Data on behalf of a third party (for example, an agency or studio that builds and operates apps for its clients), the Customer is a processor, Voidhash is a subprocessor, and:

(a) the Customer warrants that its Instructions, including the appointment of Voidhash and the Subprocessors, are authorised by the relevant controller;

(b) the Customer passes on to the controller any information or notice that Voidhash provides under this DPA where the controller needs it;

(c) Voidhash deals only with the Customer and is not obliged to communicate with the third-party controller unless Applicable Data Protection Law requires it or the Customer has ceased to exist in law; and

(d) references in this DPA to the Customer's obligations as controller apply to the Customer as processor to the extent of its role.

3.3 Voidhash as controller. Voidhash is an independent controller of personal data relating to the Customer's account, its users and contacts, billing, support, security of the Service and Voidhash's own business operations, as described in the Privacy Policy. Such processing falls outside this DPA.

3.4 Customer Integrations are not Subprocessors. When the Service sends Customer Personal Data to a Customer Integration (for example, it validates a purchase with Apple or Google, delivers a push notification through APNs or FCM, or calls the Customer's webhook endpoint), it does so on the Customer's Instruction. The provider of the Customer Integration is a recipient chosen by the Customer and acts as the Customer's processor or as an independent controller under its own terms with the Customer, not as a Subprocessor of Voidhash. Voidhash is not responsible for the processing carried out by Customer Integrations.

3.5 Each party complies with the Applicable Data Protection Law that applies to it in its respective role.

4. Instructions

4.1 Voidhash processes Customer Personal Data only on the Customer's documented Instructions, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which Voidhash is subject. In such a case, Voidhash informs the Customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

4.2 The Customer's complete documented instructions ("Instructions") at the time of conclusion are:

(a) the Terms and this DPA, including Annex I and the instruction in Section 5;

(b) the Customer's configuration and use of the Service, including settings made in the dashboard and Studio, SDK configuration, calls to the API, enabling Customer Integrations, and creating, publishing or installing paywalls, flows, components, experiments, flags, cohorts and push campaigns; and

(c) other written instructions given by an authorised user of the Customer's account (for example in a support request) that are consistent with the Terms and technically feasible.

4.3 Instructions outside the scope of Section 4.2 require Voidhash's prior written agreement, which may include additional fees. If Voidhash cannot follow such an Instruction, it informs the Customer, and the Customer may terminate the affected part of the Service in accordance with the Terms.

4.4 Voidhash informs the Customer immediately if, in its opinion, an Instruction infringes the GDPR or other Union or Member State data protection provisions. Voidhash may suspend the execution of the Instruction until the Customer confirms or changes it. Voidhash is not obliged to carry out a legal review of Instructions.

4.5 The Customer is responsible for ensuring that its Instructions comply with Applicable Data Protection Law.

5. Anonymised statistics

5.1 Instruction. The Customer instructs Voidhash to anonymise Customer Personal Data and to use the resulting Anonymised Data for the following purposes:

(a) operating, securing and maintaining the Service (for example capacity planning, performance and error measurement, detection of fraud and abuse); and

(b) improving the Service and producing aggregated statistics and benchmarks (for example average conversion rates by paywall type or market).

5.2 Conditions. Voidhash (a) anonymises data so that neither End Users nor the Customer can be identified by Voidhash or by any recipient using means reasonably likely to be used; (b) publishes or shares statistics only in aggregated form combining data of multiple customers; (c) does not attempt to re-identify Anonymised Data and contractually prohibits recipients from doing so; and (d) keeps the anonymisation methods under review in light of the state of the art.

5.3 Anonymised Data is not personal data and is not Customer Personal Data. Voidhash's rights to Anonymised Data are governed by the Terms.

5.4 Limits. Voidhash does not (a) sell Customer Personal Data or make it available to third parties for their own purposes; (b) use Customer Personal Data for its own marketing, for profiling End Users, or to provide services to other customers; or (c) use Customer Data, Customer Content or End User data to train artificial intelligence or machine-learning models, and it does not permit its AI providers to do so.

6. Customer obligations and warranties

6.1 Lawful basis. The Customer warrants that it has, and will maintain for as long as Voidhash processes Customer Personal Data, a valid legal basis under Applicable Data Protection Law for the processing it instructs, including the transfers described in Section 14.

6.2 Transparency. The Customer provides End Users with all information required by Articles 13 and 14 GDPR and other Applicable Data Protection Law, including the categories of data collected through the Service, the use of a processor, transfers outside the EEA and, where the Customer uses it, the linking of End User activity across its apps and websites based on IP addresses (Annex I, part D). Voidhash publishes a description of SDK data collection and a template privacy-policy paragraph at https://voidhash.com/legal/sdk-data.

