Error

Privacy Policy

Download

Table of Contents


Privacy Policy

The Branch Guiding Privacy Principles

Branch is a deep linking and attribution analytics platform for app and website developers. We are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. We further describe our privacy practices in the official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect to provide our services is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs to provide our services. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from providing Branch with any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Customers who subscribe to our linking and analytics platform can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell customer end user data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with the CCPA and GDPR requirements.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.

Introduction

Top
Branch Metrics, Inc. ( "Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices ("Digital Properties")--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our linking and analytics products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from vendors and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.
Branch and its Clients have entered into an agreement that governs the provision of Services by Branch and their use by Clients ("Agreement(s)"). Such Agreements may contain obligations on the parties with respect to the handling of information processed in the Services. Nothing in this Privacy Policy derogates from such obligations.

Collection and Use of Information from Our Services

What Information Does Branch Collect from Our Services?

Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

The Branch Services: Overview

Branch provides a variety of Services intended to help Clients understand the use of their Digital Properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience. For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly. For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the Client’s tracked platforms with the purpose of driving more engagement to the Client. For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to disclose to Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to disclose to Branch. We prohibit Clients from providing us with data relating to children under 13 (or, in certain jurisdictions, under 18).
Branch collects data through various methods, including:
  • When the Client integrates Branch’s SDK’s, API’s, pixels, redirect links, JavaScript tags, cookies or similar data collection technologies into their Digital Properties and/or ads;
  • From the various advertising networks and third parties that are used by the Client in connection with the measurement and analysis of Client’s marketing campaigns and that have partnered with Branch;
  • When provided voluntarily by the Client as part of the Branch account registration process.
Clients are also required to inform us if they are using Branch’s Services to analyze information protected by HIPAA so that Branch can process such information in a protected environment. In the charts below, we summarize the information collected automatically by the Services.

Information Collected By Branch Links, Pixels, and Similar Technologies

Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”). Since Clients have sole control over their Digital Properties and configuration of the Services, Clients are contractually prohibited from configuring the Services to collect directly identifiable personal information , unless otherwise agreed by Branch. If a Client has configured the Services to collect directly identifiable personal information, then Branch may receive and process such data. This includes, for example, a Client using an End User’s email address as a Client issued Developer ID.

Type of Information Collected
Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.

Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).

Information Collected by Branch SDKs

SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:

Type of Information Collected
Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version

Metadata feature used for device identification and attribution
Internet connection typeMetadata feature used for device identification and attribution
Application versionMetadata feature used for device identification and attribution
Device modelMetadata feature used for device identification and attribution
Manufacturer / BrandMetadata feature used for device identification and attribution
Operating systemMetadata feature used for device identification and attribution
Screen size (height, width)Metadata feature used for device identification and attribution
Screen resolutionMetadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)Metadata feature used for device identification and attribution
Device locale (country and language)Metadata feature used for device identification and attribution
Local IP addressMetadata feature used for device identification and attribution
Mobile platformMetadata feature used for device identification and attribution
Branch SDK versionMetadata feature used for device identification and attribution
Developer ID(optional) Client-supplied unique identifier; metadata feature used for device identification and attribution
Carrier IDMetadata feature used for device identification and attribution
EnvironmentMetadata feature used for device identification and attribution
UI ModeMetadata feature used for device identification and attribution
Engagement DataInformation relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.
Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).

In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution
As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) that have partnered with Branch to provide certain Engagement Data to Branch on the Client’s behalf in connection with the measurement and analysis of the Client's marketing campaigns.

How Does Branch Use Information Collected by Our Services?

Subject to Agreements with our Clients, data that Branch collects through the Services is processed to provide, maintain, optimize, research and improve the Services we provide our Clients, including to support other Branch products and services, to perform anti- fraud protection analysis, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
Where authorized by Agreements with our Clients, we may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any other parties, including business partners, Clients, and/or others.

Our Clients’ Use of Information

Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their Digital Properties to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to disclose information about a hotel that she found in a travel app to a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being disclosed from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions, Agreements, or other contracts with us. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.

User Choices

Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”). NAI provides you with the opportunity to opt-out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
NAI OTT/CTV Opt-Out: NAI provides you with the opportunity to opt-out of digital advertising data collection on various connected streaming devices to the extent that the device manufacturer will allow. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Global Privacy Control: Please note that we also respond to and abide by opt-out preference signals sent through the Global Privacy Control. Any opt out preferences you have exercised through these methods will only apply to the specific device/browser on which you made them. For more information on how to use the Global Privacy Control, see www.globalprivacycontrol.org.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.

Collection and Use of Information from Our Website and for Marketing Purposes

What Information Does Branch Collect about Website Visitors and Potential Customers?

Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io ( the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

What We Collect from Clients that Use the Website

Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (other-party)
Other-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing Information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard

Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
We also require Clients to set up a user ID and unique password for account security purposes. Clients must not disclose their passwords to anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our payment and contract vendors.
Connection Information with Other Parties: Some features of the dashboard Services allow you to disclose your information through your accounts to other companies such as Facebook and Google. If you choose to connect Branch to such services provided by other parties, we may collect information related to your use of those services provided by other parties, such as authentication tokens that allow us to connect to your accounts with those other parties. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected services.
Information from Other Sources: In addition to the information collected through our Website, we or our vendors may obtain and disclose additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or databases maintained by other parties. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form, downloading content that we make available on the Website, or registering for or attending our events, programs, trainings, or contests. Such information we may receive may include contact and professional details about you which you have chosen to share with us including name, email address, phone number, office or other mailing address, and professional data including organization you are affiliated with, your job title, and industry. We use this information to answer your question(s) and process requests, and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage vendors to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website.
If your browser settings permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit https://www.cookiepro.com/knowledgebase/knowledge_categories/cookies- 101/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.

How Does Branch Use the Information Collected?

Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or other parties, or where required by law.

Opt-Out & Do Not Track - Your Choice Mechanisms

In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).

Opt-Out from Promotional Emails

You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by visiting our Preference Center. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.

Opt-Out from Website Cookies/Web Beacons

We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the "Do Not Track" settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies. Please note that "Do Not Track" is a different privacy mechanism than the Global Privacy Control browser choice referenced below.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.

Vendor Tools/Analytics on the Website

The Website utilizes tracking tools from vendors, which may enable these vendors to analyze our Website traffic for analytics purposes. Some of these vendors may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the parties who provide them, and your interactions with these features are governed by the privacy policies of the parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.
Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.

Policies Applicable to Both Our Services & Our Website

When does Branch Disclose Information?

In addition to the ways described in our Terms & Conditions, applicable Agreements, and this Privacy Policy, Branch may also disclose information to others under the following circumstances:
  • With vendors, consultants, global partners, and other parties who assist Branch to provide, support, and maintain the Services and the Website and need access to information we collect to do so;
  • With our Clients and their agents, as described in this Policy;
  • To other parties (such as advertising networks or vendors used by our Clients), as directed by our Clients;
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements;
  • To investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person;
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions;
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services; and
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Updating Your Information and Contact Preferences

We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings”
which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.

We Secure the Information We Collect

Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.
Branch implements technical and organizational measures designed to protect against unauthorized access, accidental loss, destruction or damage of Client’s data. For more information on our security controls, please see https://www.branch.io/security/. If you have questions about the security of your personal information, or if you have reason to believe that the personal information that we hold about you is no longer secure, please contact us immediately as described in this Privacy Policy.

Data Retention

Branch retains the information we collect through our Website and Services for no more time than is needed to serve the legitimate business purposes for which it was collected, or as necessary to comply with our legal obligations. When we have no ongoing legitimate business need to process your personal information we either delete it or pseudonymize it unless otherwise required by applicable law or otherwise agreed to between Branch and a Client.

Links to Other Websites

The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about websites or social media platforms operated by other parties. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.

International Data Transfers

All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. Data protection laws in the United States may differ from your country, and the data Branch processes may be accessible to law enforcement and national security authorities under certain circumstances. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Data Privacy Framework mechanism discussed in the “Data Privacy Framework For EU, UK, and Swiss Personal Data Transferred into the United States” section below.

Data Privacy Framework For EU, UK, and Swiss Personal Data Transferred into the United States

Branch complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-US Data Privacy Framework (Swiss-U.S. DPF) (collectively, “Data Privacy Frameworks”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to the Data Privacy Frameworks. Branch has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom in reliance on the UK Extension to the EU-U.S. DPF. Branch has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the policies in this Privacy Policy and data subject rights under the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the applicable Principles (“DPF Principles”) shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification page, please visit https://www.dataprivacyframework.gov/.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
The Federal Trade Commission has jurisdiction over Branch’s compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
Pursuant to the Data Privacy Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to other parties pursuant to the Data Privacy Frameworks unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Data Privacy Frameworks. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Data Privacy Frameworks, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union, UK, and Swiss individuals with DPF inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
1975 W El Camino Real Ste. 102
Mountain View, CA 94040
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://www.jamsadr.com/dpf-dispute-resolution for more information and to file a complaint. This service is provided free of charge to you.
If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/framework- article/ANNEX-I-introduction.

Your Rights

Under applicable law and depending on your jurisdiction, you may have the right to access, correct, erase and restrict the processing of your personal data. You may also have the right to object to Branch’s processing of your data or exercise other rights, all in accordance with applicable law.
You have the right to lodge complaints about our data processing activities by filing a complaint with our Data Protection Officer who can be reached by the “Contact Us” section below or with a supervisory authority.

California and Certain other U.S. States

The California Consumer Privacy Act of 2018 (“CCPA”) and applicable privacy laws of other U.S. States provide certain rights to natural persons who are residents of California or such other states. Our privacy notice for California and additional information for other states is available here.

Rights of Residents of the European Economic Area and United Kingdom

The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.

Lei Geral de Proteção de Dados

Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.

Our Policy Regarding Children

Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 18). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 18) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately as required by law.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 18. If you are under 18, please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 18 may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 18 through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 18, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information as required by law.

Contact Us, Questions, Changes to This Privacy Policy

We may change this Privacy Policy at any time at our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
1975 W El Camino Real
Ste. 102
Mountain View, CA 94040, USA
or by email at info@branch.io

Compliance

This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with this Privacy Policy.

Download

Table of Contents


Privacy Policy

The Branch Guiding Privacy Principles

Branch is a deep linking and attribution analytics platform for app and website developers. We are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. We further describe our privacy practices in the official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect to provide our services is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs to provide our services. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from providing Branch with any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Customers who subscribe to our linking and analytics platform can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell customer end user data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with the CCPA and GDPR requirements.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.

Introduction

Top
Branch Metrics, Inc. ( "Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices ("Digital Properties")--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our linking and analytics products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from vendors and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.
Branch and its Clients have entered into an agreement that governs the provision of Services by Branch and their use by Clients ("Agreement(s)"). Such Agreements may contain obligations on the parties with respect to the handling of information processed in the Services. Nothing in this Privacy Policy derogates from such obligations.

Collection and Use of Information from Our Services

What Information Does Branch Collect from Our Services?

Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

The Branch Services: Overview

Branch provides a variety of Services intended to help Clients understand the use of their Digital Properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience. For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly. For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the Client’s tracked platforms with the purpose of driving more engagement to the Client. For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to disclose to Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to disclose to Branch. We prohibit Clients from providing us with data relating to children under 13 (or, in certain jurisdictions, under 18).
Branch collects data through various methods, including:
  • When the Client integrates Branch’s SDK’s, API’s, pixels, redirect links, JavaScript tags, cookies or similar data collection technologies into their Digital Properties and/or ads;
  • From the various advertising networks and third parties that are used by the Client in connection with the measurement and analysis of Client’s marketing campaigns and that have partnered with Branch;
  • When provided voluntarily by the Client as part of the Branch account registration process.
Clients are also required to inform us if they are using Branch’s Services to analyze information protected by HIPAA so that Branch can process such information in a protected environment. In the charts below, we summarize the information collected automatically by the Services.

Information Collected By Branch Links, Pixels, and Similar Technologies

Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”). Since Clients have sole control over their Digital Properties and configuration of the Services, Clients are contractually prohibited from configuring the Services to collect directly identifiable personal information , unless otherwise agreed by Branch. If a Client has configured the Services to collect directly identifiable personal information, then Branch may receive and process such data. This includes, for example, a Client using an End User’s email address as a Client issued Developer ID.

Type of Information Collected
Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.

Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).

Information Collected by Branch SDKs

SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:

Type of Information Collected
Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version

Metadata feature used for device identification and attribution
Internet connection typeMetadata feature used for device identification and attribution
Application versionMetadata feature used for device identification and attribution
Device modelMetadata feature used for device identification and attribution
Manufacturer / BrandMetadata feature used for device identification and attribution
Operating systemMetadata feature used for device identification and attribution
Screen size (height, width)Metadata feature used for device identification and attribution
Screen resolutionMetadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)Metadata feature used for device identification and attribution
Device locale (country and language)Metadata feature used for device identification and attribution
Local IP addressMetadata feature used for device identification and attribution
Mobile platformMetadata feature used for device identification and attribution
Branch SDK versionMetadata feature used for device identification and attribution
Developer ID(optional) Client-supplied unique identifier; metadata feature used for device identification and attribution
Carrier IDMetadata feature used for device identification and attribution
EnvironmentMetadata feature used for device identification and attribution
UI ModeMetadata feature used for device identification and attribution
Engagement DataInformation relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.
Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).

In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution
As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) that have partnered with Branch to provide certain Engagement Data to Branch on the Client’s behalf in connection with the measurement and analysis of the Client's marketing campaigns.

How Does Branch Use Information Collected by Our Services?

Subject to Agreements with our Clients, data that Branch collects through the Services is processed to provide, maintain, optimize, research and improve the Services we provide our Clients, including to support other Branch products and services, to perform anti- fraud protection analysis, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
Where authorized by Agreements with our Clients, we may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any other parties, including business partners, Clients, and/or others.

Our Clients’ Use of Information

Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their Digital Properties to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to disclose information about a hotel that she found in a travel app to a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being disclosed from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions, Agreements, or other contracts with us. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.

User Choices

Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”). NAI provides you with the opportunity to opt-out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
NAI OTT/CTV Opt-Out: NAI provides you with the opportunity to opt-out of digital advertising data collection on various connected streaming devices to the extent that the device manufacturer will allow. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Global Privacy Control: Please note that we also respond to and abide by opt-out preference signals sent through the Global Privacy Control. Any opt out preferences you have exercised through these methods will only apply to the specific device/browser on which you made them. For more information on how to use the Global Privacy Control, see www.globalprivacycontrol.org.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.

Collection and Use of Information from Our Website and for Marketing Purposes

What Information Does Branch Collect about Website Visitors and Potential Customers?

Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io ( the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

What We Collect from Clients that Use the Website

Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (other-party)
Other-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing Information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard

Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
We also require Clients to set up a user ID and unique password for account security purposes. Clients must not disclose their passwords to anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our payment and contract vendors.
Connection Information with Other Parties: Some features of the dashboard Services allow you to disclose your information through your accounts to other companies such as Facebook and Google. If you choose to connect Branch to such services provided by other parties, we may collect information related to your use of those services provided by other parties, such as authentication tokens that allow us to connect to your accounts with those other parties. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected services.
Information from Other Sources: In addition to the information collected through our Website, we or our vendors may obtain and disclose additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or databases maintained by other parties. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form, downloading content that we make available on the Website, or registering for or attending our events, programs, trainings, or contests. Such information we may receive may include contact and professional details about you which you have chosen to share with us including name, email address, phone number, office or other mailing address, and professional data including organization you are affiliated with, your job title, and industry. We use this information to answer your question(s) and process requests, and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage vendors to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website.
If your browser settings permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit https://www.cookiepro.com/knowledgebase/knowledge_categories/cookies- 101/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.

How Does Branch Use the Information Collected?

Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or other parties, or where required by law.

Opt-Out & Do Not Track - Your Choice Mechanisms

In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).

Opt-Out from Promotional Emails

You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by visiting our Preference Center. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.

Opt-Out from Website Cookies/Web Beacons

We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the "Do Not Track" settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies. Please note that "Do Not Track" is a different privacy mechanism than the Global Privacy Control browser choice referenced below.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.

Vendor Tools/Analytics on the Website

The Website utilizes tracking tools from vendors, which may enable these vendors to analyze our Website traffic for analytics purposes. Some of these vendors may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the parties who provide them, and your interactions with these features are governed by the privacy policies of the parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.
Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.

Policies Applicable to Both Our Services & Our Website

When does Branch Disclose Information?

In addition to the ways described in our Terms & Conditions, applicable Agreements, and this Privacy Policy, Branch may also disclose information to others under the following circumstances:
  • With vendors, consultants, global partners, and other parties who assist Branch to provide, support, and maintain the Services and the Website and need access to information we collect to do so;
  • With our Clients and their agents, as described in this Policy;
  • To other parties (such as advertising networks or vendors used by our Clients), as directed by our Clients;
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements;
  • To investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person;
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions;
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services; and
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Updating Your Information and Contact Preferences

We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings”
which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.

We Secure the Information We Collect

Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.
Branch implements technical and organizational measures designed to protect against unauthorized access, accidental loss, destruction or damage of Client’s data. For more information on our security controls, please see https://www.branch.io/security/. If you have questions about the security of your personal information, or if you have reason to believe that the personal information that we hold about you is no longer secure, please contact us immediately as described in this Privacy Policy.

Data Retention

Branch retains the information we collect through our Website and Services for no more time than is needed to serve the legitimate business purposes for which it was collected, or as necessary to comply with our legal obligations. When we have no ongoing legitimate business need to process your personal information we either delete it or pseudonymize it unless otherwise required by applicable law or otherwise agreed to between Branch and a Client.

Links to Other Websites

The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about websites or social media platforms operated by other parties. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.

International Data Transfers

All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. Data protection laws in the United States may differ from your country, and the data Branch processes may be accessible to law enforcement and national security authorities under certain circumstances. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Data Privacy Framework mechanism discussed in the “Data Privacy Framework For EU, UK, and Swiss Personal Data Transferred into the United States” section below.

Data Privacy Framework For EU, UK, and Swiss Personal Data Transferred into the United States

Branch complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-US Data Privacy Framework (Swiss-U.S. DPF) (collectively, “Data Privacy Frameworks”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to the Data Privacy Frameworks. Branch has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom in reliance on the UK Extension to the EU-U.S. DPF. Branch has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the policies in this Privacy Policy and data subject rights under the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the applicable Principles (“DPF Principles”) shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification page, please visit https://www.dataprivacyframework.gov/.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
The Federal Trade Commission has jurisdiction over Branch’s compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
Pursuant to the Data Privacy Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to other parties pursuant to the Data Privacy Frameworks unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Data Privacy Frameworks. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Data Privacy Frameworks, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union, UK, and Swiss individuals with DPF inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
1975 W El Camino Real Ste. 102
Mountain View, CA 94040
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://www.jamsadr.com/dpf-dispute-resolution for more information and to file a complaint. This service is provided free of charge to you.
If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/framework- article/ANNEX-I-introduction.

