Tapbound

Legal

Data Processing Agreement (DPA)

Last updated 18 August 2026

1. Scope and applicability

This Data Processing Agreement (“DPA”) governs the processing of personal data by SkyWay Mark Trading Ventures (TapBound.com) (“Processor”) on behalf of the customer (“Controller”) in connection with the Tapbound website-to-app conversion platform and related services.

2. Roles and processing details

The Controller determines the purposes and means of processing personal data within their website and mobile applications. The Processor processes personal data solely on documented instructions from the Controller, including with respect to transfers of personal data to a third country or international organisation.

  • Subject Matter: Provision of mobile app generation, build artifact delivery, optional push notification routing, and related platform management services.
  • Categories of Data: User account credentials, email addresses, site metadata, app branding configurations, temporary build logs, and communication records.
  • Categories of Data Subjects: Customer employees, contractors, and authorized platform users.

3. Technical and organizational measures

Processor maintains state-of-the-art security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access:

  • AES-256-GCM encryption for all sensitive credentials at rest with HKDF-derived unique per-item keys.
  • TLS 1.3 encryption in transit across all endpoints with HSTS.
  • Strict database least-privilege access, audit logging, and automated credential purging upon submission termination.

4. Subprocessors

Controller grants general authorization to Processor to engage sub-processors to assist in delivering the services. An up-to-date list of sub-processors is available at tapbound.com/subprocessors.

5. Data deletion and assistance

Upon termination of services or upon Controller’s request, Processor will delete or return all personal data in accordance with the account retention and deletion schedule, unless applicable law requires continued storage.