6.3 Consent and device storage. Voidhash's position on consent for the processing performed through the SDKs is as follows; the Customer remains responsible, as controller, for the assessment in its own circumstances:

(a) Purchase processing. Validating receipts and transactions, restoring purchases, determining entitlements, and the identifiers and on-device storage needed for these functions are part of the service the End User has explicitly requested and are strictly necessary for it. They run without consent.

(b) Revenue analytics. Revenue, MRR, subscription and refund reporting is computed on Voidhash's servers from the purchase transactions already processed under point (a). It requires no additional on-device storage or event collection and continues to work regardless of the End User's analytics choice. The Customer determines the legal basis for it (typically legitimate interest or compliance with accounting obligations).

(c) Usage analytics. Automatic events (such as app opens and screen views), custom events, paywall impressions and interactions, and person traits may require the End User's consent under rules implementing Article 5(3) of Directive 2002/58/EC (in the Czech Republic, § 89(3) of Act No. 127/2005 Coll.), depending on the jurisdiction and on how the Customer uses them. Deciding whether consent is needed, obtaining and recording it, and passing the result to the SDK using the controls described at https://voidhash.com/legal/sdk-data is the Customer's responsibility. Where usage analytics is disabled for an End User, metrics that rely on impressions (for example paywall conversion rates) are computed only from End Users for whom it is enabled and may be incomplete.

6.4 App Tracking Transparency. The Voidhash SDK does not read the IDFA, IDFV, Google Advertising ID or Android ID. If the Customer configures a paywall flow to request App Tracking Transparency permission, the Customer is responsible for the purpose of that request, its wording and its compliance with Apple's rules, and for any tracking it performs on the basis of that permission.

6.5 Children. If the Customer's product is directed at children, or the Customer knows that it processes children's data, the Customer is responsible for compliance with the applicable rules, including Article 8 GDPR (in the Czech Republic, consent of a child aged 15 or over under § 7 of Act No. 110/2019 Coll.) and the US Children's Online Privacy Protection Act (COPPA), and it configures the Service to minimise the data collected (for example, it does not identify End Users by email or name).

6.6 Prohibited data. The Customer does not submit to the Service, including in custom events, properties, person traits, paywall form inputs, push notification content or Customer Content:

(a) special categories of personal data (Article 9 GDPR) or personal data relating to criminal convictions and offences (Article 10 GDPR), including data from which such categories can be inferred (for example an event name revealing a health condition);

(b) payment card numbers, bank account credentials, passwords, government identification numbers, or precise geolocation;

unless Voidhash has expressly agreed to it in writing.

6.7 Store disclosures. The Customer completes the privacy disclosures required by app stores (App Store privacy labels and privacy manifest, Google Play Data safety form) accurately, taking into account Annex I.

6.8 Account security. The Customer keeps its account credentials, API keys and the credentials of its Customer Integrations confidential, assigns roles to its users appropriately, keeps the SDKs reasonably up to date, and secures its own systems and endpoints that receive data from the Service.

6.9 The Customer informs Voidhash without undue delay if it becomes aware that the processing of Customer Personal Data infringes Applicable Data Protection Law or this DPA.

7. Confidentiality and personnel

7.1 Voidhash grants access to Customer Personal Data only to personnel who need it to provide the Service, and only to the extent necessary. Such personnel are bound by a contractual or statutory obligation of confidentiality that continues after their engagement ends, and are informed of their data protection obligations.

7.2 Voidhash personnel access Customer Personal Data only (a) to provide, maintain and secure the Service; (b) to provide support at the Customer's request; (c) to investigate and remedy incidents; and (d) to comply with law.

8. Security of processing

8.1 Voidhash implements and maintains the technical and organisational measures described in Annex II to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risks for the rights and freedoms of natural persons (Article 32 GDPR).

8.2 Voidhash may update the measures in Annex II as technology and threats evolve, provided that the overall level of security is not reduced.

8.3 The Customer acknowledges that, for the data described in Annex I and provided the Customer complies with Section 6.6, the measures in Annex II provide an appropriate level of security. The Customer is responsible for the security measures within its control (Section 6.8).

9. Subprocessors

9.1 General authorisation. The Customer gives Voidhash general written authorisation to engage Subprocessors. The Subprocessors engaged at the effective date are listed in Annex III and at https://voidhash.com/legal/subprocessors (the "Subprocessor Page").

9.2 Flow-down. Before a Subprocessor processes Customer Personal Data, Voidhash (a) assesses that the Subprocessor provides sufficient guarantees to implement appropriate technical and organisational measures; and (b) concludes a written contract with it imposing in substance the same data protection obligations as those in this DPA, in particular with respect to security, confidentiality, assistance, deletion, audit and transfers (Article 28(4) GDPR).

9.3 Liability. Voidhash remains fully liable to the Customer for the performance of each Subprocessor's obligations.

9.4 Notice of changes. Voidhash notifies the Customer of any intended addition or replacement of a Subprocessor at least 30 days before the new Subprocessor starts processing Customer Personal Data. The notice is sent by email to the owners of the Customer's account and to everyone subscribed to updates under the Subprocessor Page, and the Subprocessor Page is updated at the same time. The notice states the Subprocessor's name, purpose, the data concerned, processing location and transfer mechanism.