Your Rights

Under applicable law and depending on your jurisdiction, you may have the right to access, correct, erase and restrict the processing of your personal data. You may also have the right to object to Branch’s processing of your data or exercise other rights, all in accordance with applicable law.
You have the right to lodge complaints about our data processing activities by filing a complaint with our Data Protection Officer who can be reached by the “Contact Us” section below or with a supervisory authority.

California and Certain other U.S. States

The California Consumer Privacy Act of 2018 (“CCPA”) and applicable privacy laws of other U.S. States provide certain rights to natural persons who are residents of California or such other states. Our privacy notice for California and additional information for other states is available here.

Rights of Residents of the European Economic Area and United Kingdom

The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.

Lei Geral de Proteção de Dados

Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.

Our Policy Regarding Children

Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 18). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 18) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately as required by law.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 18. If you are under 18, please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 18 may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 18 through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 18, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information as required by law.

Contact Us, Questions, Changes to This Privacy Policy

We may change this Privacy Policy at any time at our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
1975 W El Camino Real
Ste. 102
Mountain View, CA 94040, USA
or by email at info@branch.io

Compliance

This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with this Privacy Policy.

Download

Table of Contents


Privacy Policy

The Branch Guiding Privacy Principles

Branch is a deep linking and attribution analytics platform for app and website developers. We are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. We further describe our privacy practices in the official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect to provide our services is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs to provide our services. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from providing Branch with any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Customers who subscribe to our linking and analytics platform can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell customer end user data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with the CCPA and GDPR requirements.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.

Introduction

Top
Branch Metrics, Inc. ( "Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices ("Digital Properties")--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our linking and analytics products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from vendors and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.
Branch and its Clients have entered into an agreement that governs the provision of Services by Branch and their use by Clients ("Agreement(s)"). Such Agreements may contain obligations on the parties with respect to the handling of information processed in the Services. Nothing in this Privacy Policy derogates from such obligations.

Collection and Use of Information from Our Services

What Information Does Branch Collect from Our Services?

Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

The Branch Services: Overview

Branch provides a variety of Services intended to help Clients understand the use of their Digital Properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience. For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly. For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the Client’s tracked platforms with the purpose of driving more engagement to the Client. For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to disclose to Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to disclose to Branch. We prohibit Clients from providing us with data relating to children under 13 (or, in certain jurisdictions, under 18).
Branch collects data through various methods, including:
  • When the Client integrates Branch’s SDK’s, API’s, pixels, redirect links, JavaScript tags, cookies or similar data collection technologies into their Digital Properties and/or ads;
  • From the various advertising networks and third parties that are used by the Client in connection with the measurement and analysis of Client’s marketing campaigns and that have partnered with Branch;
  • When provided voluntarily by the Client as part of the Branch account registration process.
Clients are also required to inform us if they are using Branch’s Services to analyze information protected by HIPAA so that Branch can process such information in a protected environment. In the charts below, we summarize the information collected automatically by the Services.

Information Collected By Branch Links, Pixels, and Similar Technologies

Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”). Since Clients have sole control over their Digital Properties and configuration of the Services, Clients are contractually prohibited from configuring the Services to collect directly identifiable personal information , unless otherwise agreed by Branch. If a Client has configured the Services to collect directly identifiable personal information, then Branch may receive and process such data. This includes, for example, a Client using an End User’s email address as a Client issued Developer ID.

Type of Information Collected
Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.

Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).

Information Collected by Branch SDKs

SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:

Type of Information Collected
Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version

Metadata feature used for device identification and attribution
Internet connection typeMetadata feature used for device identification and attribution
Application versionMetadata feature used for device identification and attribution
Device modelMetadata feature used for device identification and attribution
Manufacturer / BrandMetadata feature used for device identification and attribution
Operating systemMetadata feature used for device identification and attribution
Screen size (height, width)Metadata feature used for device identification and attribution
Screen resolutionMetadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)Metadata feature used for device identification and attribution
Device locale (country and language)Metadata feature used for device identification and attribution
Local IP addressMetadata feature used for device identification and attribution
Mobile platformMetadata feature used for device identification and attribution
Branch SDK versionMetadata feature used for device identification and attribution
Developer ID(optional) Client-supplied unique identifier; metadata feature used for device identification and attribution
Carrier IDMetadata feature used for device identification and attribution
EnvironmentMetadata feature used for device identification and attribution
UI ModeMetadata feature used for device identification and attribution
Engagement DataInformation relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.
Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).

In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution
As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) that have partnered with Branch to provide certain Engagement Data to Branch on the Client’s behalf in connection with the measurement and analysis of the Client's marketing campaigns.

How Does Branch Use Information Collected by Our Services?

Subject to Agreements with our Clients, data that Branch collects through the Services is processed to provide, maintain, optimize, research and improve the Services we provide our Clients, including to support other Branch products and services, to perform anti- fraud protection analysis, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
Where authorized by Agreements with our Clients, we may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any other parties, including business partners, Clients, and/or others.

Our Clients’ Use of Information

Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their Digital Properties to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to disclose information about a hotel that she found in a travel app to a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being disclosed from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions, Agreements, or other contracts with us. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.

User Choices

Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”). NAI provides you with the opportunity to opt-out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
NAI OTT/CTV Opt-Out: NAI provides you with the opportunity to opt-out of digital advertising data collection on various connected streaming devices to the extent that the device manufacturer will allow. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Global Privacy Control: Please note that we also respond to and abide by opt-out preference signals sent through the Global Privacy Control. Any opt out preferences you have exercised through these methods will only apply to the specific device/browser on which you made them. For more information on how to use the Global Privacy Control, see www.globalprivacycontrol.org.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.

Collection and Use of Information from Our Website and for Marketing Purposes

What Information Does Branch Collect about Website Visitors and Potential Customers?

Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io ( the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

What We Collect from Clients that Use the Website

Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (other-party)
Other-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing Information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard

Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
We also require Clients to set up a user ID and unique password for account security purposes. Clients must not disclose their passwords to anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our payment and contract vendors.
Connection Information with Other Parties: Some features of the dashboard Services allow you to disclose your information through your accounts to other companies such as Facebook and Google. If you choose to connect Branch to such services provided by other parties, we may collect information related to your use of those services provided by other parties, such as authentication tokens that allow us to connect to your accounts with those other parties. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected services.
Information from Other Sources: In addition to the information collected through our Website, we or our vendors may obtain and disclose additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or databases maintained by other parties. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form, downloading content that we make available on the Website, or registering for or attending our events, programs, trainings, or contests. Such information we may receive may include contact and professional details about you which you have chosen to share with us including name, email address, phone number, office or other mailing address, and professional data including organization you are affiliated with, your job title, and industry. We use this information to answer your question(s) and process requests, and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage vendors to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website.
If your browser settings permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit https://www.cookiepro.com/knowledgebase/knowledge_categories/cookies- 101/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.

How Does Branch Use the Information Collected?

Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or other parties, or where required by law.

Opt-Out & Do Not Track - Your Choice Mechanisms

In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).

Opt-Out from Promotional Emails

You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by visiting our Preference Center. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.

Opt-Out from Website Cookies/Web Beacons

We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the "Do Not Track" settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies. Please note that "Do Not Track" is a different privacy mechanism than the Global Privacy Control browser choice referenced below.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.

Vendor Tools/Analytics on the Website

The Website utilizes tracking tools from vendors, which may enable these vendors to analyze our Website traffic for analytics purposes. Some of these vendors may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the parties who provide them, and your interactions with these features are governed by the privacy policies of the parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.
Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.

Policies Applicable to Both Our Services & Our Website

When does Branch Disclose Information?

In addition to the ways described in our Terms & Conditions, applicable Agreements, and this Privacy Policy, Branch may also disclose information to others under the following circumstances:
  • With vendors, consultants, global partners, and other parties who assist Branch to provide, support, and maintain the Services and the Website and need access to information we collect to do so;
  • With our Clients and their agents, as described in this Policy;
  • To other parties (such as advertising networks or vendors used by our Clients), as directed by our Clients;
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements;
  • To investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person;
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions;
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services; and
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Updating Your Information and Contact Preferences

We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings”
which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.

We Secure the Information We Collect

Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.
Branch implements technical and organizational measures designed to protect against unauthorized access, accidental loss, destruction or damage of Client’s data. For more information on our security controls, please see https://www.branch.io/security/. If you have questions about the security of your personal information, or if you have reason to believe that the personal information that we hold about you is no longer secure, please contact us immediately as described in this Privacy Policy.

Our Data Retention Policy

For our Services: Branch retains the information collected by the Services for no more time than is needed to serve the legitimate business need for which it was collected. For example, Branch stores the information collected by our Services for the purposes of establishing matches between devices used by Users (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), information collected from that User by our Services for the purposes of establishing matches between devices used by will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Usage activity logs of Users, which are used for the purpose of providing reporting and analytics to the Client, are stored in an identifiable form for no more than 14 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized usage activity logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Aggregated reporting metrics disclosed to Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.
For the Website: We retain the information collected by the Website for no more time than is needed to serve the legitimate business need for which it was collected. For example, we store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.

Links to Other Websites

The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about websites or social media platforms operated by other parties. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.

International Data Transfers

All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. Data protection laws in the United States may differ from your country, and the data Branch processes may be accessible to law enforcement and national security authorities under certain circumstances. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Data Privacy Framework mechanism discussed in the “Data Privacy Framework For EU, UK, and Swiss Personal Data Transferred into the United States” section below.

Data Privacy Framework For EU, UK, and Swiss Personal Data Transferred into the United States

Branch complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-US Data Privacy Framework (Swiss-U.S. DPF) (collectively, “Data Privacy Frameworks”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to the Data Privacy Frameworks. Branch has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom in reliance on the UK Extension to the EU-U.S. DPF. Branch has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the policies in this Privacy Policy and data subject rights under the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the applicable Principles (“DPF Principles”) shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification page, please visit https://www.dataprivacyframework.gov/.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
The Federal Trade Commission has jurisdiction over Branch’s compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
Pursuant to the Data Privacy Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to other parties pursuant to the Data Privacy Frameworks unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Data Privacy Frameworks. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Data Privacy Frameworks, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union, UK, and Swiss individuals with DPF inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
1975 W El Camino Real Ste. 102
Mountain View, CA 94040
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://www.jamsadr.com/dpf-dispute-resolution for more information and to file a complaint. This service is provided free of charge to you.
If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/framework- article/ANNEX-I-introduction.

Your Rights

Under applicable law and depending on your jurisdiction, you may have the right to access, correct, erase and restrict the processing of your personal data. You may also have the right to object to Branch’s processing of your data or exercise other rights, all in accordance with applicable law.
You have the right to lodge complaints about our data processing activities by filing a complaint with our Data Protection Officer who can be reached by the “Contact Us” section below or with a supervisory authority.

California and Certain other U.S. States

The California Consumer Privacy Act of 2018 (“CCPA”) and applicable privacy laws of other U.S. States provide certain rights to natural persons who are residents of California or such other states. Our privacy notice for California and additional information for other states is available here.

Rights of Residents of the European Economic Area and United Kingdom

The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.

Lei Geral de Proteção de Dados

Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.

Our Policy Regarding Children

Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 18). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 18) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately as required by law.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 18. If you are under 18, please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 18 may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 18 through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 18, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information as required by law.

Contact Us, Questions, Changes to This Privacy Policy

We may change this Privacy Policy at any time at our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
1975 W El Camino Real
Ste. 102
Mountain View, CA 94040, USA
or by email at info@branch.io

Compliance

This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with this Privacy Policy.

Download

Table of Contents


Privacy Policy

The Branch Guiding Privacy Principles

Branch is a deep linking and attribution analytics platform for app and website developers. We are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. We further describe our privacy practices in the official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect to provide our services is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs to provide our services. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from providing Branch with any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Customers who subscribe to our linking and analytics platform can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell customer end user data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with the CCPA and GDPR requirements.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.

Introduction

Branch Metrics, Inc. ( "Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices ("Digital Properties")--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our linking and analytics products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from vendors and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.
Branch and its Clients have entered into an agreement that governs the provision of Services by Branch and their use by Clients ("Agreement(s)"). Such Agreements may contain obligations on the parties with respect to the handling of information processed in the Services. Nothing in this Privacy Policy derogates from such obligations.

Collection and Use of Information from Our Services

What Information Does Branch Collect from Our Services?

Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

The Branch Services: Overview

Branch provides a variety of Services intended to help Clients understand the use of their Digital Properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience. For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly. For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the Client’s tracked platforms with the purpose of driving more engagement to the Client. For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to disclose to Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to disclose to Branch. We prohibit Clients from providing us with data relating to children under 13 (or, in certain jurisdictions, under 18).
Branch collects data through various methods, including:
  • When the Client integrates Branch’s SDK’s, API’s, pixels, redirect links, JavaScript tags, cookies or similar data collection technologies into their Digital Properties and/or ads;
  • From the various advertising networks and third parties that are used by the Client in connection with the measurement and analysis of Client’s marketing campaigns and that have partnered with Branch;
  • When provided voluntarily by the Client as part of the Branch account registration process.
Clients are also required to inform us if they are using Branch’s Services to analyze information protected by HIPAA so that Branch can process such information in a protected environment. In the charts below, we summarize the information collected automatically by the Services.

Information Collected By Branch Links, Pixels, and Similar Technologies

Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”). Since Clients have sole control over their Digital Properties and configuration of the Services, Clients are contractually prohibited from configuring the Services to collect directly identifiable personal information , unless otherwise agreed by Branch. If a Client has configured the Services to collect directly identifiable personal information, then Branch may receive and process such data. This includes, for example, a Client using an End User’s email address as a Client issued Developer ID.

Type of Information Collected
Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.

Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).

Information Collected by Branch SDKs

SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:

Type of Information Collected
Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version

Metadata feature used for device identification and attribution
Internet connection typeMetadata feature used for device identification and attribution
Application versionMetadata feature used for device identification and attribution
Device modelMetadata feature used for device identification and attribution
Manufacturer / BrandMetadata feature used for device identification and attribution
Operating systemMetadata feature used for device identification and attribution
Screen size (height, width)Metadata feature used for device identification and attribution
Screen resolutionMetadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)Metadata feature used for device identification and attribution
Device locale (country and language)Metadata feature used for device identification and attribution
Local IP addressMetadata feature used for device identification and attribution
Mobile platformMetadata feature used for device identification and attribution
Branch SDK versionMetadata feature used for device identification and attribution
Developer ID(optional) Client-supplied unique identifier; metadata feature used for device identification and attribution
Carrier IDMetadata feature used for device identification and attribution
EnvironmentMetadata feature used for device identification and attribution
UI ModeMetadata feature used for device identification and attribution
Engagement DataInformation relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.
Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).

In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution
As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) that have partnered with Branch to provide certain Engagement Data to Branch on the Client’s behalf in connection with the measurement and analysis of the Client's marketing campaigns.

How Does Branch Use Information Collected by Our Services?

Subject to Agreements with our Clients, data that Branch collects through the Services is processed to provide, maintain, optimize, research and improve the Services we provide our Clients, including to support other Branch products and services, to perform anti- fraud protection analysis, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
Where authorized by Agreements with our Clients, we may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any other parties, including business partners, Clients, and/or others.

Our Clients’ Use of Information

Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their Digital Properties to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to disclose information about a hotel that she found in a travel app to a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being disclosed from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions, Agreements, or other contracts with us. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.

User Choices

Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”). NAI provides you with the opportunity to opt-out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
NAI OTT/CTV Opt-Out: NAI provides you with the opportunity to opt-out of digital advertising data collection on various connected streaming devices to the extent that the device manufacturer will allow. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Global Privacy Control: Please note that we also respond to and abide by opt-out preference signals sent through the Global Privacy Control. Any opt out preferences you have exercised through these methods will only apply to the specific device/browser on which you made them. For more information on how to use the Global Privacy Control, see www.globalprivacycontrol.org.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.

Collection and Use of Information from Our Website and for Marketing Purposes

What Information Does Branch Collect about Website Visitors and Potential Customers?

Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io ( the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

What We Collect from Clients that Use the Website

Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (other-party)
Other-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing Information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard

Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
We also require Clients to set up a user ID and unique password for account security purposes. Clients must not disclose their passwords to anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our payment and contract vendors.
Connection Information with Other Parties: Some features of the dashboard Services allow you to disclose your information through your accounts to other companies such as Facebook and Google. If you choose to connect Branch to such services provided by other parties, we may collect information related to your use of those services provided by other parties, such as authentication tokens that allow us to connect to your accounts with those other parties. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected services.
Information from Other Sources: In addition to the information collected through our Website, we or our vendors may obtain and disclose additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or databases maintained by other parties. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form, downloading content that we make available on the Website, or registering for or attending our events, programs, trainings, or contests. Such information we may receive may include contact and professional details about you which you have chosen to share with us including name, email address, phone number, office or other mailing address, and professional data including organization you are affiliated with, your job title, and industry. We use this information to answer your question(s) and process requests, and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage vendors to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website.
If your browser settings permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit https://www.cookiepro.com/knowledgebase/knowledge_categories/cookies- 101/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.

How Does Branch Use the Information Collected?

Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or other parties, or where required by law.

Opt-Out & Do Not Track - Your Choice Mechanisms

In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).

Opt-Out from Promotional Emails

You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by visiting our Preference Center. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.

Opt-Out from Website Cookies/Web Beacons

We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the "Do Not Track" settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies. Please note that "Do Not Track" is a different privacy mechanism than the Global Privacy Control browser choice referenced below.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.

Vendor Tools/Analytics on the Website

The Website utilizes tracking tools from vendors, which may enable these vendors to analyze our Website traffic for analytics purposes. Some of these vendors may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the parties who provide them, and your interactions with these features are governed by the privacy policies of the parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.
Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.

Policies Applicable to Both Our Services & Our Website

When does Branch Disclose Information?

In addition to the ways described in our Terms & Conditions, applicable Agreements, and this Privacy Policy, Branch may also disclose information to others under the following circumstances:
  • With vendors, consultants, global partners, and other parties who assist Branch to provide, support, and maintain the Services and the Website and need access to information we collect to do so;
  • With our Clients and their agents, as described in this Policy;
  • To other parties (such as advertising networks or vendors used by our Clients), as directed by our Clients;
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements;
  • To investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person;
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions;
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services; and
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Updating Your Information and Contact Preferences

We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings”
which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.

