Privacy Policy

1. Who we are and what this policy covers

Gharial is a service operated by Rootlake LLC, a Wyoming limited liability company (“Gharial”, “we”, “us” or “our”). Rootlake LLC is the controller of the personal data described here. Our contact details are in Section 15.

Gharial provides a software development kit (the “SDK”) that app developers (“publishers”) add to their Android and iOS apps. With the consent of the person using the app, the SDK measures the quality of the mobile network on that device. We pay publishers for it.

This policy covers three groups of people:

• App users: people who use an app that includes the SDK. See Section 3.
• Publishers: the developers and companies that join Gharial, and their staff. See Section 4.
• Visitors to gharialdata.com. See Section 5.

It does not cover what a publisher’s app collects for itself. Each app has its own privacy policy for that.

United States. The SDK is not meant for devices in the United States. We do not collect, keep or share data from devices located there: records that come from the United States are discarded when they reach our systems, before anything is stored.

2. Our role

For the data the SDK collects, we and the publisher of the app each decide part of the processing: the publisher chooses to include the SDK and asks for your consent, and we decide how the SDK works and what the data is used for. Where the GDPR, the UK GDPR or a similar law applies, we and the publisher are joint controllers of that data. In short, the arrangement between us is this:

• The publisher asks for your consent, lets you withdraw it, and tells you about the SDK in its own privacy policy.
• Gharial operates the SDK, keeps this policy accurate, protects the data it holds, and answers requests about it.
• You may use your rights against either of us. We help each other to answer.

For publisher and visitor data, we are the only controller.

3. App users: data collected through the SDK

3.1 What the SDK collects

With your consent, the SDK may collect from your device:

• A pseudonymous identifier for your device. It is not your name, email address or phone number.
• On Android, the resettable advertising identifier of the operating system. It is used only to recognise the same device across measurements and to detect fraud, not for advertising. You can reset or delete it in your device settings. On iOS, the SDK does not read the advertising identifier.
• Information about your mobile network and connection: carrier, signal strength, network technology, connection type (mobile or Wi-Fi), whether a VPN is in use, download and upload speed and latency.
• The approximate or precise location of each measurement. Precise location is collected only if you have also granted the app the location permission of your device.
• Information about your device: manufacturer, model, operating system and version.
• The identifier of the app that includes the SDK.
• Your IP address, which our servers receive with each transmission.

3.2 What the SDK does not collect

The SDK does not collect your name, email address, postal address or phone number. It does not read your contacts, calls, messages, photos, videos or files. It does not record what you do in other apps or which websites you visit.

3.3 Why we use it

The data is used to:

• Measure and improve the performance, coverage and quality of mobile networks.
• Provide network analytics to telecommunications operators, regulators and similar organisations.
• Detect and prevent fraud and abuse of the SDK, and calculate what we pay the publisher.

It is not used for advertising, for ad targeting or for marketing profiles, and it is not used to identify you.

3.4 Lawful basis

We process this data on the basis of your consent (Article 6(1)(a) of the GDPR and the UK GDPR, and the consent rules of other laws that apply, such as the Digital Personal Data Protection Act 2023 of India). The SDK collects nothing until the app has recorded your consent, and it stops when you withdraw it.

3.5 Giving and withdrawing consent

The publisher of the app asks for your consent before the SDK starts. You can withdraw it at any time:

• In the privacy settings of the app.
• By turning off the location permission, or resetting the advertising identifier, in your device settings. This limits what the SDK can collect.
• By writing to the publisher of the app.
• By writing to us at privacy@gharialdata.com.

Withdrawing consent does not affect processing that took place before.

3.6 Who receives it

We share the data collected through the SDK with:

• Network analytics partners: companies that analyse mobile network performance for telecommunications operators, regulators and similar organisations. They may use the data only for the purposes in Section 3.3. We do not publish their names here, because the list changes and our agreements with them are confidential. If you ask us, we will tell you which partners have received data linked to your device.
• Service providers that operate parts of the service for us, such as the infrastructure that receives the SDK’s measurements, and cloud hosting. They act on our instructions under written agreements.

Section 6 lists every category of recipient.

3.7 How long we keep it

We keep measurements that can be linked to a device identifier for up to 12 months. After that we delete them or keep them only in an aggregated form that cannot be linked to a device. Our partners keep the data they receive under their own retention rules, within the limits of our agreements with them.

We keep a record of each consent (when it was given, in which app and how) for as long as we may need it to show that the processing was lawful.

3.8 Children

The SDK is not meant for children. Publishers must not use it in apps directed to children: see Section 11.

4. Publishers

4.1 What we collect

When you create and use a Gharial account, we collect:

• Account details: name, email address, password (stored as a hash by our authentication provider), country, language, account type, company name and website.
• Business details: legal name, registration number, tax identifier, phone number and address.
• Payout details: payment method, account holder, bank name and country, account number or IBAN, and SWIFT or local bank code.
• Identity verification: before the first payment, an identity verification provider checks who you are. For a person, the provider collects an image of an identity document and a selfie or short video, compares them, and screens the name against sanctions and watchlists. For a company, it checks the company register, company documents and the people who own or control the company. The images, and any biometric comparison, stay with the provider. We receive the result and a few facts to compare with your business details: the name and type of the document, its country, nationality and date of birth, or for a company the registered name, number, status and key people, and whether the screening found a match.
• Your apps: name, platform, package name or bundle ID, store listing details such as the icon, the developer name and the public developer contact email, and the usage numbers the SDK reports for each app.
• Security records: the IP address and country of your sign-up, and a log of sign-ins, security events and changes to your account, business and payout details.
• Messages you send us.