9.5 Objection. The Customer may object to a new Subprocessor on reasonable grounds relating to data protection by notifying legal@voidhash.com within 15 days of the notice. The parties then discuss the objection in good faith; Voidhash may propose a change to the Service or the Customer's configuration that avoids the processing of Customer Personal Data by the new Subprocessor. If the objection is not resolved within 30 days of its receipt, the Customer may terminate the affected part of the Service (or, where it cannot reasonably be separated, the Terms) with effect before the new Subprocessor starts processing Customer Personal Data, and Voidhash refunds any prepaid fees for the period after termination. If the Customer does not object within the time limit, the Subprocessor is deemed authorised.

9.6 Urgent replacement. If a Subprocessor must be replaced urgently for reasons beyond Voidhash's reasonable control (for example a security incident, insolvency or termination of service by the Subprocessor), Voidhash may engage a replacement Subprocessor immediately and notifies the Customer as soon as possible. The Customer's right to object under Section 9.5 applies from the notice.

9.7 Feature-specific Subprocessors. Subprocessors listed as feature-specific on the Subprocessor Page process Customer Personal Data only when the Customer uses the relevant feature.

9.8 Copies. At the Customer's request, Voidhash provides a copy of the data protection terms of its agreement with a Subprocessor; commercial and confidential information may be redacted.

10. Assistance with data subject requests

10.1 Taking into account the nature of the processing, Voidhash assists the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer's obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR.

10.2 Self-service tools. The Service provides the following tools, which the Customer uses as its primary means of responding to requests:

(a) Erasure: an End User can be erased from Studio or through the API (POST /api/v1/persons/erasures). Erasure removes the End User's name, email, traits, all distinct identifiers, events, push devices, cohort memberships, unfinished checkouts, flag targeting, identifiers in webhook delivery history, stored store payloads and push notification content. Purchase, subscription and revenue records are kept, linked only to an anonymous person identifier, so that the Customer's revenue reporting remains accurate. A person.deleted webhook is emitted so that the Customer can also delete the End User from its own systems;

(b) Access and portability: person profiles, events and purchases can be retrieved through the API in a structured, machine-readable format; data for which no self-service export exists is provided on request, free of charge, in a structured, machine-readable format (JSON);

(c) Rectification: person properties can be updated through the SDK identify call or the API;

(d) Restriction and objection: the Customer can disable data collection for an End User's device using the controls described at https://voidhash.com/legal/sdk-data, stop sending data about the End User through the API, and erase the End User.

10.3 Requests received by Voidhash. If Voidhash receives a request from a data subject relating to Customer Personal Data (for example at legal@voidhash.com), it does not respond to it itself (other than to confirm receipt and refer the data subject to the Customer) and forwards it to the Customer within 5 Business Days, provided that Voidhash can identify the Customer from the request. Otherwise, Voidhash advises the data subject to contact the provider of the app or website concerned.

10.4 Further assistance. Where the tools are not sufficient, Voidhash provides further reasonable assistance on written request. Voidhash may charge reasonable costs for assistance that goes substantially beyond the self-service tools, unless the request results from Voidhash's breach of this DPA.

10.5 The Customer remains responsible for erasing or correcting data in its own systems and in Customer Integrations.

11. Personal Data Breaches

11.1 Voidhash notifies the Customer of a Personal Data Breach without undue delay and in any event within 48 hours after becoming aware of it.

11.2 The notification contains, to the extent then available:

(a) a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

(b) the contact point for data protection matters from whom more information can be obtained (legal@voidhash.com);

(c) a description of the likely consequences of the Personal Data Breach; and

(d) a description of the measures taken or proposed to be taken to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where it is not possible to provide all information at the same time, Voidhash provides it in phases without undue further delay (Article 33(3) and (4) GDPR).

11.3 The notification is sent by email to the owners of the Customer's account and may also be shown in the dashboard.

11.4 Voidhash takes reasonable measures to contain, investigate and remedy the Personal Data Breach and to mitigate its effects, keeps a record of it, and assists the Customer in fulfilling the Customer's obligations under Articles 33 and 34 GDPR, taking into account the nature of the processing and the information available to Voidhash.

11.5 The Customer decides whether to notify the supervisory authority and data subjects. Voidhash does not notify them on the Customer's behalf unless the law requires it or the Customer so instructs.

11.6 Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data (for example pings, port scans, blocked denial-of-service attacks or unsuccessful log-in attempts) are not Personal Data Breaches. Notification of a Personal Data Breach is not an acknowledgement of fault or liability by Voidhash.