We Secure the Information We Collect

Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.
Branch implements technical and organizational measures designed to protect against unauthorized access, accidental loss, destruction or damage of Client’s data. For more information on our security controls, please see https://www.branch.io/security/. If you have questions about the security of your personal information, or if you have reason to believe that the personal information that we hold about you is no longer secure, please contact us immediately as described in this Privacy Policy.

Our Data Retention Policy

For our Services: Branch retains the information collected by the Services for no more time than is needed to serve the legitimate business need for which it was collected. For example, Branch stores the information collected by our Services for the purposes of establishing matches between devices used by Users (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), information collected from that User by our Services for the purposes of establishing matches between devices used by will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Usage activity logs of Users, which are used for the purpose of providing reporting and analytics to the Client, are stored in an identifiable form for no more than 14 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized usage activity logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Aggregated reporting metrics disclosed to Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.
For the Website: We retain the information collected by the Website for no more time than is needed to serve the legitimate business need for which it was collected. For example, we store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.

Links to Other Websites

The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about websites or social media platforms operated by other parties. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.

International Data Transfers

All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. Data protection laws in the United States may differ from your country, and the data Branch processes may be accessible to law enforcement and national security authorities under certain circumstances. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Data Privacy Framework mechanism discussed in the “Data Privacy Framework For EU, UK, and Swiss Personal Data Transferred into the United States” section below.

Data Privacy Framework For EU, UK, and Swiss Personal Data Transferred into the United States

Branch complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-US Data Privacy Framework (Swiss-U.S. DPF) (collectively, “Data Privacy Frameworks”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to the Data Privacy Frameworks. Branch has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom in reliance on the UK Extension to the EU-U.S. DPF. Branch has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the policies in this Privacy Policy and data subject rights under the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the applicable Principles (“DPF Principles”) shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification page, please visit https://www.dataprivacyframework.gov/.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
The Federal Trade Commission has jurisdiction over Branch’s compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
Pursuant to the Data Privacy Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to other parties pursuant to the Data Privacy Frameworks unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Data Privacy Frameworks. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Data Privacy Frameworks, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union, UK, and Swiss individuals with DPF inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
1975 W El Camino Real Ste. 102
Mountain View, CA 94040
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://www.jamsadr.com/dpf-dispute-resolution for more information and to file a complaint. This service is provided free of charge to you.
If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/framework- article/ANNEX-I-introduction.

Data Subject Rights

Depending on your jurisdiction.

California Consumer Privacy Act

The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to natural persons who are residents of California. Our CCPA privacy notice is available here.

Rights of Residents of the European Economic Area and United Kingdom

The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.

Lei Geral de Proteção de Dados

Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.

Our Policy Regarding Children

Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 18). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 18) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately as required by law.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 18. If you are under 18, please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 18 may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 18 through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 18, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information as required by law.

Contact Us, Questions, Changes to This Privacy Policy

We may change this Privacy Policy at any time at our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
1975 W El Camino Real
Ste. 102
Mountain View, CA 94040, USA
or by email at info@branch.io

Compliance

This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with this Privacy Policy.

Download

Table of Contents


Privacy Policy


The Branch Guiding Privacy Principles

Branch is a deep linking and attribution analytics platform for app and website developers. We are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. We further describe our privacy practices in the official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect to provide our services is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs to provide our services. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from providing Branch with any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Customers who subscribe to our linking and analytics platform can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell customer end user data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with the CCPA and GDPR requirements.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.
Branch Metrics, Inc. ( "Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices ("Digital Properties")--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our linking and analytics products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from vendors and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.
Branch and its Clients have entered into an agreement that governs the provision of Services by Branch and their use by Clients ("Agreement(s)"). Such Agreements may contain obligations on the parties with respect to the handling of information processed in the Services. Nothing in this Privacy Policy derogates from such obligations.
Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
Branch provides a variety of Services intended to help Clients understand the use of their Digital Properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience. For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly. For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the Client’s tracked platforms with the purpose of driving more engagement to the Client. For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to disclose to Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to disclose to Branch. We prohibit Clients from providing us with data relating to children under 13 (or, in certain jurisdictions, under 16).
Branch collects data through various methods, including:
  • When the Client integrates Branch’s SDK’s, API’s, pixels, redirect links, JavaScript tags, cookies or similar data collection technologies into their Digital Properties and/or ads;
  • From the various advertising networks and third parties that are used by the Client in connection with the measurement and analysis of Client’s marketing campaigns and that have partnered with Branch;
  • When provided voluntarily by the Client as part of the Branch account registration process.
Clients are also required to inform us if they are using Branch’s services to analyze information protected by HIPAA so that Branch can process such information in a protected environment.
In the charts below, we summarize the information collected automatically by the Services.
Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”). Since Clients have sole control over their Digital Properties and configuration of the Services, Clients are contractually prohibited from configuring the Services to collect directly identifiable personal information , unless otherwise agreed by Branch. If a Client has configured the Services to collect directly identifiable personal information, then Branch may receive and process such data. This includes, for example, a Client using an End User’s email address as a Client issued Developer ID.
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.

Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).
SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version
Metadata feature used for device identification and attribution
Internet connection type
Metadata feature used for device identification and attribution
Application version
Metadata feature used for device identification and attribution
Device model
Metadata feature used for device identification and attribution
Manufacturer / Brand
Metadata feature used for device identification and attribution
Operating system
Metadata feature used for device identification and attribution
Operating system version
Metadata feature used for device identification and attribution
Screen size (height, width)
Metadata feature used for device identification and attribution
Screen resolution
Metadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)
Metadata feature used for device identification and attribution
Device locale (country and language)
Metadata feature used for device identification and attribution
Local IP address
Metadata feature used for device identification and attribution
Mobile platform
Metadata feature used for device identification and attribution
Branch SDK version
Metadata feature used for device identification and attribution
Developer ID
(optional) Client-supplied unique identifier; metadata feature Used for device identification and attribution
Carrier ID
Metadata feature used for device identification and attribution
Environment
Metadata feature used for device identification and attribution
UI Mode
Metadata feature used for device identification and attribution
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.

Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).
In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution
As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) that have partnered with Branch to provide certain Engagement Data to Branch on the Client’s behalf in connection with the measurement and analysis of the Client's marketing campaigns.
Subject to Agreements with our Clients, data that Branch collects through the Services is processed to provide, maintain, optimize, research and improve the Services we provide our Clients, including to support other Branch products and services, to perform anti-fraud protection analysis, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
Where authorized by Agreements with our Clients, we may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any other parties, including business partners, Clients, and/or others.
Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their Digital Properties to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to disclose information about a hotel that she found in a travel app to a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being disclosed from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions, Agreements, or other contracts with us. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.
Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”) and adheres to its Code of Conduct. NAI provides you with the opportunity to opt out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.
Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io ( the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (other-party)
Other-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard
Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
We also require Clients to set up a user ID and unique password for account security purposes. Clients must not disclose their passwords to anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our payment and contract vendors.
Connection Information with Other Parties: Some features of the dashboard Services allow you to disclose your information through your accounts to other companies such as Facebook and Google. If you choose to connect Branch to such services provided by other parties, we may collect information related to your use of those services provided by other parties, such as authentication tokens that allow us to connect to your accounts with those other parties. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected services.
Information from Other Sources: In addition to the information collected through our Website, we or our vendors may obtain and disclose additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or databases maintained by other parties. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form on the Website. We use this information to answer their question(s), and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage vendors to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website.
If your browser settings permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit https://www.cookiepro.com/knowledgebase/knowledge_categories/cookies-101/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.
Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or other parties, or where required by law.
In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).
You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by filling out this form. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.
We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the "Do Not Track" settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies. Please note that "Do Not Track" is a different privacy mechanism than the Global Privacy Control browser choice referenced below.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.
The Website utilizes tracking tools from vendors, which may enable these vendors to analyze our Website traffic for analytics purposes. Some of these vendors may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the parties who provide them, and your interactions with these features are governed by the privacy policies of the parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.
Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.
In addition to the ways described in our Terms & Conditions, applicable Agreements, and this Privacy Policy, Branch may also disclose information to others under the following circumstances:
  • With vendors, consultants, global partners, and other parties who assist Branch to provide, support, and maintain the Services and the Website and need access to information we collect to do so;
  • With our Clients and their agents, as described in this Policy;
  • To other parties (such as advertising networks or vendors used by our Clients), as directed by our Clients;
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements;
  • To investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person;
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions;
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services; and
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings” which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.
Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.
Branch implements technical and organizational measures designed to protect against unauthorized access, accidental loss, destruction or damage of Client’s data. For more information on our security controls, please see https://www.branch.io/security/. If you have questions about the security of your personal information, or if you have reason to believe that the personal information that we hold about you is no longer secure, please contact us immediately as described in this Privacy Policy.
For our Services: Branch retains the information collected by the Services for no more time than is needed to serve the legitimate business need for which it was collected. For example, Branch stores the information collected by our Services for the purposes of establishing matches between devices used by Users (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), information collected from that User by our Services for the purposes of establishing matches between devices used by will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Usage activity logs of Users, which are used for the purpose of providing reporting and analytics to the Client, are stored in an identifiable form for no more than 14 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized usage activity logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Aggregated reporting metrics disclosed to Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.
For the Website: We retain the information collected by the Website for no more time than is needed to serve the legitimate business need for which it was collected. For example, we store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.
The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about websites or social media platforms operated by other parties. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.
All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. Data protection laws in the United States may differ from your country, and the data Branch processes may be accessible to law enforcement and national security authorities under certain circumstances. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Data Privacy Framework mechanism discussed in the “Data Privacy Framework For EU, UK, and Swiss Personal Data Transferred into the United States” section below.
Branch complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-US Data Privacy Framework (Swiss-U.S. DPF) (collectively, “Data Privacy Frameworks”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to the Data Privacy Frameworks. Branch has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom in reliance on the UK Extension to the EU-U.S. DPF. Branch has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the policies in this Privacy Policy and data subject rights under the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the applicable Principles (“DPF Principles”) shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification page, please visit https://www.dataprivacyframework.gov/.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
The Federal Trade Commission has jurisdiction over Branch’s compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
Pursuant to the Data Privacy Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to other parties pursuant to the Data Privacy Frameworks unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Data Privacy Frameworks. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Data Privacy Frameworks, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union, UK, and Swiss individuals with DPF inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://www.jamsadr.com/dpf-dispute-resolution for more information and to file a complaint. This service is provided free of charge to you.
If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction.
California Consumer Privacy Act
The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to natural persons who are residents of California. Our CCPA privacy notice is available here.
Rights of Residents of the European Economic Area and United Kingdom
The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.
Lei Geral de Proteção de Dados
Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.
Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 16). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately as required by law.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 16. If you are under 16, please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 16 may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 16 through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 16, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information as required by law.
We may change this Privacy Policy at any time in our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at info@branch.io
This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with this Privacy Policy.
Download

Table of Contents


Privacy Policy


The Branch Guiding Privacy Principles

Branch is a deep linking and attribution analytics platform for app and website developers. We are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. We further describe our privacy practices in the official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect to provide our services is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs to provide our services. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from providing Branch with any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Customers who subscribe to our linking and analytics platform can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell customer end user data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with the CCPA and GDPR requirements.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.
Branch Metrics, Inc. ( "Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices ("Digital Properties")--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our linking and analytics products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from vendors and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.
Branch and its Clients have entered into an agreement that governs the provision of Services by Branch and their use by Clients ("Agreement(s)"). Such Agreements may contain obligations on the parties with respect to the handling of information processed in the Services. Nothing in this Privacy Policy derogates from such obligations.
Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
Branch provides a variety of Services intended to help Clients understand the use of their Digital Properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience. For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly. For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the Client’s tracked platforms with the purpose of driving more engagement to the Client. For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to disclose to Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to disclose to Branch. We prohibit Clients from providing us with data relating to children under 13 (or, in certain jurisdictions, under 16).
Branch collects data through various methods, including:
  • When the Client integrates Branch’s SDK’s, API’s, pixels, redirect links, JavaScript tags, cookies or similar data collection technologies into their Digital Properties and/or ads;
  • From the various advertising networks and third parties that are used by the Client in connection with the measurement and analysis of Client’s marketing campaigns and that have partnered with Branch;
  • When provided voluntarily by the Client as part of the Branch account registration process.
Clients are also required to inform us if they are using Branch’s services to analyze information protected by HIPAA so that Branch can process such information in a protected environment.
In the charts below, we summarize the information collected automatically by the Services.
Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”). Since Clients have sole control over their Digital Properties and configuration of the Services, Clients are contractually prohibited from configuring the Services to collect directly identifiable personal information , unless otherwise agreed by Branch. If a Client has configured the Services to collect directly identifiable personal information, then Branch may receive and process such data. This includes, for example, a Client using an End User’s email address as a Client issued Developer ID.
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.

Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).
SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version
Metadata feature used for device identification and attribution
Internet connection type
Metadata feature used for device identification and attribution
Application version
Metadata feature used for device identification and attribution
Device model
Metadata feature used for device identification and attribution
Manufacturer / Brand
Metadata feature used for device identification and attribution
Operating system
Metadata feature used for device identification and attribution
Operating system version
Metadata feature used for device identification and attribution
Screen size (height, width)
Metadata feature used for device identification and attribution
Screen resolution
Metadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)
Metadata feature used for device identification and attribution
Device locale (country and language)
Metadata feature used for device identification and attribution
Local IP address
Metadata feature used for device identification and attribution
Mobile platform
Metadata feature used for device identification and attribution
Branch SDK version
Metadata feature used for device identification and attribution
Developer ID
(optional) Client-supplied unique identifier; metadata feature Used for device identification and attribution
Carrier ID
Metadata feature used for device identification and attribution
Environment
Metadata feature used for device identification and attribution
UI Mode
Metadata feature used for device identification and attribution
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.

Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).
In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution
As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) that have partnered with Branch to provide certain Engagement Data to Branch on the Client’s behalf in connection with the measurement and analysis of the Client's marketing campaigns.
Subject to Agreements with our Clients, data that Branch collects through the Services is processed to provide, maintain, optimize, research and improve the Services we provide our Clients, including to support other Branch products and services, to perform anti-fraud protection analysis, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
Where authorized by Agreements with our Clients, we may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any other parties, including business partners, Clients, and/or others.
Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their Digital Properties to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to disclose information about a hotel that she found in a travel app to a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being disclosed from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions, Agreements, or other contracts with us. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.
Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”) and adheres to its Code of Conduct. NAI provides you with the opportunity to opt out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.
Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io ( the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (other-party)
Other-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard
Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
We also require Clients to set up a user ID and unique password for account security purposes. Clients must not disclose their passwords to anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our payment and contract vendors.
Connection Information with Other Parties: Some features of the dashboard Services allow you to disclose your information through your accounts to other companies such as Facebook and Google. If you choose to connect Branch to such services provided by other parties, we may collect information related to your use of those services provided by other parties, such as authentication tokens that allow us to connect to your accounts with those other parties. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected services.
Information from Other Sources: In addition to the information collected through our Website, we or our vendors may obtain and disclose additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or databases maintained by other parties. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form on the Website. We use this information to answer their question(s), and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage vendors to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website.
If your browser settings permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit https://www.cookiepro.com/knowledgebase/knowledge_categories/cookies-101/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.
Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or other parties, or where required by law.
In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).
You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by filling out this form. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.
We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the "Do Not Track" settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies. Please note that "Do Not Track" is a different privacy mechanism than the Global Privacy Control browser choice referenced below.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.
The Website utilizes tracking tools from vendors, which may enable these vendors to analyze our Website traffic for analytics purposes. Some of these vendors may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the parties who provide them, and your interactions with these features are governed by the privacy policies of the parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.
Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.
In addition to the ways described in our Terms & Conditions, applicable Agreements, and this Privacy Policy, Branch may also disclose information to others under the following circumstances:
  • With vendors, consultants, global partners, and other parties who assist Branch to provide, support, and maintain the Services and the Website and need access to information we collect to do so;
  • With our Clients and their agents, as described in this Policy;
  • To other parties (such as advertising networks or vendors used by our Clients), as directed by our Clients;
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements;
  • To investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person;
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions;
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services; and
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings” which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.
Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.
Branch implements technical and organizational measures designed to protect against unauthorized access, accidental loss, destruction or damage of Client’s data. For more information on our security controls, please see https://www.branch.io/security/. If you have questions about the security of your personal information, or if you have reason to believe that the personal information that we hold about you is no longer secure, please contact us immediately as described in this Privacy Policy.
For our Services: Branch retains the information collected by the Services for no more time than is needed to serve the legitimate business need for which it was collected. For example, Branch stores the information collected by our Services for the purposes of establishing matches between devices used by Users (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), information collected from that User by our Services for the purposes of establishing matches between devices used by will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Usage activity logs of Users, which are used for the purpose of providing reporting and analytics to the Client, are stored in an identifiable form for no more than 14 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized usage activity logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Aggregated reporting metrics disclosed to Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.
For the Website: We retain the information collected by the Website for no more time than is needed to serve the legitimate business need for which it was collected. For example, we store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.
The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about websites or social media platforms operated by other parties. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.
All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. Data protection laws in the United States may differ from your country, and the data Branch processes may be accessible to law enforcement and national security authorities under certain circumstances. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Data Privacy Framework mechanism discussed in the “Data Privacy Framework For EU, UK, and Swiss Personal Data Transferred into the United States” section below.
Branch complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-US Data Privacy Framework (Swiss-U.S. DPF) (collectively, “Data Privacy Frameworks”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to the Data Privacy Frameworks. Branch has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom in reliance on the UK Extension to the EU-U.S. DPF. Branch has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the policies in this Privacy Policy and data subject rights under the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the applicable Principles (“DPF Principles”) shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification page, please visit https://www.dataprivacyframework.gov/.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
The Federal Trade Commission has jurisdiction over Branch’s compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
Pursuant to the Data Privacy Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to other parties pursuant to the Data Privacy Frameworks unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Data Privacy Frameworks. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Data Privacy Frameworks, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union, UK, and Swiss individuals with DPF inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://www.jamsadr.com/dpf-dispute-resolution for more information and to file a complaint. This service is provided free of charge to you.
If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf?tabset-35584=2.
California Consumer Privacy Act
The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to natural persons who are residents of California. Our CCPA privacy notice is available here.
Rights of Residents of the European Economic Area and United Kingdom
The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.
Lei Geral de Proteção de Dados
Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.
Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 16). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately as required by law.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 16. If you are under 16, please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 16 may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 16 through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 16, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information as required by law.
We may change this Privacy Policy at any time in our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at info@branch.io
This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with this Privacy Policy.
Download

Table of Contents


Privacy Policy


The Branch Guiding Privacy Principles

Branch is a deep linking and attribution analytics platform for app and website developers. We are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. We further describe our privacy practices in the official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect to provide our services is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs to provide our services. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from providing Branch with any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Customers who subscribe to our linking and analytics platform can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell customer end user data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with the CCPA and GDPR requirements.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.
Branch Metrics, Inc. ( "Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices ("Digital Properties")--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our linking and analytics products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from vendors and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.
Branch and its Clients have entered into an agreement that governs the provision of Services by Branch and their use by Clients ("Agreement(s)"). Such Agreements may contain obligations on the parties with respect to the handling of information processed in the Services. Nothing in this Privacy Policy derogates from such obligations.
Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
Branch provides a variety of Services intended to help Clients understand the use of their Digital Properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience. For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly. For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the Client’s tracked platforms with the purpose of driving more engagement to the Client. For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to disclose to Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to disclose to Branch. We prohibit Clients from providing us with data relating to children under 13 (or, in certain jurisdictions, under 16).
Branch collects data through various methods, including:
  • When the Client integrates Branch’s SDK’s, API’s, pixels, redirect links, JavaScript tags, cookies or similar data collection technologies into their Digital Properties and/or ads;
  • From the various advertising networks and third parties that are used by the Client in connection with the measurement and analysis of Client’s marketing campaigns and that have partnered with Branch;
  • When provided voluntarily by the Client as part of the Branch account registration process.
Clients are also required to inform us if they are using Branch’s services to analyze information protected by HIPAA so that Branch can process such information in a protected environment.
In the charts below, we summarize the information collected automatically by the Services.
Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”). Since Clients have sole control over their Digital Properties and configuration of the Services, Clients are contractually prohibited from configuring the Services to collect directly identifiable personal information , unless otherwise agreed by Branch. If a Client has configured the Services to collect directly identifiable personal information, then Branch may receive and process such data. This includes, for example, a Client using an End User’s email address as a Client issued Developer ID.
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.

Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).
SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version
Metadata feature used for device identification and attribution
Internet connection type
Metadata feature used for device identification and attribution
Application version
Metadata feature used for device identification and attribution
Device model
Metadata feature used for device identification and attribution
Manufacturer / Brand
Metadata feature used for device identification and attribution
Operating system
Metadata feature used for device identification and attribution
Operating system version
Metadata feature used for device identification and attribution
Screen size (height, width)
Metadata feature used for device identification and attribution
Screen resolution
Metadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)
Metadata feature used for device identification and attribution
Device locale (country and language)
Metadata feature used for device identification and attribution
Local IP address
Metadata feature used for device identification and attribution
Mobile platform
Metadata feature used for device identification and attribution
Branch SDK version
Metadata feature used for device identification and attribution
Developer ID
(optional) Client-supplied unique identifier; metadata feature Used for device identification and attribution
Carrier ID
Metadata feature used for device identification and attribution
Environment
Metadata feature used for device identification and attribution
UI Mode
Metadata feature used for device identification and attribution
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.

Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).
In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution
As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) that have partnered with Branch to provide certain Engagement Data to Branch on the Client’s behalf in connection with the measurement and analysis of the Client's marketing campaigns.
Subject to Agreements with our Clients, data that Branch collects through the Services is processed to provide, maintain, optimize, research and improve the Services we provide our Clients, including to support other Branch products and services, to perform anti-fraud protection analysis, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
Where authorized by Agreements with our Clients, we may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any other parties, including business partners, Clients, and/or others.
Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their Digital Properties to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to disclose information about a hotel that she found in a travel app to a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being disclosed from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions, Agreements, or other contracts with us. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.
Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”) and adheres to its Code of Conduct. NAI provides you with the opportunity to opt out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.
Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io ( the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (other-party)
Other-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard
Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
We also require Clients to set up a user ID and unique password for account security purposes. Clients must not disclose their passwords to anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our payment and contract vendors.
Connection Information with Other Parties: Some features of the dashboard Services allow you to disclose your information through your accounts to other companies such as Facebook and Google. If you choose to connect Branch to such services provided by other parties, we may collect information related to your use of those services provided by other parties, such as authentication tokens that allow us to connect to your accounts with those other parties. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected services.
Information from Other Sources: In addition to the information collected through our Website, we or our vendors may obtain and disclose additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or databases maintained by other parties. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form on the Website. We use this information to answer their question(s), and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage vendors to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website.
If your browser settings permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit https://www.cookiepro.com/knowledgebase/knowledge_categories/cookies-101/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.
Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or other parties, or where required by law.
In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).
You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by filling out this form. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.
We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the "Do Not Track" settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies. Please note that "Do Not Track" is a different privacy mechanism than the Global Privacy Control browser choice referenced below.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.
The Website utilizes tracking tools from vendors, which may enable these vendors to analyze our Website traffic for analytics purposes. Some of these vendors may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the parties who provide them, and your interactions with these features are governed by the privacy policies of the parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.
Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.
In addition to the ways described in our Terms & Conditions, applicable Agreements, and this Privacy Policy, Branch may also disclose information to others under the following circumstances:
  • With vendors, consultants, global partners, and other parties who assist Branch to provide, support, and maintain the Services and the Website and need access to information we collect to do so;
  • With our Clients and their agents, as described in this Policy;
  • To other parties (such as advertising networks or vendors used by our Clients), as directed by our Clients;
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements;
  • To investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person;
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions;
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services; and
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings” which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.
Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.
Branch implements technical and organizational measures designed to protect against unauthorized access, accidental loss, destruction or damage of Client’s data. For more information on our security controls, please see https://www.branch.io/security/. If you have questions about the security of your personal information, or if you have reason to believe that the personal information that we hold about you is no longer secure, please contact us immediately as described in this Privacy Policy.
For our Services: Branch retains the information collected by the Services for no more time than is needed to serve the legitimate business need for which it was collected. For example, Branch stores the information collected by our Services for the purposes of establishing matches between devices used by Users (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), information collected from that User by our Services for the purposes of establishing matches between devices used by will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Usage activity logs of Users, which are used for the purpose of providing reporting and analytics to the Client, are stored in an identifiable form for no more than 14 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized usage activity logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Aggregated reporting metrics disclosed to Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.
For the Website: We retain the information collected by the Website for no more time than is needed to serve the legitimate business need for which it was collected. For example, we store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.
The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about websites or social media platforms operated by other parties. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.
All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. Data protection laws in the United States may differ from your country, and the data Branch processes may be accessible to law enforcement and national security authorities under certain circumstances. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Data Privacy Framework mechanism discussed in the “Data Privacy Framework For EU, UK, and Swiss Personal Data Transferred into the United States” section below.
Branch complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-US Data Privacy Framework (Swiss-U.S. DPF) (collectively, “Data Privacy Frameworks”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to the Data Privacy Frameworks. Branch has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom in reliance on the UK Extension to the EU-U.S. DPF. Branch has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the policies in this Privacy Policy and data subject rights under the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the applicable Principles (“DPF Principles”) shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification page, please visit https://www.dataprivacyframework.gov/.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
The Federal Trade Commission has jurisdiction over Branch’s compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
Pursuant to the Data Privacy Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to other parties pursuant to the Data Privacy Frameworks unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Data Privacy Frameworks. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Data Privacy Frameworks, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union, UK, and Swiss individuals with DPF inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by BBB National Programs, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information and to file a complaint. This service is provided free of charge to you.
If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf?tabset-35584=2.
California Consumer Privacy Act
The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to natural persons who are residents of California. Our CCPA privacy notice is available here.
Rights of Residents of the European Economic Area and United Kingdom
The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.
Lei Geral de Proteção de Dados
Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.
Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 16). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately as required by law.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 16. If you are under 16, please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 16 may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 16 through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 16, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information as required by law.
We may change this Privacy Policy at any time in our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at info@branch.io
This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with this Privacy Policy.
Download

Table of Contents


Privacy Policy


The Branch Guiding Privacy Principles

Branch is a deep linking and attribution analytics platform for app and website developers. We are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. We further describe our privacy practices in the official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect to provide our services is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs to provide our services. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from providing Branch with any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Customers who subscribe to our linking and analytics platform can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell customer end user data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with the CCPA and GDPR requirements.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.
Branch Metrics, Inc. ( "Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices ("Digital Properties")--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our linking and analytics products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from vendors and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.
Branch and its Clients have entered into an agreement that governs the provision of Services by Branch and their use by Clients ("Agreement(s)"). Such Agreements may contain obligations on the parties with respect to the handling of information processed in the Services. Nothing in this Privacy Policy derogates from such obligations.
Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
Branch provides a variety of Services intended to help Clients understand the use of their Digital Properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience. For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly. For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the Client’s tracked platforms with the purpose of driving more engagement to the Client. For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to disclose to Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to disclose to Branch. We prohibit Clients from providing us with data relating to children under 13 (or, in certain jurisdictions, under 16).
Branch collects data through various methods, including:
  • When the Client integrates Branch’s SDK’s, API’s, pixels, redirect links, JavaScript tags, cookies or similar data collection technologies into their Digital Properties and/or ads;
  • From the various advertising networks and third parties that are used by the Client in connection with the measurement and analysis of Client’s marketing campaigns and that have partnered with Branch;
  • When provided voluntarily by the Client as part of the Branch account registration process.
Clients are also required to inform us if they are using Branch’s services to analyze information protected by HIPAA so that Branch can process such information in a protected environment.
In the charts below, we summarize the information collected automatically by the Services.
Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”). Since Clients have sole control over their Digital Properties and configuration of the Services, Clients are contractually prohibited from configuring the Services to collect directly identifiable personal information , unless otherwise agreed by Branch. If a Client has configured the Services to collect directly identifiable personal information, then Branch may receive and process such data. This includes, for example, a Client using an End User’s email address as a Client issued Developer ID.
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.

Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).
SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version
Metadata feature used for device identification and attribution
Internet connection type
Metadata feature used for device identification and attribution
Application version
Metadata feature used for device identification and attribution
Device model
Metadata feature used for device identification and attribution
Manufacturer / Brand
Metadata feature used for device identification and attribution
Operating system
Metadata feature used for device identification and attribution
Operating system version
Metadata feature used for device identification and attribution
Screen size (height, width)
Metadata feature used for device identification and attribution
Screen resolution
Metadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)
Metadata feature used for device identification and attribution
Device locale (country and language)
Metadata feature used for device identification and attribution
Local IP address
Metadata feature used for device identification and attribution
Mobile platform
Metadata feature used for device identification and attribution
Branch SDK version
Metadata feature used for device identification and attribution
Developer ID
(optional) Client-supplied unique identifier; metadata feature Used for device identification and attribution
Carrier ID
Metadata feature used for device identification and attribution
Environment
Metadata feature used for device identification and attribution
UI Mode
Metadata feature used for device identification and attribution
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.

Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).
In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution
As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) that have partnered with Branch to provide certain Engagement Data to Branch on the Client’s behalf in connection with the measurement and analysis of the Client's marketing campaigns.
Subject to Agreements with our Clients, data that Branch collects through the Services is processed to provide, maintain, optimize, research and improve the Services we provide our Clients, including to support other Branch products and services, to perform anti-fraud protection analysis, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
Where authorized by Agreements with our Clients, we may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any other parties, including business partners, Clients, and/or others.
Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their Digital Properties to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to disclose information about a hotel that she found in a travel app to a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being disclosed from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions, Agreements, or other contracts with us. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.
Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”) and adheres to its Code of Conduct. NAI provides you with the opportunity to opt out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.
Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io ( the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (other-party)
Other-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard
Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
We also require Clients to set up a user ID and unique password for account security purposes. Clients must not disclose their passwords to anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our payment and contract vendors.
Connection Information with Other Parties: Some features of the dashboard Services allow you to disclose your information through your accounts to other companies such as Facebook and Google. If you choose to connect Branch to such services provided by other parties, we may collect information related to your use of those services provided by other parties, such as authentication tokens that allow us to connect to your accounts with those other parties. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected services.
Information from Other Sources: In addition to the information collected through our Website, we or our vendors may obtain and disclose additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or databases maintained by other parties. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form on the Website. We use this information to answer their question(s), and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage vendors to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website.
If your browser settings permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit https://www.cookiepro.com/knowledgebase/knowledge_categories/cookies-101/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.
Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or other parties, or where required by law.
In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).
You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by filling out this form. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.
We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the "Do Not Track" settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies. Please note that "Do Not Track" is a different privacy mechanism than the Global Privacy Control browser choice referenced below.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.
The Website utilizes tracking tools from vendors, which may enable these vendors to analyze our Website traffic for analytics purposes. Some of these vendors may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the parties who provide them, and your interactions with these features are governed by the privacy policies of the parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.
Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.
In addition to the ways described in our Terms & Conditions, applicable Agreements, and this Privacy Policy, Branch may also disclose information to others under the following circumstances:
  • With vendors, consultants, global partners, and other parties who assist Branch to provide, support, and maintain the Services and the Website and need access to information we collect to do so;
  • With our Clients and their agents, as described in this Policy;
  • To other parties (such as advertising networks or vendors used by our Clients), as directed by our Clients;
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements;
  • To investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person;
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions;
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services; and
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings” which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.
Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.
Branch implements technical and organizational measures designed to protect against unauthorized access, accidental loss, destruction or damage of Client’s data. For more information on our security controls, please see https://www.branch.io/security/. If you have questions about the security of your personal information, or if you have reason to believe that the personal information that we hold about you is no longer secure, please contact us immediately as described in this Privacy Policy.
For our Services: Branch retains the information collected by the Services for no more time than is needed to serve the legitimate business need for which it was collected. For example, Branch stores the information collected by our Services for the purposes of establishing matches between devices used by Users (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), information collected from that User by our Services for the purposes of establishing matches between devices used by will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Usage activity logs of Users, which are used for the purpose of providing reporting and analytics to the Client, are stored in an identifiable form for no more than 7 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized usage activity logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Aggregated reporting metrics disclosed to Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.
For the Website: We retain the information collected by the Website for no more time than is needed to serve the legitimate business need for which it was collected. For example, we store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.
The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about websites or social media platforms operated by other parties. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.
All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. Data protection laws in the United States may differ from your country, and the data Branch processes may be accessible to law enforcement and national security authorities under certain circumstances. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Data Privacy Framework mechanism discussed in the “Data Privacy Framework For EU, UK, and Swiss Personal Data Transferred into the United States” section below.
Branch complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-US Data Privacy Framework (Swiss-U.S. DPF) (collectively, “Data Privacy Frameworks”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to the Data Privacy Frameworks. Branch has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom in reliance on the UK Extension to the EU-U.S. DPF. Branch has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the policies in this Privacy Policy and data subject rights under the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the applicable Principles (“DPF Principles”) shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification page, please visit https://www.dataprivacyframework.gov/.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
The Federal Trade Commission has jurisdiction over Branch’s compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
Pursuant to the Data Privacy Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to other parties pursuant to the Data Privacy Frameworks unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Data Privacy Frameworks. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Data Privacy Frameworks, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union, UK, and Swiss individuals with DPF inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by BBB National Programs, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information and to file a complaint. This service is provided free of charge to you.
If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf?tabset-35584=2.
California Consumer Privacy Act
The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to natural persons who are residents of California. Our CCPA privacy notice is available here.
Rights of Residents of the European Economic Area and United Kingdom
The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.
Lei Geral de Proteção de Dados
Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.
Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 16). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately as required by law.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 16. If you are under 16, please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 16 may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 16 through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 16, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information as required by law.
We may change this Privacy Policy at any time in our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at info@branch.io
This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with this Privacy Policy.
Download

Table of Contents


Privacy Policy


The Branch Guiding Privacy Principles

Branch is a deep linking and attribution analytics platform for app and website developers. We are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. We further describe our privacy practices in the official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect to provide our services is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs to provide our services. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from providing Branch with any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Customers who subscribe to our linking and analytics platform can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell customer end user data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with the CCPA and GDPR requirements.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.
Branch Metrics, Inc. ( "Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices ("Digital Properties")--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our linking and analytics products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from vendors and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.
Branch and its Clients have entered into an agreement that governs the provision of Services by Branch and their use by Clients ("Agreement(s)"). Such Agreements may contain obligations on the parties with respect to the handling of information processed in the Services. Nothing in this Privacy Policy derogates from such obligations.
Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
Branch provides a variety of Services intended to help Clients understand the use of their Digital Properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience. For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly. For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the Client’s tracked platforms with the purpose of driving more engagement to the Client. For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to disclose to Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to disclose to Branch. We strongly discourage Clients from disclosing sensitive User information with us, as such information is not necessary for the provision of the Services, and we prohibit them from providing us with data relating to children under 13 (or, in certain jurisdictions, under 16).
Branch collects data through various methods, including:
  • When the Client integrates Branch’s SDK’s, API’s, pixels, redirect links, JavaScript tags, cookies or similar data collection technologies into their Digital Properties and/or ads;
  • From the various advertising networks and third parties that are used by the Client in connection with the measurement and analysis of Client’s marketing campaigns and that have partnered with Branch;
  • When provided voluntarily by the Client as part of the Branch account registration process;
In the charts below, we summarize the information collected automatically by the Services.
Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”). Since Clients have sole control over their Digital Properties and configuration of the Services, Clients are contractually prohibited from configuring the Services to collect directly identifiable personal information , unless otherwise agreed by Branch. If a Client has configured the Services to collect directly identifiable personal information, then Branch may receive and process such data. This includes, for example, a Client using an End User’s email address as a Client issued Developer ID.
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.

Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).
SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version
Metadata feature used for device identification and attribution
Internet connection type
Metadata feature used for device identification and attribution
Application version
Metadata feature used for device identification and attribution
Device model
Metadata feature used for device identification and attribution
Manufacturer / Brand
Metadata feature used for device identification and attribution
Operating system
Metadata feature used for device identification and attribution
Operating system version
Metadata feature used for device identification and attribution
Screen size (height, width)
Metadata feature used for device identification and attribution
Screen resolution
Metadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)
Metadata feature used for device identification and attribution
Device locale (country and language)
Metadata feature used for device identification and attribution
Local IP address
Metadata feature used for device identification and attribution
Mobile platform
Metadata feature used for device identification and attribution
Branch SDK version
Metadata feature used for device identification and attribution
Developer ID
(optional) Client-supplied unique identifier; metadata feature Used for device identification and attribution
Carrier ID
Metadata feature used for device identification and attribution
Environment
Metadata feature used for device identification and attribution
UI Mode
Metadata feature used for device identification and attribution
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.

Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).
In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution
As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) that have partnered with Branch to provide certain Engagement Data to Branch on the Client’s behalf in connection with the measurement and analysis of the Client's marketing campaigns.
Data that Branch collects through the Services is processed to provide, maintain, optimize, research and improve the Services we provide our Clients, including to support other Branch products and services, to perform anti-fraud protection analysis, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
We may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any other parties, including business partners, Clients, and/or others.
Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their Digital Properties to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to disclose information about a hotel that she found in a travel app to a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being disclosed from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.
Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”) and adheres to its Code of Conduct. NAI provides you with the opportunity to opt out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.
Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io ( the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (other-party)
Other-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard
When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
We also require Clients to set up a user ID and unique password for account security purposes. Clients must not disclose their passwords to anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our payment and contract vendors.
Connection Information with Other Parties: Some features of the dashboard Services allow you to disclose your information through your accounts to other companies such as Facebook and Google. If you choose to connect Branch to such services provided by other parties, we may collect information related to your use of those services provided by other parties, such as authentication tokens that allow us to connect to your accounts with those other parties. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected services.
Information from Other Sources: In addition to the information collected through our Website, we or our vendors may obtain and disclose additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or databases maintained by other parties. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form on the Website. We use this information to answer their question(s), and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage vendors to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website.
If your browser settings permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit https://www.cookiepro.com/knowledgebase/knowledge_categories/cookies-101/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.
Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or other parties, or where required by law.
In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).
You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by filling out this form. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.
We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the "Do Not Track" settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies. Please note that "Do Not Track" is a different privacy mechanism than the Global Privacy Control browser choice referenced below.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.
The Website utilizes tracking tools from vendors, which may enable these vendors to analyze our Website traffic for analytics purposes. Some of these vendors may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the parties who provide them, and your interactions with these features are governed by the privacy policies of the parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.
Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.
In addition to the ways described in our Terms & Conditions and this Privacy Policy, Branch may also disclose information to others under the following circumstances:
  • With vendors, consultants, global partners, and other parties who assist Branch to provide, support, and maintain the Services and the Website and need access to information we collect to do so;
  • With our Clients and their agents, as described in this Policy;
  • To other parties (such as advertising networks or vendors used by our Clients), as directed by our Clients;
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements;
  • To investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person;
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions;
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services; and
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings” which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.
Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.
Branch implements technical and organizational measures designed to protect against unauthorized access, accidental loss, destruction or damage of Client’s data. For more information on our security controls, please see https://www.branch.io/security/. If you have questions about the security of your personal information, or if you have reason to believe that the personal information that we hold about you is no longer secure, please contact us immediately as described in this Privacy Policy.
For our Services: Branch retains the information collected by the Services for no more time than is needed to serve the legitimate business need for which it was collected. For example, Branch stores the information collected by our Services for the purposes of establishing matches between devices used by Users (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), information collected from that User by our Services for the purposes of establishing matches between devices used by will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Usage activity logs of Users, which are used for the purpose of providing reporting and analytics to the Client, are stored in an identifiable form for no more than 7 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized usage activity logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Aggregated reporting metrics disclosed to Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.
For the Website: We retain the information collected by the Website for no more time than is needed to serve the legitimate business need for which it was collected. For example, we store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.
The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about websites or social media platforms operated by other parties. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.
All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. Data protection laws in the United States may differ from your country, and the data Branch processes may be accessible to law enforcement and national security authorities under certain circumstances. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Data Privacy Framework mechanism discussed in the “Data Privacy Framework For EU, UK, and Swiss Personal Data Transferred into the United States” section below.
Branch complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-US Data Privacy Framework (Swiss-U.S. DPF) (collectively, “Data Privacy Frameworks”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to the Data Privacy Frameworks. Branch has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom in reliance on the UK Extension to the EU-U.S. DPF. Branch has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the policies in this Privacy Policy and data subject rights under the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the applicable Principles (“DPF Principles”) shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification page, please visit https://www.dataprivacyframework.gov/.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
The Federal Trade Commission has jurisdiction over Branch’s compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
Pursuant to the Data Privacy Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to other parties pursuant to the Data Privacy Frameworks unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Data Privacy Frameworks. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Data Privacy Frameworks, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union, UK, and Swiss individuals with DPF inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by BBB National Programs, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information and to file a complaint. This service is provided free of charge to you.
If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf?tabset-35584=2.
California Consumer Privacy Act
The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to natural persons who are residents of California. Our CCPA privacy notice is available here.
Rights of Residents of the European Economic Area and United Kingdom
The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.
Lei Geral de Proteção de Dados
Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.
Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 16). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately as required by law.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 16. If you are under 16, please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 16 may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 16 through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 16, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information as required by law.
We may change this Privacy Policy at any time in our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at info@branch.io
This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with this Privacy Policy.
Download

Table of Contents


Privacy Policy

Effective October 6, 2023

The Branch Guiding Privacy Principles

We are a linking and analytics platform for app and website developers. And we are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. We further describe our privacy practices in the official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect to provide our services is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs to provide our services. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from providing Branch with any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Customers who subscribe to our linking and analytics platform can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell customer end user data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with the CCPA and GDPR requirements.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.
Branch Metrics, Inc. ( "Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our linking and analytics products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from vendors and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.
Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
Branch provides a variety of Services intended to help Clients understand the use of their digital properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience.
  • For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly.
  • For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link, and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the Client’s tracked platforms with the purpose of driving more engagement to the Client.
  • For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to disclose to Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to disclose to Branch. We strongly discourage Clients from disclosing sensitive User information with us, as such information is not necessary for the provision of the Services, and we prohibit them from providing us with data relating to children under 13 (or, in certain jurisdictions, under 16).
In the charts below, we summarize the information collected automatically by the Services.
Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”).
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.
Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).
SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version
Metadata feature used for device identification and attribution
Internet connection type
Metadata feature used for device identification and attribution
Application version
Metadata feature used for device identification and attribution
Device model
Metadata feature used for device identification and attribution
Manufacturer / Brand
Metadata feature used for device identification and attribution
Operating system
Metadata feature used for device identification and attribution
Operating system version
Metadata feature used for device identification and attribution
Screen size (height, width)
Metadata feature used for device identification and attribution
Screen resolution
Metadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)
Metadata feature used for device identification and attribution
Device locale (country and language)
Metadata feature used for device identification and attribution
Local IP address
Metadata feature used for device identification and attribution
Mobile platform
Metadata feature used for device identification and attribution
Branch SDK version
Metadata feature used for device identification and attribution
Developer ID
(optional) Client-supplied unique identifier; metadata feature Used for device identification and attribution
Carrier ID
Metadata feature used for device identification and attribution
Environment
Metadata feature used for device identification and attribution
UI Mode
Metadata feature used for device identification and attribution
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.
Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).
In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution
As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) to provide certain Engagement Data to Branch on the Client’s behalf.
Data Branch collects through the Services is processed:
  • to better understand how and from where Users come to download certain apps, what types of apps are popular, or to recognize browsers and devices that are likely to be operated by the same User.
  • to provide, maintain, optimize, research and improve the Branch Services we provide our Clients, including to support other Branch products and services, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
  • to fulfill Clients’ and prospective Clients’ requests for the Services including processing data at the Client’s direction and transferring User data to them. Branch does not control how Clients use information Branch discloses to Clients, and Users should read Clients’ Privacy Policies to understand how they use information they receive from Branch.
  • to aggregate data across various sources, including data from various Clients or other parties.
  • to create reports based on aggregated information, which is information that cannot reasonably be linked back to any individual person or Client and disclose these reports to the public.
  • for anti-fraud protection and analysis relating to the Services to ensure more accurate attribution measurement, general fraud prevention, or where otherwise required by law.
We may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any other parties, including business partners, Clients, and/or others.
Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their apps to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to disclose information about a hotel that she found in a travel app to a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being disclosed from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.
Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”) and adheres to its Code of Conduct. NAI provides you with the opportunity to opt out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.
Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io ( the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (other-party)
Other-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard
When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
We also require Clients to set up a user ID and unique password for account security purposes. Clients must not disclose their passwords to anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our payment and contract vendors.
Connection Information with Other Parties: Some features of the dashboard Services allow you to disclose your information through your accounts to other companies such as Facebook and Google. If you choose to connect Branch to such services provided by other parties, we may collect information related to your use of those services provided by other parties, such as authentication tokens that allow us to connect to your accounts with those other parties. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected services.
Information from Other Sources: In addition to the information collected through our Website, we or our vendors may obtain and disclose additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or databases maintained by other parties. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form on the Website. We use this information to answer their question(s), and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage vendors to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website.
If you permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit https://www.cookiepro.com/knowledgebase/knowledge_categories/cookies-101/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.
Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or other parties, or where required by law.
In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).
You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by filling out this form. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.
We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the "Do Not Track" settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies. Please note that "Do Not Track" is a different privacy mechanism than the Global Privacy Control browser choice referenced below.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.
The Website utilizes tracking tools from vendors, which may enable these vendors to analyze our Website traffic for analytics purposes. Some of these vendors may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the parties who provide them, and your interactions with these features are governed by the privacy policies of the parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.
Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.
In addition to the ways described in our Terms & Conditions and this Privacy Policy, Branch may also disclose information to others under the following circumstances:
  • With vendors, consultants and other parties who work for us and need access to information we collect to do that work.
  • With our Clients and their agents, as described in this Policy.
  • To other parties (such as advertising networks or vendors used by our Clients), as directed by our Clients.
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements, and in order to investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person.
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions.
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services.
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings” which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.
Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.
For our Services: Branch stores the information collected by our Services (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), identifiers collected from that User will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Usage activity logs, which are used for the purpose of reporting and analytics, are stored in an identifiable form for no more than 7 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Aggregated reporting metrics disclosed to Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.
For the Website: We store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.
The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about websites or social media platforms operated by other parties. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.
All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. Data protection laws in the United States may differ from your country, and the data Branch processes may be accessible to law enforcement and national security authorities under certain circumstances. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Data Privacy Framework mechanism discussed in the “Data Privacy Framework For EU, UK, and Swiss Personal Data Transferred into the United States” section below.
Branch complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-US Data Privacy Framework (Swiss-U.S. DPF) (collectively, “Data Privacy Frameworks”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to the Data Privacy Frameworks. Branch has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom in reliance on the UK Extension to the EU-U.S. DPF. Branch has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the policies in this Privacy Policy and data subject rights under the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the applicable Principles (“DPF Principles”) shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification page, please visit https://www.dataprivacyframework.gov/.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
The Federal Trade Commission has jurisdiction over Branch’s compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
Pursuant to the Data Privacy Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to other parties pursuant to the Data Privacy Frameworks unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Data Privacy Frameworks. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Data Privacy Frameworks, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union, UK, and Swiss individuals with DPF inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by BBB National Programs, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information and to file a complaint. This service is provided free of charge to you.
If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf?tabset-35584=2.
California Consumer Privacy Act
The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to natural persons who are residents of California. Our CCPA privacy notice is available here.
Rights of Residents of the European Economic Area and United Kingdom
The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.
Lei Geral de Proteção de Dados
Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.
Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 16). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately as required by law.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 16. If you are under 16, please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 16 may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 16 through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 16, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information as required by law.
We may change this Privacy Policy at any time in our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at info@branch.io
This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with this Privacy Policy.
Download

Table of Contents


Privacy Policy

Effective October 6, 2023

The Branch Guiding Privacy Principles

We are a linking and analytics platform for app and website developers. And we are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. We further describe our privacy practices in the official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect to provide our services is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs to provide our services. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from providing Branch with any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Customers who subscribe to our linking and analytics platform can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell customer end user data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with the CCPA and GDPR requirements.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.
Branch Metrics, Inc. ( "Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our linking and analytics products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from vendors and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.
Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
Branch provides a variety of Services intended to help Clients understand the use of their digital properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience.
  • For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly.
  • For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link, and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the Client’s tracked platforms with the purpose of driving more engagement to the Client.
  • For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to disclose to Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to disclose to Branch. We strongly discourage Clients from disclosing sensitive User information with us, as such information is not necessary for the provision of the Services, and we prohibit them from providing us with data relating to children under 13 (or, in certain jurisdictions, under 16).
In the charts below, we summarize the information collected automatically by the Services.
Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”).
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.
Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).
SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version
Metadata feature used for device identification and attribution
Internet connection type
Metadata feature used for device identification and attribution
Application version
Metadata feature used for device identification and attribution
Device model
Metadata feature used for device identification and attribution
Manufacturer / Brand
Metadata feature used for device identification and attribution
Operating system
Metadata feature used for device identification and attribution
Operating system version
Metadata feature used for device identification and attribution
Screen size (height, width)
Metadata feature used for device identification and attribution
Screen resolution
Metadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)
Metadata feature used for device identification and attribution
Device locale (country and language)
Metadata feature used for device identification and attribution
Local IP address
Metadata feature used for device identification and attribution
Mobile platform
Metadata feature used for device identification and attribution
Branch SDK version
Metadata feature used for device identification and attribution
Developer ID
(optional) Client-supplied unique identifier; metadata feature Used for device identification and attribution
Carrier ID
Metadata feature used for device identification and attribution
Environment
Metadata feature used for device identification and attribution
UI Mode
Metadata feature used for device identification and attribution
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.
Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).
In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution
As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) to provide certain Engagement Data to Branch on the Client’s behalf.
Data Branch collects through the Services is processed:
  • to better understand how and from where Users come to download certain apps, what types of apps are popular, or to recognize browsers and devices that are likely to be operated by the same User.
  • to provide, maintain, optimize, research and improve the Branch Services we provide our Clients, including to support other Branch products and services, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
  • to fulfill Clients’ and prospective Clients’ requests for the Services including processing data at the Client’s direction and transferring User data to them. Branch does not control how Clients use information Branch discloses to Clients, and Users should read Clients’ Privacy Policies to understand how they use information they receive from Branch.
  • to aggregate data across various sources, including data from various Clients or other parties.
  • to create reports based on aggregated information, which is information that cannot reasonably be linked back to any individual person or Client and disclose these reports to the public.
  • for anti-fraud protection and analysis relating to the Services to ensure more accurate attribution measurement, general fraud prevention, or where otherwise required by law.
We may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any other parties, including business partners, Clients, and/or others.
Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their apps to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to disclose information about a hotel that she found in a travel app to a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being disclosed from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.
Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”) and adheres to its Code of Conduct. NAI provides you with the opportunity to opt out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.
Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io ( the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (other-party)
Other-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard
When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
We also require Clients to set up a user ID and unique password for account security purposes. Clients must not disclose their passwords to anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our payment and contract vendors.
Connection Information with Other Parties: Some features of the dashboard Services allow you to disclose your information through your accounts to other companies such as Facebook and Google. If you choose to connect Branch to such services provided by other parties, we may collect information related to your use of those services provided by other parties, such as authentication tokens that allow us to connect to your accounts with those other parties. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected services.
Information from Other Sources: In addition to the information collected through our Website, we or our vendors may obtain and disclose additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or databases maintained by other parties. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form on the Website. We use this information to answer their question(s), and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage vendors to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website.
If you permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit https://www.cookiepro.com/knowledgebase/knowledge_categories/cookies-101/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.
Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or other parties, or where required by law.
In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).
You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by filling out this form. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.
We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the "Do Not Track" settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies. Please note that "Do Not Track" is a different privacy mechanism than the Global Privacy Control browser choice referenced below.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.
The Website utilizes tracking tools from vendors, which may enable these vendors to analyze our Website traffic for analytics purposes. Some of these vendors may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the parties who provide them, and your interactions with these features are governed by the privacy policies of the parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.
Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.
In addition to the ways described in our Terms & Conditions and this Privacy Policy, Branch may also disclose information to others under the following circumstances:
  • With vendors, consultants and other parties who work for us and need access to information we collect to do that work.
  • With our Clients and their agents, as described in this Policy.
  • To other parties (such as advertising networks or vendors used by our Clients), as directed by our Clients.
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements, and in order to investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person.
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions.
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services.
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings” which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.
Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.
For our Services: Branch stores the information collected by our Services (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), identifiers collected from that User will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Usage activity logs, which are used for the purpose of reporting and analytics, are stored in an identifiable form for no more than 7 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Aggregated reporting metrics disclosed to Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.
For the Website: We store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.
The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about websites or social media platforms operated by other parties. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.
All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. Data protection laws in the United States may differ from your country, and the data Branch processes may be accessible to law enforcement and national security authorities under certain circumstances. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Data Privacy Framework mechanism discussed in the “Privacy Shield For EU, UK, and Swiss Personal Data Transferred into the United States” section below.
Branch complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-US Data Privacy Framework (Swiss-U.S. DPF) (collectively, “Data Privacy Frameworks”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to the Data Privacy Frameworks. Branch has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom in reliance on the UK Extension to the EU-U.S. DPF. Branch has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the policies in this Privacy Policy and data subject rights under the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the applicable Principles (“DPF Principles”) shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification page, please visit https://www.dataprivacyframework.gov/.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
The Federal Trade Commission has jurisdiction over Branch’s compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
Pursuant to the Data Privacy Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to other parties pursuant to the Data Privacy Frameworks unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Data Privacy Frameworks. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Data Privacy Frameworks, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union, UK, and Swiss individuals with DPF inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by BBB National Programs, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information and to file a complaint. This service is provided free of charge to you.
If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf?tabset-35584=2.
California Consumer Privacy Act
The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to natural persons who are residents of California. Our CCPA privacy notice is available here.
Rights of Residents of the European Economic Area and United Kingdom
The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.
Lei Geral de Proteção de Dados
Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.
Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 16). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately as required by law.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 16. If you are under 16, please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 16 may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 16 through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 16, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information as required by law.
We may change this Privacy Policy at any time in our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at info@branch.io
This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with this Privacy Policy.
Download

Table of Contents


Privacy Policy


The Branch Guiding Privacy Principles

We are a linking and analytics platform for app and website developers. And we are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. We further describe our privacy practices in the official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect to provide our services is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs to provide our services. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from providing Branch with any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Customers who subscribe to our linking and analytics platform can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell customer end user data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with the CCPA and GDPR requirements.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.

Introduction

Branch Metrics, Inc. ( "Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our linking and analytics products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from vendors and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.

Collection and Use of Information from Our Services

What Information Does Branch Collect from Our Services?

Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

The Branch Services: Overview

Branch provides a variety of Services intended to help Clients understand the use of their digital properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience.
    • For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly.
    • For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link, and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the Client’s tracked platforms with the purpose of driving more engagement to the Client.
    • For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to disclose to Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to disclose to Branch. We strongly discourage Clients from disclosing sensitive User information with us, as such information is not necessary for the provision of the Services, and we prohibit them from providing us with data relating to children under 13 (or, in certain jurisdictions, under 16).
In the charts below, we summarize the information collected automatically by the Services.
Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”).
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.
Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).