4.2 Why we use it

We use this data to create and run your account, to confirm that an app is yours, to verify who you are and meet our duties under sanctions and anti-money-laundering rules, to calculate and pay what you earn, to keep tax and accounting records, to prevent fraud and abuse, to give you support, and to send you notices about the service.

4.3 Lawful basis

• Contract (Article 6(1)(b)): running your account and paying you.
• Legal obligation (Article 6(1)(c)): tax and accounting records, and sanctions checks.
• Legitimate interests (Article 6(1)(f)): preventing fraud, securing the service, verifying identity before payment, and improving the service. We have weighed these interests against yours.
• Consent, where the identity verification provider processes biometric data: the provider asks for it on its own screen before the check.

4.4 Emails to the developer contact of an app

To confirm that an app belongs to the publisher who added it, we may send one email to the developer contact address that the app store publishes for that app. We use that address only for this, and we do not send it again within 24 hours.

5. Visitors to our website

Our website sets no analytics or advertising cookies. Our hosting provider receives your IP address, browser type and the pages you request, in order to deliver the site and keep it secure. We use this for that purpose only, on the basis of our legitimate interests.

The dashboard at app.gharialdata.com uses only the cookies it needs to work: one that keeps you signed in, and one that remembers your language. The sign-up and sign-in pages use a bot protection service, which checks signals from your browser to tell people from automated traffic.

6. Who we share personal data with

We do not sell publisher or visitor data, and we do not share it for advertising.

A list of the service providers we use, and where they process data, is available on request at privacy@gharialdata.com.

7. International transfers

We are based in the United States. We, our partners and our service providers process personal data in several countries, including the United States, the United Kingdom, countries of the European Economic Area and India.

When personal data of a person in the European Economic Area, the United Kingdom or Switzerland is transferred to a country that has not been recognised as giving adequate protection, we rely on the European Commission’s Standard Contractual Clauses of 4 June 2021 and the United Kingdom’s International Data Transfer Addendum, with additional safeguards where they are needed. You can ask us for a copy of the safeguards that apply.

8. Security

We protect personal data with measures that fit the risk. They include encryption in transit and at rest, access limited by role with sign-in records, separate environments, two-step sign-in for staff, and review of changes before release. Payout details in full can be seen only by the staff who make payments.

No system is completely secure. If a breach is likely to put your rights at risk, we will tell you and the authorities as the law requires.

9. How long we keep personal data

A valid deletion request overrides these periods, unless the law requires us to keep the data.

10. Your rights

10.1 Everyone

Whatever country you are in, you can ask us what personal data we hold about you, ask us to correct or delete it, and withdraw a consent you gave. Write to privacy@gharialdata.com. We do not charge for this, unless a request is clearly unfounded or excessive.

10.2 European Economic Area, United Kingdom and Switzerland

You have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, to withdraw consent at any time, and to complain to your data protection authority. We answer within one month. We may extend this by two months for a complex request, and we will tell you if we do.

10.3 United States

The SDK does not collect data from devices in the United States (see Section 1), so the only personal information we hold about people there is that of publishers and website visitors. We do not sell it, and we do not share it for cross-context behavioural advertising.

If you live in a state with a consumer privacy law, such as California, you have the right to know what we hold about you, to have it corrected or deleted, and not to be treated differently for using these rights. You may use an authorised agent, and we will ask for proof of the authorisation. We answer within 45 days.

10.4 India

Under the Digital Personal Data Protection Act 2023 you have the right to a summary of your personal data and of how it is processed, to correction and erasure, to withdraw consent, to have a complaint dealt with, and to nominate a person to act for you. Send a complaint to privacy@gharialdata.com first. If our answer does not resolve it, you may go to the Data Protection Board of India.

10.5 Using your rights over SDK data

The SDK does not know your name or email address. It knows your device by an identifier. To find your data we need one of these:

• The advertising identifier of your device (on Android: Settings, then Google, then Ads).
• The name of the app and roughly when you used it, so that we can work with its publisher to find the identifier.

Send it to privacy@gharialdata.com. We will delete the data linked to it, add the identifier to a suppression list so that nothing more is kept, and ask the partners who received it to delete it as well. We confirm receipt within 5 business days.

11. Children

Gharial is not meant for children. Publishers must not use the SDK in apps directed to children: under 18 in India, under 16 in the European Economic Area unless the country sets a lower age, under 13 in the United Kingdom, or a higher age where local law sets one. We do not collect age or date of birth through the SDK, and we do not knowingly process the data of children.

If you think the SDK has collected data from a child, write to privacy@gharialdata.com. We will look into it and delete the data.

Publisher accounts are for adults aged 18 or over.

12. Automated decisions

We use automated checks to detect invalid traffic and fraud, and an automated identity check before the first payment. A person reviews any decision to refuse, suspend or close a publisher account. We make no automated decisions about app users.

13. Representatives in the European Union and the United Kingdom

If you are in the European Union or the United Kingdom, you can also contact our representative under Article 27 of the GDPR and the UK GDPR:

European Union: Euverify Ltd (Ireland), Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland. Email: gdpr@euverify.com

United Kingdom: Euverify Ltd (UK), 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom. Email: gdpr@euverify.com

14. Changes to this policy

We may update this policy. The date and version at the top show the latest change. If a change is material, we tell publishers by email or on the dashboard before it takes effect, and we update the text that publishers show to app users where needed.

15. Contact

Gharial is operated by:

Rootlake LLC
30 N Gould St Ste N
Sheridan, WY 82801
United States

Privacy: privacy@gharialdata.com
Legal: legal@gharialdata.com