12. Data protection impact assessments and prior consultation

12.1 Taking into account the nature of the processing and the information available to it, Voidhash assists the Customer in ensuring compliance with its obligations under Articles 32 to 36 GDPR, in particular in carrying out data protection impact assessments and consulting the supervisory authority.

12.2 Voidhash provides this assistance primarily by making available this DPA and its Annexes, the Subprocessor Page and the SDK data description at https://voidhash.com/legal/sdk-data, and by answering reasonable questions. Further assistance may be charged at reasonable cost.

13. Demonstrating compliance and audits

13.1 Information. Voidhash makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR and this DPA. This includes this DPA, Annex II, the Subprocessor Page and, once in any 12-month period, answers to a reasonable written security questionnaire. Voidhash currently does not hold certifications such as ISO/IEC 27001 or SOC 2; where its Subprocessors hold such certifications, Voidhash may refer to them or share their reports if permitted.

13.2 Audits. If the information under Section 13.1 is not sufficient to demonstrate compliance, or if a supervisory authority requires it, or after a Personal Data Breach, Voidhash allows for and contributes to audits, including inspections, by the Customer or an independent auditor mandated by the Customer, under the following conditions:

(a) the Customer gives at least 30 days' written notice to legal@voidhash.com and the parties agree the scope, timing and duration in advance;

(b) audits take place no more than once in any 12-month period, unless required by a supervisory authority or following a Personal Data Breach;

(c) the auditor is bound by confidentiality and is not a competitor of Voidhash;

(d) the audit takes place during business hours and does not unreasonably disrupt Voidhash's operations; it does not extend to the data of other customers, to information whose disclosure would compromise security, or to the premises of Subprocessors (for which Voidhash relies on the Subprocessors' own audit reports and contractual audit rights); and

(e) the Customer bears its own costs and the auditor's costs.

13.3 The Customer provides Voidhash with a copy of the audit report. The report is Voidhash's Confidential Information. Voidhash remedies confirmed non-compliance without undue delay.

13.4 This Section does not limit the powers of a supervisory authority. Voidhash maintains a record of processing activities carried out on behalf of controllers (Article 30(2) GDPR) and cooperates with supervisory authorities on request.

14. International transfers

14.1 Location. Voidhash's Subprocessors store and process Customer Personal Data in the eastern United States, and requests pass through the global network of Cloudflare, as described in Annex III. The Customer authorises the transfers needed to provide the Service to the countries listed there.

14.2 Voidhash's onward transfers. Voidhash transfers Customer Personal Data outside the EEA only in compliance with Chapter V GDPR, in particular:

(a) to recipients in a country covered by an adequacy decision, including recipients in the United States certified under the EU–US Data Privacy Framework; or

(b) on the basis of the SCCs (Module 3, processor to processor) concluded between Voidhash and the Subprocessor, together with appropriate supplementary measures.

Details are set out in Annex IV.

14.3 Customers outside the EEA. Where the Customer is located in a country outside the EEA that is not covered by an adequacy decision, the SCCs (Module 4, processor to controller), completed as set out in Annex IV, are incorporated into this DPA and apply to transfers of Customer Personal Data from Voidhash to the Customer.

14.4 United Kingdom and Switzerland. For Restricted Transfers under UK Data Protection Law, the UK Addendum applies, and for Restricted Transfers under the FADP the SCCs apply with the adjustments, in each case as set out in Annex IV.

14.5 Changes in transfer mechanisms. If a transfer mechanism relied on under this Section is invalidated or ceases to be sufficient, Voidhash implements an alternative mechanism without undue delay and informs the Customer. If no alternative is available within a reasonable time, either party may suspend the affected transfer and the Customer may terminate the affected part of the Service, in which case Voidhash refunds any prepaid fees for the period after termination.

15. Requests from public authorities

15.1 Voidhash does not disclose Customer Personal Data to a public authority unless required to do so by binding law. If Voidhash receives a legally binding request:

(a) it tries to redirect the authority to request the data directly from the Customer;

(b) it notifies the Customer promptly and provides a copy of the request, unless prohibited by law; if prohibited, it uses reasonable efforts to obtain a waiver of the prohibition;

(c) it assesses the legality of the request and challenges it where, after careful assessment, it concludes that there are reasonable grounds to consider it unlawful under the law applicable to it, applicable international obligations or principles of international comity, including where the request conflicts with Union law (Article 48 GDPR);

(d) it discloses only the minimum amount of data permissible under a reasonable interpretation of the request; and

(e) it documents the request and its response and, to the extent permitted, makes this information available to the Customer.

15.2 Voidhash does not voluntarily create mechanisms that give public authorities access to Customer Personal Data. More information on safeguards against unlawful international access is available at https://voidhash.com/legal/international-access.

16. Return and deletion

16.1 During the term. The Customer can export Customer Personal Data through the API and erase it using the tools in Section 10.2 at any time. Customer Personal Data is retained in accordance with the Customer's Instructions and the Retention Period defined in the Terms (Article 12.6), as described in Annex I, part E, which also sets out when Voidhash may delete or aggregate data during the term.