Information Collected by Branch SDKs

SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version
Metadata feature used for device identification and attribution
Internet connection type
Metadata feature used for device identification and attribution
Application version
Metadata feature used for device identification and attribution
Device model
Metadata feature used for device identification and attribution
Manufacturer / Brand
Metadata feature used for device identification and attribution
Operating system
Metadata feature used for device identification and attribution
Operating system version
Metadata feature used for device identification and attribution
Screen size (height, width)
Metadata feature used for device identification and attribution
Screen resolution
Metadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)
Metadata feature used for device identification and attribution
Device locale (country and language)
Metadata feature used for device identification and attribution
Local IP address
Metadata feature used for device identification and attribution
Mobile platform
Metadata feature used for device identification and attribution
Branch SDK version
Metadata feature used for device identification and attribution
Developer ID
(optional) Client-supplied unique identifier; metadata feature Used for device identification and attribution
Carrier ID
Metadata feature used for device identification and attribution
Environment
Metadata feature used for device identification and attribution
UI Mode
Metadata feature used for device identification and attribution
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.
Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).
In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution

Information Collected By Other Parties

As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) to provide certain Engagement Data to Branch on the Client’s behalf.

How Does Branch Use Information Collected by Our Services?

Data Branch collects through the Services is processed:
  • to better understand how and from where Users come to download certain apps, what types of apps are popular, or to recognize browsers and devices that are likely to be operated by the same User.
  • to provide, maintain, optimize, research and improve the Branch Services we provide our Clients, including to support other Branch products and services, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
  • to fulfill Clients’ and prospective Clients’ requests for the Services including processing data at the Client’s direction and transferring User data to them. Branch does not control how Clients use information Branch discloses to Clients, and Users should read Clients’ Privacy Policies to understand how they use information they receive from Branch.
  • to aggregate data across various sources, including data from various Clients or other parties.
  • to create reports based on aggregated information, which is information that cannot reasonably be linked back to any individual person or Client and disclose these reports to the public.
  • for anti-fraud protection and analysis relating to the Services to ensure more accurate attribution measurement, general fraud prevention, or where otherwise required by law.
We may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any other parties, including business partners, Clients, and/or others.

Our Clients’ Use of Information

Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their apps to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to disclose information about a hotel that she found in a travel app to a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being disclosed from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.

User Choices

Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”) and adheres to its Code of Conduct. NAI provides you with the opportunity to opt out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.

Collection and Use of Information from Our Website and for Marketing Purposes

What Information Does Branch Collect about Website Visitors and Potential Customers?

Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io ( the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

What We Collect from Clients that Use the Website

Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (other-party)
Other-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard
When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
We also require Clients to set up a user ID and unique password for account security purposes. Clients must not disclose their passwords to anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our payment and contract vendors.
Connection Information with Other Parties: Some features of the dashboard Services allow you to disclose your information through your accounts to other companies such as Facebook and Google. If you choose to connect Branch to such services provided by other parties, we may collect information related to your use of those services provided by other parties, such as authentication tokens that allow us to connect to your accounts with those other parties. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected services.
Information from Other Sources: In addition to the information collected through our Website, we or our vendors may obtain and disclose additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or databases maintained by other parties. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form on the Website. We use this information to answer their question(s), and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage vendors to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website.
If you permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit https://www.cookiepro.com/knowledgebase/knowledge_categories/cookies-101/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.

How Does Branch Use the Information Collected?

Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or other parties, or where required by law.

Opt-Out & Do Not Track - Your Choice Mechanisms

In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).

Opt Out from Promotional Emails

You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by filling out this form. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.

Opt Out from Website Cookies/Web Beacons

We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the "Do Not Track" settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies. Please note that "Do Not Track" is a different privacy mechanism than the Global Privacy Control browser choice referenced below.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.

Vendor Tools/Analytics on the Website

The Website utilizes tracking tools from vendors, which may enable these vendors to analyze our Website traffic for analytics purposes. Some of these vendors may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the parties who provide them, and your interactions with these features are governed by the privacy policies of the parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.
Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.

Policies Applicable to Both Our Services & Our Website

When does Branch Disclose Information?

In addition to the ways described in our Terms & Conditions and this Privacy Policy, Branch may also disclose information to others under the following circumstances:
  • With vendors, consultants and other parties who work for us and need access to information we collect to do that work.
  • With our Clients and their agents, as described in this Policy.
  • To other parties (such as advertising networks or vendors used by our Clients), as directed by our Clients.
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements, and in order to investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person.
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions.
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services.
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Updating Your Information and Contact Preferences

We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings” which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.

We Secure the Information We Collect

Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.

Our Data Retention Policy

For our Services: Branch stores the information collected by our Services (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), identifiers collected from that User will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Usage activity logs, which are used for the purpose of reporting and analytics, are stored in an identifiable form for no more than 7 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Aggregated reporting metrics disclosed to Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.
For the Website: We store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.
The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about websites or social media platforms operated by other parties. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.

International Data Transfers

All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. Data protection laws in the United States may differ from your country, and the data Branch processes may be accessible to law enforcement and national security authorities under certain circumstances. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Privacy Shield mechanism discussed in the “Privacy Shield For EU, UK, and Swiss Personal Data Transferred into the United States” section below.

Privacy Shield For EU, UK, and Swiss Personal Data Transferred into the United States

Branch complies with the E.U.-U.S. Privacy Shield Framework and the Swiss-US Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to Privacy Shield. Branch recognizes that the Court of Justice of the European Union ruled in July 2020 that a certification under the EU-U.S. Privacy Shield Framework no longer can serve as the basis by which entities subject to the GDPR export personal data to jurisdictions outside the European Economic Area, and that the Swiss Data Protection Authority similarly held the Swiss-US Privacy Shield inadequate. Branch will continue to honor its obligation to comply with the Privacy Shield Principles with respect to data that was transferred pursuant to the EU-U.S. and Swiss-U.S. Privacy Shield Framework. If there is any conflict between the policies in this Privacy Policy and data subject rights under the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification page, please visit https://www.privacyshield.gov.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
Branch is subject to the investigatory and enforcement authority of the US Federal Trade Commission.
Pursuant to the Privacy Shield Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to other parties pursuant to the Privacy Shield unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Privacy Shield. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Privacy Shield Principles, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to Privacy Shield. European Union, UK, and Swiss individuals with Privacy Shield inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU PRIVACY SHIELD, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit http://www.bbb.org/EU-privacy-shield/for-eu-consumers for more information and to file a complaint. This service is provided free of charge to you.
If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 at https://www.privacyshield.gov/article?id=ANNEX-I-introduction.

Data Subject Rights

California Consumer Privacy Act
The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to natural persons who are residents of California. Our CCPA privacy notice is available here.
Rights of Residents of the European Economic Area and United Kingdom
The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.
Lei Geral de Proteção de Dados
Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.

Our Policy Regarding Children

Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 16). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately as required by law.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 16. If you are under 16, please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 16 may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 16 through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 16, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information as required by law.

Contact Us, Questions, Changes to This Privacy Policy

We may change this Privacy Policy at any time in our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at info@branch.io

Compliance

This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with this Privacy Policy.
Download

Table of Contents


Privacy Policy


The Branch Guiding Privacy Principles

We are a linking and analytics platform for app and website developers. And we are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. We further describe our privacy practices in the official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect to provide our services is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs to provide our services. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from providing Branch with any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Customers who subscribe to our linking and analytics platform can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell customer end user data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with the CCPA and GDPR requirements.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.

Introduction

Branch Metrics, Inc. ( "Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our linking and analytics products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from vendors and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.

Collection and Use of Information from Our Services

What Information Does Branch Collect from Our Services?

Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

The Branch Services: Overview

Branch provides a variety of Services intended to help Clients understand the use of their digital properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience.
    • For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly.
    • For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link, and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the Client’s tracked platforms with the purpose of driving more engagement to the Client.
    • For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to disclose to Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to disclose to Branch. We strongly discourage Clients from disclosing sensitive User information with us, as such information is not necessary for the provision of the Services, and we prohibit them from providing us with data relating to children under 13 (or, in certain jurisdictions, under 16).
In the charts below, we summarize the information collected automatically by the Services.
Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”).
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.
Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).

Information Collected by Branch SDKs

SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version
Metadata feature used for device identification and attribution
Internet connection type
Metadata feature used for device identification and attribution
Application version
Metadata feature used for device identification and attribution
Device model
Metadata feature used for device identification and attribution
Manufacturer / Brand
Metadata feature used for device identification and attribution
Operating system
Metadata feature used for device identification and attribution
Operating system version
Metadata feature used for device identification and attribution
Screen size (height, width)
Metadata feature used for device identification and attribution
Screen resolution
Metadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)
Metadata feature used for device identification and attribution
Device locale (country and language)
Metadata feature used for device identification and attribution
Local IP address
Metadata feature used for device identification and attribution
Mobile platform
Metadata feature used for device identification and attribution
Branch SDK version
Metadata feature used for device identification and attribution
Developer ID
(optional) Client-supplied unique identifier; metadata feature Used for device identification and attribution
Carrier ID
Metadata feature used for device identification and attribution
Environment
Metadata feature used for device identification and attribution
UI Mode
Metadata feature used for device identification and attribution
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.
Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).
In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution

Information Collected By Other Parties

As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) to provide certain Engagement Data to Branch on the Client’s behalf.

How Does Branch Use Information Collected by Our Services?

Data Branch collects through the Services is processed:
  • to better understand how and from where Users come to download certain apps, what types of apps are popular, or to recognize browsers and devices that are likely to be operated by the same User.
  • to provide, maintain, optimize, research and improve the Branch Services we provide our Clients, including to support other Branch products and services, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
  • to fulfill Clients’ and prospective Clients’ requests for the Services including processing data at the Client’s direction and transferring User data to them. Branch does not control how Clients use information Branch discloses to Clients, and Users should read Clients’ Privacy Policies to understand how they use information they receive from Branch.
  • to aggregate data across various sources, including data from various Clients or other parties.
  • to create reports based on aggregated information, which is information that cannot reasonably be linked back to any individual person or Client and disclose these reports to the public.
  • for anti-fraud protection and analysis relating to the Services to ensure more accurate attribution measurement, general fraud prevention, or where otherwise required by law.
We may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any other parties, including business partners, Clients, and/or others.

Our Clients’ Use of Information

Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their apps to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to disclose information about a hotel that she found in a travel app to a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being disclosed from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.

User Choices

Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”) and adheres to its Code of Conduct. NAI provides you with the opportunity to opt out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.

Collection and Use of Information from Our Website and for Marketing Purposes

What Information Does Branch Collect about Website Visitors and Potential Customers?

Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io ( the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

What We Collect from Clients that Use the Website

Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (other-party)
Other-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard
When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
We also require Clients to set up a user ID and unique password for account security purposes. Clients must not disclose their passwords to anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our payment and contract vendors.
Connection Information with Other Parties: Some features of the dashboard Services allow you to disclose your information through your accounts to other companies such as Facebook and Google. If you choose to connect Branch to such services provided by other parties, we may collect information related to your use of those services provided by other parties, such as authentication tokens that allow us to connect to your accounts with those other parties. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected services.
Information from Other Sources: In addition to the information collected through our Website, we or our vendors may obtain and disclose additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or databases maintained by other parties. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form on the Website. We use this information to answer their question(s), and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage vendors to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website.
If you permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit http://www.allaboutcookies.org/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.

How Does Branch Use the Information Collected?

Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or other parties, or where required by law.

Opt-Out & Do Not Track - Your Choice Mechanisms

In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).

Opt Out from Promotional Emails

You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by filling out this form. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.

Opt Out from Website Cookies/Web Beacons

We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the "Do Not Track" settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies. Please note that "Do Not Track" is a different privacy mechanism than the Global Privacy Control browser choice referenced below.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.

Vendor Tools/Analytics on the Website

The Website utilizes tracking tools from vendors, which may enable these vendors to analyze our Website traffic for analytics purposes. Some of these vendors may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the parties who provide them, and your interactions with these features are governed by the privacy policies of the parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.
Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.

Policies Applicable to Both Our Services & Our Website

When does Branch Disclose Information?

In addition to the ways described in our Terms & Conditions and this Privacy Policy, Branch may also disclose information to others under the following circumstances:
  • With vendors, consultants and other parties who work for us and need access to information we collect to do that work.
  • With our Clients and their agents, as described in this Policy.
  • To other parties (such as advertising networks or vendors used by our Clients), as directed by our Clients.
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements, and in order to investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person.
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions.
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services.
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Updating Your Information and Contact Preferences

We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings” which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.

We Secure the Information We Collect

Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.

Our Data Retention Policy

For our Services: Branch stores the information collected by our Services (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), identifiers collected from that User will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Usage activity logs, which are used for the purpose of reporting and analytics, are stored in an identifiable form for no more than 7 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Aggregated reporting metrics disclosed to Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.
For the Website: We store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.
The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about websites or social media platforms operated by other parties. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.

International Data Transfers

All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. Data protection laws in the United States may differ from your country, and the data Branch processes may be accessible to law enforcement and national security authorities under certain circumstances. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Privacy Shield mechanism discussed in the “Privacy Shield For EU, UK, and Swiss Personal Data Transferred into the United States” section below.

Privacy Shield For EU, UK, and Swiss Personal Data Transferred into the United States

Branch complies with the E.U.-U.S. Privacy Shield Framework and the Swiss-US Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to Privacy Shield. Branch recognizes that the Court of Justice of the European Union ruled in July 2020 that a certification under the EU-U.S. Privacy Shield Framework no longer can serve as the basis by which entities subject to the GDPR export personal data to jurisdictions outside the European Economic Area, and that the Swiss Data Protection Authority similarly held the Swiss-US Privacy Shield inadequate. Branch will continue to honor its obligation to comply with the Privacy Shield Principles with respect to data that was transferred pursuant to the EU-U.S. and Swiss-U.S. Privacy Shield Framework. If there is any conflict between the policies in this Privacy Policy and data subject rights under the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification page, please visit https://www.privacyshield.gov.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
Branch is subject to the investigatory and enforcement authority of the US Federal Trade Commission.
Pursuant to the Privacy Shield Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to other parties pursuant to the Privacy Shield unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Privacy Shield. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Privacy Shield Principles, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to Privacy Shield. European Union, UK, and Swiss individuals with Privacy Shield inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU PRIVACY SHIELD, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit http://www.bbb.org/EU-privacy-shield/for-eu-consumers for more information and to file a complaint. This service is provided free of charge to you.
If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 at https://www.privacyshield.gov/article?id=ANNEX-I-introduction.

Data Subject Rights

California Consumer Privacy Act
The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to natural persons who are residents of California. Our CCPA privacy notice is available here.
Rights of Residents of the European Economic Area and United Kingdom
The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.
Lei Geral de Proteção de Dados
Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.

Our Policy Regarding Children

Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 16). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately as required by law.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 16. If you are under 16, please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 16 may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 16 through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 16, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information as required by law.

Contact Us, Questions, Changes to This Privacy Policy

We may change this Privacy Policy at any time in our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at info@branch.io

Compliance

This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with this Privacy Policy.
Download

Table of Contents


Privacy Policy


The Branch Guiding Privacy Principles

We are a linking and analytics platform for app and website developers. And we are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. We further describe our privacy practices in the official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect to provide our services is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs to provide our services. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from providing Branch with any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Customers who subscribe to our linking and analytics platform can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell customer end user data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with the CCPA and GDPR requirements.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.

Introduction

Branch Metrics, Inc. ( "Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our linking and analytics products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from vendors and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.

Collection and Use of Information from Our Services

What Information Does Branch Collect from Our Services?

Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

The Branch Services: Overview

Branch provides a variety of Services intended to help Clients understand the use of their digital properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience.
    • For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly.
    • For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link, and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the Client’s tracked platforms with the purpose of driving more engagement to the Client.
    • For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to disclose to Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to disclose to Branch. We strongly discourage Clients from disclosing sensitive User information with us, as such information is not necessary for the provision of the Services, and we prohibit them from providing us with data relating to children under 13 (or, in certain jurisdictions, under 16).
In the charts below, we summarize the information collected automatically by the Services.
Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”).
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.
Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).

Information Collected by Branch SDKs

SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version
Metadata feature used for device identification and attribution
Internet connection type
Metadata feature used for device identification and attribution
Application version
Metadata feature used for device identification and attribution
Device model
Metadata feature used for device identification and attribution
Manufacturer / Brand
Metadata feature used for device identification and attribution
Operating system
Metadata feature used for device identification and attribution
Operating system version
Metadata feature used for device identification and attribution
Screen size (height, width)
Metadata feature used for device identification and attribution
Screen resolution
Metadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)
Metadata feature used for device identification and attribution
Device locale (country and language)
Metadata feature used for device identification and attribution
Local IP address
Metadata feature used for device identification and attribution
Mobile platform
Metadata feature used for device identification and attribution
Branch SDK version
Metadata feature used for device identification and attribution
Developer ID
(optional) Client-supplied unique identifier; metadata feature Used for device identification and attribution
Carrier ID
Metadata feature used for device identification and attribution
Environment
Metadata feature used for device identification and attribution
UI Mode
Metadata feature used for device identification and attribution
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.
Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).
In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution

Information Collected By Other Parties

As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) to provide certain Engagement Data to Branch on the Client’s behalf.

How Does Branch Use Information Collected by Our Services?

Data Branch collects through the Services is processed:
  • to better understand how and from where Users come to download certain apps, what types of apps are popular, or to recognize browsers and devices that are likely to be operated by the same User.
  • to provide, maintain, optimize, research and improve the Branch Services we provide our Clients, including to support other Branch products and services, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
  • to fulfill Clients’ and prospective Clients’ requests for the Services including processing data at the Client’s direction and transferring User data to them. Branch does not control how Clients use information Branch discloses to Clients, and Users should read Clients’ Privacy Policies to understand how they use information they receive from Branch.
  • to aggregate data across various sources, including data from various Clients or other parties.
  • to create reports based on aggregated information, which is information that cannot reasonably be linked back to any individual person or Client and disclose these reports to the public.
  • for anti-fraud protection and analysis relating to the Services to ensure more accurate attribution measurement, general fraud prevention, or where otherwise required by law.
We may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any other parties, including business partners, Clients, and/or others.

Our Clients’ Use of Information

Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their apps to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to disclose information about a hotel that she found in a travel app to a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being disclosed from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.

User Choices

Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”) and adheres to its Code of Conduct. NAI provides you with the opportunity to opt out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.

Collection and Use of Information from Our Website and for Marketing Purposes

What Information Does Branch Collect about Website Visitors and Potential Customers?

Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io ( the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

What We Collect from Clients that Use the Website

Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (other-party)
Other-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard
When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
We also require Clients to set up a user ID and unique password for account security purposes. Clients must not disclose their passwords to anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our payment and contract vendors.
Connection Information with Other Parties: Some features of the dashboard Services allow you to disclose your information through your accounts to other companies such as Facebook and Google. If you choose to connect Branch to such services provided by other parties, we may collect information related to your use of those services provided by other parties, such as authentication tokens that allow us to connect to your accounts with those other parties. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected services.
Information from Other Sources: In addition to the information collected through our Website, we or our vendors may obtain and disclose additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or databases maintained by other parties. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form on the Website. We use this information to answer their question(s), and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage vendors to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website.
If you permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit http://www.allaboutcookies.org/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.