16.2 After termination. On termination of the Terms, the following applies, consistently with the data portability and switching provisions in Article 18 of the Terms (https://voidhash.com/legal/terms) and https://voidhash.com/legal/data-portability:

(a) the Customer may export Customer Personal Data during the Retrieval Period defined in Article 18.9 of the Terms (at least 30 days after any transitional period for switching); on request, Voidhash provides the data in a structured, commonly used and machine-readable format, which fulfils Voidhash's obligation to return the data;

(b) after the Retrieval Period ends, Voidhash deletes all Customer Personal Data, including copies held by Subprocessors, within 30 days, and confirms the deletion in writing on request; and

(c) copies in backups are deleted on their regular rotation and are not restored except for disaster recovery, in which case data already deleted is deleted again.

16.3 Voidhash may retain Customer Personal Data where Union or Member State law requires storage, only for as long as required, and continues to protect it in accordance with this DPA. Technical logs that may contain identifiers are deleted on their ordinary 30-day rotation.

16.4 Anonymised Data is not affected by this Section.

17. Liability

17.1 Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms. Liability under this DPA and the Terms is aggregated and not cumulative.

17.2 Section 17.1 does not limit (a) liability that cannot be limited under applicable law, including liability for harm caused intentionally or through gross negligence or for harm to a person's natural rights (§ 2898 of the Czech Civil Code); (b) either party's liability to data subjects under Article 82 GDPR or under the SCCs; or (c) a party's own liability for administrative fines imposed on it.

17.3 Where both parties are liable to a data subject for the same damage and one party has paid full compensation, it may claim back from the other party the part of the compensation corresponding to the other party's share of responsibility (Article 82(5) GDPR).

18. Order of precedence

18.1 In the event of a conflict, the following order applies: (a) the SCCs, including the UK Addendum and the Swiss adjustments; (b) this DPA, including Annex V for matters governed by US State Privacy Laws; (c) the Terms. An Enterprise order form or signed amendment that expressly amends this DPA prevails over this DPA, but not over the SCCs.

18.2 Nothing in this DPA or the Terms is intended to modify or contradict the SCCs or to prejudice the fundamental rights or freedoms of data subjects.

19. Term, changes and final provisions

19.1 Term. This DPA takes effect when the Terms are accepted and remains in force for as long as Voidhash processes Customer Personal Data, including after termination of the Terms until deletion under Section 16. Provisions that by their nature are intended to survive termination survive it.

19.2 Changes. Voidhash may change this DPA in accordance with the change procedure in the Terms, including at least 30 days' notice and the Customer's right to reject the change and terminate free of charge before it takes effect. Changes required by law, by a decision or guidance of a supervisory authority, or by new standard contractual clauses may take effect sooner if necessary. Voidhash will not use a change to reduce the overall level of protection of Customer Personal Data. A DPA signed under Section 1.2 can be changed only by written agreement, except for changes required by law.

19.3 Governing law and courts. This DPA is governed by the law and subject to the jurisdiction provided for in the Terms (Czech law; the courts of the Czech Republic), except where the SCCs provide otherwise.

19.4 Language. This DPA is made in Czech and English. For Customers with their registered office in the Czech Republic, the Czech version prevails; for other Customers, the English version prevails.

19.5 Severability. If any provision of this DPA is invalid or unenforceable, the remaining provisions remain in effect, and the invalid provision is replaced by a valid provision that comes closest to its purpose.

19.6 Contacts. We have not appointed a data protection officer. For any data protection matter, contact us at legal@voidhash.com. This is the single contact address for this DPA, including data subject requests, Personal Data Breaches, security matters, audit requests and objections to Subprocessors, is legal@voidhash.com. Voidhash sends notices under this DPA to the email addresses of the owners of the Customer's account.

For Enterprise customers who sign this DPA (optional):

Annex I — Description of the processing

A. Parties

B. Subject matter, nature and purpose

1. Subject matter: provision of the hosted Service under the Terms.
2. Nature of the processing: collection through the SDKs and the API; storage; organisation and structuring; enrichment of requests with approximate location derived from the IP address; matching of identities; validation of purchases with app stores and payment providers; calculation of entitlements; aggregation and analysis for reports, cohorts, experiments and feature flags; delivery of paywalls, flows, push notifications and webhooks; consultation by the Customer's users; erasure.
3. Purposes: to enable the Customer (a) to validate in-app and web purchases and manage End Users' subscriptions and entitlements; (b) to design, deliver and test paywalls, flows and components; (c) to measure product usage and revenue; (d) to run experiments and feature flags; (e) to send push notifications and webhooks; and (f) to use the AI features, where the Customer uses them.
4. Frequency: continuous, for as long as the Customer uses the Service.