How Does Branch Use the Information Collected?

Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or other parties, or where required by law.

Opt-Out & Do Not Track - Your Choice Mechanisms

In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).

Opt Out from Promotional Emails

You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by filling out this form. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.

Opt Out from Website Cookies/Web Beacons

We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the "Do Not Track" settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies. Please note that "Do Not Track" is a different privacy mechanism than the Global Privacy Control browser choice referenced below.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.

Vendor Tools/Analytics on the Website

The Website utilizes tracking tools from vendors, which may enable these vendors to analyze our Website traffic for analytics purposes. Some of these vendors may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the parties who provide them, and your interactions with these features are governed by the privacy policies of the parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.
Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.

Policies Applicable to Both Our Services & Our Website

When does Branch Disclose Information?

In addition to the ways described in our Terms & Conditions and this Privacy Policy, Branch may also disclose information to others under the following circumstances:
  • With vendors, consultants and other parties who work for us and need access to information we collect to do that work.
  • With our Clients and their agents, as described in this Policy.
  • To other parties (such as advertising networks or vendors used by our Clients), as directed by our Clients.
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements, and in order to investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person.
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions.
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services.
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Updating Your Information and Contact Preferences

We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings” which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.

We Secure the Information We Collect

Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.

Our Data Retention Policy

For our Services: Branch stores the information collected by our Services (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), identifiers collected from that User will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Usage activity logs, which are used for the purpose of reporting and analytics, are stored in an identifiable form for no more than 7 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Aggregated reporting metrics disclosed to Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.
For the Website: We store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.
The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about websites or social media platforms operated by other parties. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.

International Data Transfers

All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. Data protection laws in the United States may differ from your country, and the data Branch processes may be accessible to law enforcement and national security authorities under certain circumstances. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Privacy Shield mechanism discussed in the “Privacy Shield For EU, UK, and Swiss Personal Data Transferred into the United States” section below.

Privacy Shield For EU, UK, and Swiss Personal Data Transferred into the United States

Branch complies with the E.U.-U.S. Privacy Shield Framework and the Swiss-US Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to Privacy Shield. Branch recognizes that the Court of Justice of the European Union ruled in July 2020 that a certification under the EU-U.S. Privacy Shield Framework no longer can serve as the basis by which entities subject to the GDPR export personal data to jurisdictions outside the European Economic Area, and that the Swiss Data Protection Authority similarly held the Swiss-US Privacy Shield inadequate. Branch will continue to honor its obligation to comply with the Privacy Shield Principles with respect to data that was transferred pursuant to the EU-U.S. and Swiss-U.S. Privacy Shield Framework. If there is any conflict between the policies in this Privacy Policy and data subject rights under the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification page, please visit https://www.privacyshield.gov.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
Branch is subject to the investigatory and enforcement authority of the US Federal Trade Commission.
Pursuant to the Privacy Shield Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to other parties pursuant to the Privacy Shield unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Privacy Shield. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Privacy Shield Principles, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to Privacy Shield. European Union, UK, and Swiss individuals with Privacy Shield inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU PRIVACY SHIELD, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit http://www.bbb.org/EU-privacy-shield/for-eu-consumers for more information and to file a complaint. This service is provided free of charge to you.
If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 at https://www.privacyshield.gov/article?id=ANNEX-I-introduction.

Data Subject Rights

California Consumer Privacy Act
The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to natural persons who are residents of California. Our CCPA privacy notice is available here.
Rights of Residents of the European Economic Area and United Kingdom
The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.
Lei Geral de Proteção de Dados
Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.

Our Policy Regarding Children

Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 16). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately as required by law.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 16. If you are under 16, please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 16 may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 16 through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 16, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information as required by law.

Contact Us, Questions, Changes to This Privacy Policy

We may change this Privacy Policy at any time in our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at info@branch.io

Compliance

This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with this Privacy Policy.
Download

Table of Contents


Privacy Policy

The Branch Guiding Privacy Principles

Top

We are a linking and analytics platform for app and website developers. And we are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. We further describe our privacy practices in the official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect to provide our services is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs to provide our services. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from providing Branch with any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Customers who subscribe to our linking and analytics platform can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell customer end user data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with the CCPA and GDPR requirements.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.

Introduction

Top

Branch Metrics, Inc. ( "Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our linking and analytics products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from vendors and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.

Collection and Use of Information from Our Services

What Information Does Branch Collect from Our Services?

Top

Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

The Branch Services: Overview

Top

Branch provides a variety of Services intended to help Clients understand the use of their digital properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience.
    • For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly.
    • For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link, and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the Client’s tracked platforms with the purpose of driving more engagement to the Client.
    • For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to disclose to Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to disclose to Branch. We strongly discourage Clients from disclosing sensitive User information with us, as such information is not necessary for the provision of the Services, and we prohibit them from providing us with data relating to children under 13 (or, in certain jurisdictions, under 16).
In the charts below, we summarize the information collected automatically by the Services.

Information Collected By Branch Links and Pixels

Top

Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”).
Type of Information Collected Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Phone Number
(Optional) used only to facilitate the “Text me the app” feature if used
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.
Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).

Information Collected by Branch SDKs

Top

SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:
Type of Information Collected Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version
Metadata feature used for device identification and attribution
Internet connection type
Metadata feature used for device identification and attribution
Application version
Metadata feature used for device identification and attribution
Device model
Metadata feature used for device identification and attribution
Manufacturer
Metadata feature used for device identification and attribution
Operating system
Metadata feature used for device identification and attribution
Operating system version
Metadata feature used for device identification and attribution
Screen size (height, width)
Metadata feature used for device identification and attribution
Screen resolution
Metadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)
Metadata feature used for device identification and attribution
Device locale (country and language)
Metadata feature used for device identification and attribution
Local IP address
Metadata feature used for device identification and attribution
Mobile platform
Metadata feature used for device identification and attribution
Branch SDK version
Metadata feature used for device identification and attribution
Developer ID
(optional) Client-supplied unique identifier; metadata feature Used for device identification and attribution
Carrier ID
Metadata feature used for device identification and attribution
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.
Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).
In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution

Information Collected By Other Parties

Top

As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) to provide certain Engagement Data to Branch on the Client’s behalf.

How Does Branch Use Information Collected by Our Services?

Top

Data Branch collects through the Services is processed:
  • to better understand how and from where Users come to download certain apps, what types of apps are popular, or to recognize browsers and devices that are likely to be operated by the same User.
  • to provide, maintain, optimize, research and improve the Branch Services we provide our Clients, including to support other Branch products and services, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
  • to fulfill Clients’ and prospective Clients’ requests for the Services including processing data at the Client’s direction and transferring User data to them. Branch does not control how Clients use information Branch discloses to Clients, and Users should read Clients’ Privacy Policies to understand how they use information they receive from Branch.
  • to aggregate data across various sources, including data from various Clients or other parties.
  • to create reports based on aggregated information, which is information that cannot reasonably be linked back to any individual person or Client and disclose these reports to the public.
  • for anti-fraud protection and analysis relating to the Services to ensure more accurate attribution measurement, general fraud prevention, or where otherwise required by law.
We may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any other parties, including business partners, Clients, and/or others.

Our Clients’ Use of Information

Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their apps to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to disclose information about a hotel that she found in a travel app to a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being disclosed from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.

User Choices

Top

Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”) and adheres to its Code of Conduct. NAI provides you with the opportunity to opt out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.

Collection and Use of Information from Our Website and for Marketing Purposes

What Information Does Branch Collect about Website Visitors and Potential Customers?

Top

Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io ( the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

What We Collect from Clients that Use the Website

Top

Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:
Type of Information Collected Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (third-party)
Third-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard
When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
We also require Clients to set up a user ID and unique password for account security purposes. Clients must not disclose their passwords to anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our payment and contract vendors.
Connection Information with Other Parties: Some features of the dashboard Services allow you to disclose your information through your accounts to other companies such as Facebook and Google. If you choose to connect Branch to such services provided by other parties, we may collect information related to your use of those services provided by other parties, such as authentication tokens that allow us to connect to your accounts with those other parties. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected services.
Information from Other Sources: In addition to the information collected through our Website, we or our vendors may obtain and disclose additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or databases maintained by other parties. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form on the Website. We use this information to answer their question(s), and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage vendors to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website.
If you permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit http://www.allaboutcookies.org/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.

How Does Branch Use the Information Collected?

Top

Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or other parties, or where required by law.

Opt-Out & Do Not Track - Your Choice Mechanisms

Top

In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).

Opt Out from Promotional Emails

Top

You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by filling out this form. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.

Opt Out from Website Cookies/Web Beacons

Top

We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the "Do Not Track" settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies. Please note that "Do Not Track" is a different privacy mechanism than the Global Privacy Control browser choice referenced below.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.

Vendor Tools/Analytics on the Website

Top

The Website utilizes tracking tools from vendors, which may enable these vendors to analyze our Website traffic for analytics purposes. Some of these vendors may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the parties who provide them, and your interactions with these features are governed by the privacy policies of the parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel . We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook . We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php .
Drift . We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.

Policies Applicable to Both Our Services & Our Website

When does Branch Disclose Information?

Top

In addition to the ways described in our Terms & Conditions and this Privacy Policy, Branch may also disclose information to others under the following circumstances:
  • With vendors, consultants and other parties who work for us and need access to information we collect to do that work.
  • With our Clients and their agents, as described in this Policy.
  • To other parties (such as advertising networks or vendors used by our Clients), as directed by our Clients.
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements, and in order to investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person.
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions.
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services.
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Updating Your Information and Contact Preferences

Top

We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings” which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.

We Secure the Information We Collect

Top

Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.

Our Data Retention Policy

Top

For our Services: Branch stores the information collected by our Services (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), identifiers collected from that User will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Usage activity logs, which are used for the purpose of reporting and analytics, are stored in an identifiable form for no more than 7 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Aggregated reporting metrics disclosed to Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.
For the Website: We store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.

Links to Other Websites

Top

The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about websites or social media platforms operated by other parties. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.

International Data Transfers

Top

All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. Data protection laws in the United States may differ from your country, and the data Branch processes may be accessible to law enforcement and national security authorities under certain circumstances. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Privacy Shield mechanism discussed in the “Privacy Shield For EU, UK, and Swiss Personal Data Transferred into the United States” section below.

Privacy Shield For EU, UK, and Swiss Personal Data Transferred into the United States

Top

Branch complies with the E.U.-U.S. Privacy Shield Framework and the Swiss-US Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to Privacy Shield. Branch recognizes that the Court of Justice of the European Union ruled in July 2020 that a certification under the EU-U.S. Privacy Shield Framework no longer can serve as the basis by which entities subject to the GDPR export personal data to jurisdictions outside the European Economic Area, and that the Swiss Data Protection Authority similarly held the Swiss-US Privacy Shield inadequate. Branch will continue to honor its obligation to comply with the Privacy Shield Principles with respect to data that was transferred pursuant to the EU-U.S. and Swiss-U.S. Privacy Shield Framework. If there is any conflict between the policies in this Privacy Policy and data subject rights under the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification page, please visit https://www.privacyshield.gov.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
Branch is subject to the investigatory and enforcement authority of the US Federal Trade Commission.
Pursuant to the Privacy Shield Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to other parties pursuant to the Privacy Shield unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Privacy Shield. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Privacy Shield Principles, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to Privacy Shield. European Union, UK, and Swiss individuals with Privacy Shield inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU PRIVACY SHIELD, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit http://www.bbb.org/EU-privacy-shield/for-eu-consumers for more information and to file a complaint. This service is provided free of charge to you.
If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 at https://www.privacyshield.gov/article?id=ANNEX-I-introduction.

Data Subject Rights

Top

California Consumer Privacy Act
The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to natural persons who are residents of California. Our CCPA privacy notice is available here.
Rights of Residents of the European Economic Area and United Kingdom
The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.
Lei Geral de Proteção de Dados
Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.

Our Policy Regarding Children

Top

Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 16). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately as required by law.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 16. If you are under 16, please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 16 may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 16 through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 16, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information as required by law.

Contact Us, Questions, Changes to This Privacy Policy

We may change this Privacy Policy at any time in our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at info@branch.io

Compliance

Top

This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with this Privacy Policy.
Download

Table of Contents


Privacy Policy


The Branch Guiding Privacy Principles

Top

We are a linking and analytics platform for app and website developers. And we are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. We further describe our privacy practices in the official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.

  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect to provide our services is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs to provide our services. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from providing Branch with any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Customers who subscribe to our linking and analytics platform can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell customer end user data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with the CCPA and GDPR requirements.

Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.

Introduction

Top

Branch Metrics, Inc. ("Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.

This Privacy Policy is divided into three parts:

  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our linking and analytics products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from vendors and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.

Collection and Use of Information from Our Services

What Information Does Branch Collect from Our Services?

Top

Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

The Branch Services: Overview

Branch provides a variety of Services intended to help Clients understand the use of their digital properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.

Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.

The key use cases of Branch’s Services are:

  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience.
    • For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly.
    • For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link, and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the Client’s tracked platforms with the purpose of driving more engagement to the Client.
    • For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.

Branch requires that each Client commit to disclose to Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to disclose to Branch. We strongly discourage Clients from disclosing sensitive User information with us, as such information is not necessary for the provision of the Services, and we prohibit them from providing us with data relating to children under 13 (or, in certain jurisdictions, under 16).

In the charts below, we summarize the information collected automatically by the Services.

Information Collected By Branch Links and Pixels

Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”).

Type of Information Collected

Purpose

IP Address

Standard web HTTP request; used for attribution and to understand general location

Cookie

Standard web cookies, used for device identification and attribution

Link Data

Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics

User Agent

Standard web browser user agent metadata; used for device identification and attribution

Referer

Standard web browser HTTP referer; may be used for reporting and analytics

Request

Standard web HTTP request

Engagement Data

Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.

Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).



Information Collected by Branch SDKs

SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:

Type of Information Collected

Purpose

Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)

Used for device identification and attribution

Branch Cookie ID

Used for device identification and attribution

IP Address

Standard web HTTP request; used for device identification, attribution, and to understand general location

Referer

Standard web browser HTTP referer; may be used for reporting and analytics

Central Processing Unit (CPU) Type

Metadata feature used for device identification and attribution

System build version

Metadata feature used for device identification and attribution

Internet connection type

Metadata feature used for device identification and attribution

Application version

Metadata feature used for device identification and attribution

Device model

Metadata feature used for device identification and attribution

Manufacturer

Metadata feature used for device identification and attribution

Operating system

Metadata feature used for device identification and attribution

Operating system version

Metadata feature used for device identification and attribution

Screen size (height, width)

Metadata feature used for device identification and attribution

Screen resolution

Metadata feature used for device identification and attribution

Mobile network status (Wi-Fi, etc.)

Metadata feature used for device identification and attribution

Device locale (country and language)

Metadata feature used for device identification and attribution

Local IP address

Metadata feature used for device identification and attribution

Mobile platform

Metadata feature used for device identification and attribution

Branch SDK version

Metadata feature used for device identification and attribution

Developer ID

(optional) Client-supplied unique identifier; metadata feature Used for device identification and attribution

Carrier ID

Metadata feature used for device identification and attribution

Engagement Data

Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.

Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).



In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:

Type of Information Collected

Purpose

MAC address

Used for device identification and attribution

Windows Advertising ID

Used for device identification and attribution

CPU ID

Used for device identification and attribution



Information Collected By Other Parties

As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) to provide certain Engagement Data to Branch on the Client’s behalf.

How Does Branch Use Information Collected by Our Services?

Top

Data Branch collects through the Services is processed:

  • to better understand how and from where Users come to download certain apps, what types of apps are popular, or to recognize browsers and devices that are likely to be operated by the same User.
  • to provide, maintain, optimize, research and improve the Branch Services we provide our Clients, including to support other Branch products and services, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
  • to fulfill Clients’ and prospective Clients’ requests for the Services including processing data at the Client’s direction and transferring User data to them. Branch does not control how Clients use information Branch discloses to Clients, and Users should read Clients’ Privacy Policies to understand how they use information they receive from Branch.
  • to aggregate data across various sources, including data from various Clients or other parties.
  • to create reports based on aggregated information, which is information that cannot reasonably be linked back to any individual person or Client and disclose these reports to the public.
  • for anti-fraud protection and analysis relating to the Services to ensure more accurate attribution measurement, general fraud prevention, or where otherwise required by law.

We may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any other parties, including business partners, Clients, and/or others.

Our Clients’ Use of Information

Top

Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their apps to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to disclose information about a hotel that she found in a travel app to a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being disclosed from its app.

We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.

User Choices

Top

Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.

Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.

NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”) and adheres to its Code of Conduct. NAI provides you with the opportunity to opt out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.

Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.

Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.

Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.

Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.

Collection and Use of Information from Our Website and for Marketing Purposes

What Information Does Branch Collect about Website Visitors and Potential Customers?

Top

Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io (the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

What We Collect from Clients that Use the Website

Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.

Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:

Type of Information Collected

Purpose

IP Address

Standard web HTTP request; may be used for limited security login controls

Cookie (ours)

Standard web cookie used for dashboard session management

Cookie (other-party)

Other-party web tracking tools used for business intelligence

First, Last Name

Used for team user identification

Work Email

Used as the primary login identifier

Password

Account registration, secure our Services and prevent fraud

Account Holder Primary Role

Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners

User Agent

Standard web browser user agent metadata; may be used for limited security login controls

Referer

Standard web browser HTTP referer; may be used for general internal business analytics

Request

Standard web HTTP request; may be used for general internal business analytics

Github ID

(optional) Can be used as a login method

Billing information

Payment account registration

Log Data

Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law

Account holder feedback

Help us improve your experience on the account dashboard



When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).

We also require Clients to set up a user ID and unique password for account security purposes. Clients must not disclose their passwords to anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.

Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our payment and contract vendors.

Connection Information with Other Parties: Some features of the dashboard Services allow you to disclose your information through your accounts to other companies such as Facebook and Google. If you choose to connect Branch to such services provided by other parties, we may collect information related to your use of those services provided by other parties, such as authentication tokens that allow us to connect to your accounts with those other parties. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected services.

Information from Other Sources: In addition to the information collected through our Website, we or our vendors may obtain and disclose additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or databases maintained by other parties. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.

Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form on the Website. We use this information to answer their question(s), and may store that information for our record keeping, marketing, and advertising purposes.

Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage vendors to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.

Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website.

If you permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit http://www.allaboutcookies.org/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.

How Does Branch Use the Information Collected?

Top

Branch processes the data described in the section above for the following purposes:

  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or other parties, or where required by law.