C. Categories of data subjects

1. End Users of the Customer's apps, websites and other products in which the SDKs or the API are used, including anonymous (not signed-in) users and visitors.
2. End Users who receive push notifications or interact with paywalls.
3. Other individuals whose personal data the Customer chooses to include in Customer Data or Customer Content (for example persons appearing in paywall images or testimonials) — optional, customer-controlled.

D. Categories of personal data

Legend for the "Collection" column: Automatic — collected whenever the relevant SDK or feature is used; Feature — collected only if the Customer uses the relevant feature; Customer-controlled — collected only if the Customer explicitly sends it; its content is determined by the Customer.

IP addresses. The full IP address is received with every SDK and API request and is stored with events. It is used (a) to derive approximate location (country, region, city and time zone); (b) for security and for the prevention of fraud and abuse; and (c) where offered, to recognise the same End User across the Customer's own apps and websites (identity resolution). Voidhash never links End Users across different customers. The Customer discloses these uses in its own privacy notices (Section 6.2).

Data not collected by the SDKs: IDFA, IDFV, Google Advertising ID, Android ID, contacts, precise (GPS) location, photos, microphone or camera data. The SDKs store identity and cache data locally on the device (iOS: UserDefaults; Android: SharedPreferences; web: localStorage of the Customer's website).

Special categories of data: none intended; prohibited under Section 6.6.

E. Duration and retention

1. Customer Personal Data is processed for the term of the Terms and until deletion under Section 16.
2. Retention Period has the meaning given in the Terms (Article 12.6): Free plan 3 years; Grow plan 5 years; Enterprise plan as agreed in the Order Form. An Enterprise Customer may agree a shorter period.
3. Event-level analytics data (events, sessions, screen views, custom events and their properties) is kept for at least the Retention Period, counted from when each event occurred. After that, Voidhash may delete it or replace it with aggregated statistics that no longer identify End Users (Section 5); Voidhash is not obliged to keep it longer.
4. Aggregated reports (revenue, MRR, conversion, retention and cohort charts) remain available for the life of the Customer's account.
5. Purchases, transactions, subscriptions and entitlements are kept for the life of the Customer's account, because access decisions and revenue history depend on them, unless the Customer erases the End User or closes the account.
6. Persons with no activity for longer than the Retention Period may be deleted.
7. Voidhash notifies the Customer at least 30 days before it first deletes data of a Project under points 3 or 6, so that the Customer can export it. On a downgrade, the new plan's Retention Period applies, with the same notice.
8. The Customer can erase End Users at any time (Section 10.2).
9. After termination of the Terms, Section 16 applies instead of points 2 to 7.
10. Technical logs and traces that may contain identifiers: 30 days.
11. Backups: deleted on their regular rotation.

F. Tools to limit processing

The Customer can limit the processing of Customer Personal Data in particular by:

1. not calling identify with an email address or name, and using a pseudonymous external user id;
2. not sending custom events, properties or traits that are not needed, and not adding form fields to paywalls;
3. disabling usage analytics or automatic events, for example for End Users who have not given consent, using the controls described at https://voidhash.com/legal/sdk-data;
4. not enabling features (push, webhooks, Stripe, AI features) it does not need;
5. erasing End Users individually through Studio or the API (Section 10.2).

G. Transfers and competent supervisory authority

1. Transfers to Subprocessors: as listed in Annex III, on the basis described in Annex IV.
2. Competent supervisory authority: Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 727/27, 170 00 Prague 7, Czech Republic, https://uoou.gov.cz.

Annex II — Technical and organisational measures

The measures below describe what is in place at the effective date of this DPA. Voidhash does not hold any security certification (such as ISO/IEC 27001 or SOC 2) and does not claim compliance with such standards.

1. Pseudonymisation and encryption (Art. 32(1)(a) GDPR)

1.1 Data is encrypted in transit between the SDKs, the API, the dashboard and the Service.

1.2 Voidhash's hosting providers encrypt stored data.

1.3 Credentials for Customer Integrations (for example App Store and Google Play keys, Stripe keys, APNs and FCM credentials) are additionally encrypted at the application level.

1.4 The identifier passed to Apple and Google with purchases is a derived token, not the Customer's user identifier; by default the SDKs use random anonymous identifiers and do not read device advertising identifiers.

2. Confidentiality, integrity, availability and resilience (Art. 32(1)(b) GDPR)

2.1 Tenant isolation. All Customer Data is scoped to an organisation and project; every API request and database query is restricted to the organisation and project of the authenticated key or user.

2.2 Access control for Customer users. Sign-in is handled by an authentication provider (WorkOS) with email and password or GitHub, Google or Microsoft sign-in, and SSO/SAML/SCIM for Enterprise customers. Access within the Service is governed by role-based permissions within each organisation. API keys can be revoked and show their last use.

2.3 Access control for Voidhash personnel. Access to production systems is restricted to authorised personnel on a least-privilege basis and is removed when no longer needed.

2.4 Audit log. Changes to configuration within the Service are recorded in an audit log available to the Customer (actor, entity, action and changes).

2.5 Protection of the perimeter. Traffic is served through Cloudflare, which provides TLS termination and protection against denial-of-service attacks; the API requires authentication and applies usage limits.

2.6 Secrets management. Production secrets are kept outside source code, and repositories are scanned for leaked secrets.

2.7 Integrity. Purchase data is validated against signed transactions from Apple and the providers' official APIs; webhooks sent to Customer endpoints are signed with HMAC so that the Customer can confirm their origin.

3. Restoring availability and access (Art. 32(1)(c) GDPR)

3.1 Databases are backed up by the managed database providers; backups are kept for a limited period and deleted on their regular rotation.

3.2 Voidhash responds to security incidents by containing, investigating and remedying them and notifies Customers in accordance with Section 11.

4. Regular testing, assessment and evaluation (Art. 32(1)(d) GDPR)

4.1 Every code change is reviewed before release and passes automated tests and checks in continuous integration.

4.2 Dependencies are scanned automatically for known vulnerabilities.

4.3 Much of the Service's code, and all SDKs, are open source and can be reviewed publicly.

4.4 Vulnerabilities can be reported to legal@voidhash.com; reports are triaged and fixed according to severity.

5. Organisational measures

5.1 Personnel are bound by confidentiality (Section 7).

5.2 Subprocessors are selected after assessment of their security and data protection practices and are bound by data processing agreements (Section 9).

5.3 Technical logs and traces are retained for 30 days.

5.4 Privacy by design: the SDKs do not read advertising identifiers; optional data (email, name, traits, form inputs) is collected only when the Customer sends it; End Users can be erased with a self-service tool.

6. Measures to assist the Customer

The tools described in Section 10.2 and Annex I, part F.

Annex III — Subprocessors

The current list of Subprocessors, including any changes notified under Section 9, is maintained at https://voidhash.com/legal/subprocessors. The list below reflects the state at the effective date of this DPA; the Subprocessor Page prevails if it is more recent.

Annex IV — International transfer mechanisms

1. Overview

Voidhash does not rely on the derogations in Article 49 GDPR for regular transfers.

2. Status of the Data Privacy Framework

The EU–US Data Privacy Framework remains in force. The General Court dismissed the action against it in case T-553/23 Latombe v Commission on 3 September 2025; an appeal (case C-703/25 P) is pending. Voidhash monitors the proceedings and relies on the SCCs as a fallback (Section 14.5).

3. Transfers to Subprocessors (Module 3)

Voidhash's transfers to Subprocessors are governed by the SCCs (Module 3) or by DPF-based terms in Voidhash's agreements with each Subprocessor. Voidhash assesses the laws and practices of the destination country for each transfer, taking into account the supplementary measures in Annex II (encryption in transit and of stored data, application-level encryption of credentials, access control, data minimisation and the process in Section 15), and makes the relevant information available to the Customer on request.

4. Module 4 (Voidhash → Customer outside the EEA)

Where Section 14.3 applies, the SCCs (Module 4) are completed as follows:

(a) Parties: Voidhash is the data exporter; the Customer is the data importer; (b) Clause 7 (docking clause): applies; (c) Clause 11(a): the optional language does not apply; (d) Clause 17: the SCCs are governed by the law of the Czech Republic; (e) Clause 18: disputes are resolved by the courts of the Czech Republic; (f) Annex I.A and I.B: Annex I of this DPA; (g) Annex II (where applicable): Annex II of this DPA.

5. UK Addendum

For Restricted Transfers under UK Data Protection Law, the SCCs are supplemented by the UK Addendum, completed as follows: Table 1 — the parties and contacts in Annex I.A; Table 2 — the modules and clause options selected above; Table 3 — Annexes I to III of this DPA; Table 4 — both the importer and the exporter may end the UK Addendum as permitted by its Section 19.

6. Swiss adjustments

For Restricted Transfers subject to the FADP: (a) the Swiss Federal Data Protection and Information Commissioner (FDPIC) is the competent supervisory authority insofar as the transfer is governed by the FADP; (b) references to the GDPR are to be read as references to the FADP insofar as the transfer is governed by the FADP; (c) the term "Member State" in Clause 18(c) must not be interpreted in a way that excludes data subjects in Switzerland from bringing claims at their place of habitual residence; and (d) the governing law and forum remain as set out above.

Annex V — US State Privacy Laws Addendum

1. Scope and definitions

1.1 This Annex applies to the extent Voidhash processes Customer Personal Data that is subject to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its regulations (Cal. Civ. Code § 1798.100 et seq. and Cal. Code Regs. tit. 11, § 7000 et seq.) ("CCPA"), or to other comprehensive US state privacy laws, including those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with comparable laws (together, "US State Privacy Laws").

1.2 The terms "business", "business purpose", "commercial purpose", "consumer", "contractor", "deidentified", "personal information", "sell", "share", "service provider" and "processor" have the meanings given in the applicable US State Privacy Law. "Customer Personal Data" includes personal information processed under this Annex.

2. Roles

2.1 For the purposes of the CCPA, the Customer is a business and Voidhash is a service provider (Cal. Civ. Code § 1798.140(ag)). For the purposes of other US State Privacy Laws, the Customer is a controller and Voidhash is a processor.

2.2 The Customer discloses Customer Personal Data to Voidhash only for the limited and specified business purposes set out in Section 3.

3. Specified business purposes

Voidhash processes Customer Personal Data only to provide the Service to the Customer as described in the Terms and in Annex I, part B, namely: validating purchases and managing subscriptions and entitlements; delivering paywalls, flows and components; measuring product usage and revenue for the Customer; running experiments and feature flags; sending push notifications and webhooks; providing AI features at the Customer's request; providing support; and the purposes permitted for service providers under Cal. Code Regs. tit. 11, § 7050(a), including security and fraud prevention, debugging, and improving the Service without building profiles for use in providing services to another business.

4. Service provider obligations (Cal. Civ. Code § 1798.100(d) and § 1798.140(ag); Cal. Code Regs. tit. 11, § 7051(a))

Voidhash:

(a) does not sell or share Customer Personal Data;

(b) does not retain, use or disclose Customer Personal Data for any purpose other than the business purposes specified in Section 3, including for any commercial purpose other than those business purposes, or as otherwise permitted by the CCPA;

(c) does not retain, use or disclose Customer Personal Data outside the direct business relationship between Voidhash and the Customer;

(d) does not combine Customer Personal Data with personal information it receives from or on behalf of another person or collects from its own interaction with the consumer, except as permitted by the CCPA and its regulations;

(e) complies with the obligations applicable to it as a service provider under the CCPA and provides the same level of privacy protection as required of businesses by the CCPA, including by implementing reasonable security measures (Annex II) and cooperating with the Customer in responding to consumer requests (Section 10);

(f) notifies the Customer no later than 5 Business Days after it determines that it can no longer meet its obligations under the CCPA;

(g) grants the Customer the right to take reasonable and appropriate steps to ensure that Voidhash uses Customer Personal Data in a manner consistent with the Customer's obligations under the CCPA, including through the information and audits under Section 13; and

(h) grants the Customer the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorised use of Customer Personal Data.

5. Subcontractors

Voidhash engages subcontractors (Subprocessors) in accordance with Section 9, notifies the Customer of them, and binds them by written contracts that impose the obligations of this Annex.

6. Consumer requests

Voidhash enables the Customer to comply with consumer requests through the tools in Section 10.2 and informs the Customer of requests it receives in accordance with Section 10.3. Voidhash is not required to delete personal information where an exception under Cal. Civ. Code § 1798.105(d) applies, in which case it informs the Customer.

7. Deidentified information

Where Voidhash creates deidentified information from Customer Personal Data (Section 5), it (a) takes reasonable measures to ensure that the information cannot be associated with a consumer or household; (b) publicly commits to maintain and use the information only in deidentified form and not to attempt to re-identify it; and (c) contractually obligates any recipient to comply with the same requirements (Cal. Civ. Code § 1798.140(m)).

8. Processor obligations under other US State Privacy Laws

To the extent other US State Privacy Laws apply (for example Va. Code § 59.1-579, Colo. Rev. Stat. § 6-1-1305, Conn. Gen. Stat. § 42-521, Tex. Bus. & Com. Code § 541.104 and Utah Code § 13-61-301), Voidhash:

(a) processes Customer Personal Data only on the Customer's Instructions, which set out the nature and purpose of the processing, the type of data, the duration and the rights and obligations of both parties (this DPA and Annex I);

(b) ensures that each person processing Customer Personal Data is subject to a duty of confidentiality;

(c) at the Customer's direction, deletes or returns Customer Personal Data at the end of the provision of services, unless retention is required by law (Section 16);

(d) makes available all information in its possession necessary to demonstrate compliance and allows and cooperates with reasonable assessments by the Customer or its designated assessor, or alternatively arranges, at least annually and at its expense, for a qualified and independent assessor to assess its measures and provides the report on request (Section 13);

(e) engages subcontractors only under a written contract imposing the same obligations and after giving the Customer an opportunity to object (Section 9);

(f) assists the Customer, taking into account the nature of the processing, in responding to consumer rights requests, in meeting its obligations regarding security and notification of security breaches, and in conducting data protection assessments (Sections 10 to 12).

9. Certification

Voidhash certifies that it understands the restrictions in this Annex and will comply with them.

10. No sale or sharing

The parties acknowledge that the Customer's disclosure of Customer Personal Data to Voidhash does not constitute a sale or sharing of personal information and that the Customer does not receive any monetary or other valuable consideration from Voidhash for it.