Opt-Out & Do Not Track - Your Choice Mechanisms

Top

In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).

Opt Out from Promotional Emails

You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by filling out this form. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.

Opt Out from Website Cookies/Web Beacons

We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:

Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the "Do Not Track" settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies. Please note that "Do Not Track" is a different privacy mechanism than the Global Privacy Control browser choice referenced below.

Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.

Vendor Tools/Analytics on the Website

Top

The Website utilizes tracking tools from vendors, which may enable these vendors to analyze our Website traffic for analytics purposes. Some of these vendors may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the parties who provide them, and your interactions with these features are governed by the privacy policies of the parties providing them. These tools include, but are not limited to, those below.

Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.

Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.

Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.

Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.

Policies Applicable to Both Our Services & Our Website

When does Branch Disclose Information?

Top

In addition to the ways described in our Terms & Conditions and this Privacy Policy, Branch may also disclose information to others under the following circumstances:

  • With vendors, consultants and other parties who work for us and need access to information we collect to do that work.
  • With our Clients and their agents, as described in this Policy.
  • To other parties (such as advertising networks or vendors used by our Clients), as directed by our Clients.
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements, and in order to investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person.
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions.
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services.
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Updating Your Information and Contact Preferences

Top

We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings” which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.

We Secure the Information We Collect

Top

Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.

Our Data Retention Policy

Top

For our Services: Branch stores the information collected by our Services (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), identifiers collected from that User will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.

Usage activity logs, which are used for the purpose of reporting and analytics, are stored in an identifiable form for no more than 7 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.

Aggregated reporting metrics disclosed to Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.

Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.

For the Website: We store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.

Links to Other Websites

Top

The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about websites or social media platforms operated by other parties. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.

International Data Transfers

Top

All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. Data protection laws in the United States may differ from your country, and the data Branch processes may be accessible to law enforcement and national security authorities under certain circumstances. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Privacy Shield mechanism discussed in the “Privacy Shield For EU, UK, and Swiss Personal Data Transferred into the United States” section below.

Privacy Shield For EU, UK, and Swiss Personal Data Transferred into the United States

Top

Branch complies with the E.U.-U.S. Privacy Shield Framework and the Swiss-US Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to Privacy Shield. Branch recognizes that the Court of Justice of the European Union ruled in July 2020 that a certification under the EU-U.S. Privacy Shield Framework no longer can serve as the basis by which entities subject to the GDPR export personal data to jurisdictions outside the European Economic Area, and that the Swiss Data Protection Authority similarly held the Swiss-US Privacy Shield inadequate. Branch will continue to honor its obligation to comply with the Privacy Shield Principles with respect to data that was transferred pursuant to the EU-U.S. and Swiss-U.S. Privacy Shield Framework. If there is any conflict between the policies in this Privacy Policy and data subject rights under the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification page, please visit https://www.privacyshield.gov.

Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.

Branch is subject to the investigatory and enforcement authority of the US Federal Trade Commission.

Pursuant to the Privacy Shield Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.

Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to other parties pursuant to the Privacy Shield unless we can prove we were not a party to the actions giving rise to the damages.

We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Privacy Shield. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.

In compliance with the Privacy Shield Principles, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to Privacy Shield. European Union, UK, and Swiss individuals with Privacy Shield inquiries or complaints should first contact Branch at:

Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at
privacy@branch.io

Branch has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU PRIVACY SHIELD, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit http://www.bbb.org/EU-privacy-shield/for-eu-consumers for more information and to file a complaint. This service is provided free of charge to you.

If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 at https://www.privacyshield.gov/article?id=ANNEX-I-introduction.

Data Subject Rights

Top

California Consumer Privacy Act

The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to natural persons who are residents of California. Our CCPA privacy notice is available here.

Rights of Residents of the European Economic Area and United Kingdom

The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.

Lei Geral de Proteção de Dados

Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.

Our Policy Regarding Children

Top

Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 16). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.

If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately as required by law.

Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 16. If you are under 16, please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 16 may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 16 through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 16, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information as required by law.

Contact Us, Questions, Changes to This Privacy Policy

Top

We may change this Privacy Policy at any time in our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:

Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at
info@branch.io

Compliance

Top

This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with this Privacy Policy.

Download

Table of Contents


Privacy Policy
Last updated February 3, 2022

The Branch Guiding Privacy Principles

Top

We are a linking and analytics platform for app and website developers. And we are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. You’ll find our official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from sharing with Branch any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Our customers can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell personal data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with GDPR requirements as well.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.

Introduction

Top

Branch Metrics, Inc. ("Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from service providers and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.

Collection and Use of Information from Our Services

What Information Does Branch Collect from Our Services?

Top

Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

The Branch Services: Overview

Top

Branch provides a variety of Services intended to help Clients understand the use of their digital properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience.
    • For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly.
    • For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link, and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the tracked platforms with the purpose of driving more engagement to the Client.
    • For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to share with Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to share with Branch. We strongly discourage Clients from sharing sensitive User information with us, as such information is not necessary for the provision of the Services, and we prohibit them from providing us with data relating to children under 13 (or, in certain jurisdictions, under 16).
In the charts below, we summarize the information collected automatically by the Services.

Information Collected By Branch Links and Pixels

Top

Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”).
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Phone Number
(Optional) used only to facilitate the “Text me the app” feature if used
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.
Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).

SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:

Information Collected by Branch SDKs

Top

Type of Information Collected
Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version
Metadata feature used for device identification and attribution
Internet connection type
Metadata feature used for device identification and attribution
Application version
Metadata feature used for device identification and attribution
Device model
Metadata feature used for device identification and attribution
Manufacturer
Metadata feature used for device identification and attribution
Operating system
Metadata feature used for device identification and attribution
Operating system version
Metadata feature used for device identification and attribution
Screen size (height, width)
Metadata feature used for device identification and attribution
Screen resolution
Metadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)
Metadata feature used for device identification and attribution
Device locale (country and language)
Metadata feature used for device identification and attribution
Local IP address
Metadata feature used for device identification and attribution
Mobile platform
Metadata feature used for device identification and attribution
Branch SDK version
Metadata feature used for device identification and attribution
Developer ID
(optional) Client-supplied unique identifier; metadata feature Used for device identification and attribution
Carrier ID
Metadata feature used for device identification and attribution
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.
Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).
In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution

Information Collected By Third Parties

As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) to provide certain Engagement Data to Branch on the Client’s behalf.

How Does Branch Use Information Collected by Our Services?

Data Branch collects through the Services is processed:
  • to better understand how and from where Users come to download certain apps, what types of apps are popular, or to infer that certain browsers and devices are operated by the same User based upon connections Branch has derived across non-affiliated apps and websites.
  • to provide, maintain, optimize, research and improve the Branch Services we provide our Clients, including to support other Branch products and services, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
  • to fulfill Clients’ and prospective Clients’ requests for the Services including processing data at the Client’s direction and transferring User data to them. Branch does not control how Clients use information Branch shares with Clients and Users should read Clients’ Privacy Policies to understand how they use information they receive from Branch.
  • to aggregate data across various sources, including data from various Clients or third parties.
  • to create reports based on aggregated information, which is information that cannot reasonably be linked back to any individual person or Client and share these reports with the public.
  • for anti-fraud protection and analysis relating to the Services to ensure more accurate attribution measurement, general fraud prevention, or where otherwise required by law.
We may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also share such data with any third parties, including business partners, Clients, and/or others.

Our Clients’ Use of Information

Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their apps to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to share information about a hotel that she found in a travel app with a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being shared from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.

User Choices

Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”) and adheres to its Code of Conduct. NAI provides you with the opportunity to opt out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.

Collection and Use of Information from Our Website and for Marketing Purposes

What Information Does Branch Collect about Website Visitors and Potential Customers?

Top

Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io (the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.

What We Collect from Clients that Use the Website

Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (third-party)
Third-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard

We also require Clients to set up a user ID and unique password for account security purposes. Clients must not share their passwords with anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our third-party payment and contract processors.
Third-Party Connection Information: Some features of the dashboard Services allow you to share your information through your accounts with other companies such as Facebook and Google. If you choose to connect Branch to such third-party services, we may collect information related to your use of those third-party services, such as authentication tokens that allow us to connect to your third-party service accounts. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected third-party services.
Information from Other Sources: In addition to the information collected through our Website, we or our third-party service providers may obtain additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or third-party databases. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form on the Website. We use this information to answer their question(s), and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage third-party service providers to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website. This may include mouse movements and how you scroll through the Website, but we do not collect keystroke data.
If you permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit http://www.allaboutcookies.org/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.

How Does Branch Use the Information Collected?

Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or third parties, or where required by law.

Opt-Out & Do Not Track - Your Choice Mechanisms

In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).

Opt Out from Promotional Emails

You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by filling out this form. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.

Opt Out from Website Cookies/Web Beacons

We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the Do Not Track settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.

Third-Party Tools/Analytics on the Website

The Website utilizes third-party tracking tools from third-party service providers, which may enable these third parties to analyze our Website traffic for analytics purposes. Some of these third-party service providers may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the third parties who provide them, and your interactions with these features are governed by the privacy policies of the third parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.
Drift . We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.

Policies Applicable to Both Our Services & Our Website

How does Branch Share Information?

In addition to the ways described in our Terms & Conditions and this Privacy Policy, Branch may also share information with others under the following circumstances:
  • With third-party vendors, consultants and other service providers who work for us and need access to information we collect to do that work.
  • With our Clients and their agents, as described in this Policy.
  • To third parties (such as advertising networks or vendors used by our Clients), as directed by our Clients.
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements, and in order to investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person.
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions.
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services.
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Updating Your Information and Contact Preferences; California Shine the Light Law

We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings” which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.
Under California law, California residents who have an established business relationship with us may choose to opt-out of the disclosure of Personal Data about them to third parties for such third parties’ direct marketing purposes. Our policy is not to disclose Personal Data collected through our Website to a third party for direct marketing purposes without your approval. If you choose to opt-out at any time after granting approval, email privacy@branch.io.
California residents who have provided us with Personal Data can also request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their Personal Data (if any) for such third parties’ direct marketing purposes in the prior calendar year, as well as the type of Personal Data disclosed to those parties. If you are a California resident and would like such a list, please email privacy@branch.io.

We Secure the Information We Collect

Top

Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.

Our Data Retention Policy

For our Services: Branch stores the information collected by our Services (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), identifiers collected from that User will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Usage activity logs, which are used for the purpose of reporting and analytics, are stored in an identifiable form for no more than 7 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Aggregated reporting metrics shared with Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.
For the Website: We store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.

Links to Other Websites

The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about third-party websites or social media platforms. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.

International Data Transfers

All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Privacy Shield mechanism discussed in the “Privacy Shield For EU, UK, and Swiss Personal Data Transferred into the United States” section below.

Privacy Shield For EU, UK, and Swiss Personal Data Transferred into the United States

Branch complies with the E.U.-U.S. Privacy Shield Framework and the Swiss-US Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to Privacy Shield. Branch recognizes that the Court of Justice of the European Union ruled in July 2020 that a certification under the EU-U.S. Privacy Shield Framework no longer can serve as the basis by which entities subject to the GDPR export personal data to jurisdictions outside the European Economic Area, and that the Swiss Data Protection Authority similarly held the Swiss-US Privacy Shield inadequate. Branch will continue to honor its obligation to comply with the Privacy Shield Principles with respect to data that was transferred pursuant to the EU-U.S. and Swiss-U.S. Privacy Shield Framework. If there is any conflict between the policies in this Privacy Policy and data subject rights under the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification page, please visit visit https://www.privacyshield.gov.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
Branch is subject to the investigatory and enforcement authority of the US Federal Trade Commission.
Pursuant to the Privacy Shield Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to agent third parties pursuant to the Privacy Shield unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Privacy Shield. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Privacy Shield Principles, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to Privacy Shield. European Union, UK, and Swiss individuals with Privacy Shield inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU PRIVACY SHIELD, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit http://www.bbb.org/EU-privacy-shield/for-eu-consumers for more information and to file a complaint. This service is provided free of charge to you.
If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 at https://www.privacyshield.gov/article?id=ANNEX-I-introduction.

Data Subject Rights

California Consumer Privacy Act
The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to natural persons who are residents of California. Our CCPA privacy notice is available here .
Rights of Residents of the European Economic Area and United Kingdom
The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here .
Lei Geral de Proteção de Dados
Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.

Our Policy Regarding Children

Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 16). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 13 (and in certain jurisdictions under the age of 16). If you are under 13 (and in certain jurisdictions under 16), please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 13 (and in certain jurisdictions under 16) may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 13 (and in certain jurisdictions under 16) through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16), please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information.

Contact Us, Questions, Changes to This Privacy Policy

We may change this Privacy Policy at any time in our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at info@branch.io

Compliance

This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with Privacy Shield Principles and this Privacy Policy.
Download

Table of Contents


Privacy Policy
Last updated February 3, 2022
The Branch Guiding Privacy Principles
We are a linking and analytics platform for app and website developers. And we are proud of our commitment to providing our services in a privacy-first way. So we thought it would be helpful to lay out, in plain English, the Branch Guiding Privacy Principles that drive how we’ve chosen to design our services with privacy as a top priority. You’ll find our official Privacy Policy below this section, but we hope you’ll find this summary of our principles helpful.
  • We limit the data we collect. We practice data minimization, which means that we take steps to avoid collecting or storing information that we don’t need to provide our services. The personal data that we collect is limited to data like advertising identifiers, IP address, and information derived from resettable cookies (the full list is below in our privacy policy). We do not collect or store information such as names, email addresses, physical addresses, or SSNs. Nor do we want to. In fact, our Terms & Conditions prohibit our customers from sharing with Branch any kind of sensitive end-user information.
  • We will only provide you with data about actual end-user activity on your apps or websites. Our customers can only access “earned” cookies or identifiers. This means that an end user must visit a customer’s site before our customer can see the cookie; and an end user must download a customer’s app in order for Branch to collect the end user’s advertising identifier for that customer. In short, the Branch services benefit customers who already have seen an end user across their platforms and want to understand the relationship between those web visits and app sessions.
  • We do not rent or sell personal data. No Branch customer can access another Branch customer’s end-user data. And we are not in the business of renting or selling any customer’s end-user data to anyone else. To enable customers to control their end-user personal data, they can request deletion here of that data at any time, whether in bulk or for a specific end user. These controls are available to customers worldwide, although we designed them to comply with GDPR requirements as well.
Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.
Introduction
Branch Metrics, Inc. ("Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
This Privacy Policy is divided into three parts:
  • Collection and Use of Information from Our Services: This section explains how Branch collects and uses information about Users in connection with our products and services (the "Branch Services" or the "Services").
  • Collection and Use of Information from Our Website and for Marketing Purposes: This section explains how we collect and use information about our website visitors through our website located at branch.io (the “Website”), which includes the dashboard we provide to our Clients located at dashboard.branch.io. So, if you are a Client using our Branch dashboard, this section applies to the data we collect from you. It also explains how we collect information about potential Clients from service providers and other sources to enhance our marketing efforts.
  • Policies Applicable to Both Our Services & Our Website: This section lays out the parts of the Branch Privacy Policy that apply to both the Services and to the Website.
Collection and Use of Information from Our Services
What Information Does Branch Collect from Our Services?
Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
The Branch Services: Overview
Branch provides a variety of Services intended to help Clients understand the use of their digital properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
Branch has no direct relationship with Users. Branch’s Services are provided when Branch Clients install on their platforms “Branch Mechanisms” (including links, pixels, direct platform integrations, etc.) that capture User action on behalf of the Client. Using the information collected from these Branch Mechanisms, Branch uses a variety of attribution techniques to connect User actions across different channels and platforms. Some of these attribution techniques include a direct pass-through of identifiers from platform to platform, creating and storing identifiers unique to the Branch platform to connect User actions and identifiers together, and predictive modeling algorithms using real-time and historical data parameters observed from User interactions where there are no shared identifiers available, as well as using historical connections Branch has derived over time using our technology. In some cases, these connections are made without the use of cookies. These techniques help Clients match Users with devices they use, including matching the same User across multiple devices.
The key use cases of Branch’s Services are:
  • To support Clients in implementing deep linking, which uses Branch’s connection information in real time to improve the User experience.
    • For example, if a User clicks on a link in an email or ad to a specific page in a Client’s app, Branch helps the User get to that page after they download the app.
  • To report individualized and aggregated analytics metrics about the performance of the Client’s product and marketing initiatives to the Client directly.
    • For example, Branch can tell a Client how many Users that downloaded an app or that went to a specific page in an app came from clicking on a specific link, and provide corresponding advertising or other identifiers.
  • To assist the Client by presenting real time, targeted messaging to their Users depending on past behavior observed across the tracked platforms with the purpose of driving more engagement to the Client.
    • For example, Branch can use Branch Mechanisms to provide a tailored message like a coupon code or special offer in your website to users who have interacted with your app and/or website in the past.
Branch requires that each Client commit to share with Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to share with Branch. We strongly discourage Clients from sharing sensitive User information with us, as such information is not necessary for the provision of the Services, and we prohibit them from providing us with data relating to children under 13 (or, in certain jurisdictions, under 16).
In the charts below, we summarize the information collected automatically by the Services.
Information Collected By Branch Links and Pixels
Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”).
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; used for attribution and to understand general location
Cookie
Standard web cookies, used for device identification and attribution
Link Data
Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics
User Agent
Standard web browser user agent metadata; used for device identification and attribution
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Request
Standard web HTTP request
Phone Number
(Optional) used only to facilitate the “Text me the app” feature if used
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.
Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).
Information Collected by Branch SDKs
Type of Information Collected
Purpose
Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)
Used for device identification and attribution
Branch Cookie ID
Used for device identification and attribution
IP Address
Standard web HTTP request; used for device identification, attribution, and to understand general location
Referer
Standard web browser HTTP referer; may be used for reporting and analytics
Central Processing Unit (CPU) Type
Metadata feature used for device identification and attribution
System build version
Metadata feature used for device identification and attribution
Internet connection type
Metadata feature used for device identification and attribution
Application version
Metadata feature used for device identification and attribution
Device model
Metadata feature used for device identification and attribution
Manufacturer
Metadata feature used for device identification and attribution
Operating system
Metadata feature used for device identification and attribution
Operating system version
Metadata feature used for device identification and attribution
Screen size (height, width)
Metadata feature used for device identification and attribution
Screen resolution
Metadata feature used for device identification and attribution
Mobile network status (Wi-Fi, etc.)
Metadata feature used for device identification and attribution
Device locale (country and language)
Metadata feature used for device identification and attribution
Local IP address
Metadata feature used for device identification and attribution
Mobile platform
Metadata feature used for device identification and attribution
Branch SDK version
Metadata feature used for device identification and attribution
Developer ID
(optional) Client-supplied unique identifier; metadata feature Used for device identification and attribution
Carrier ID
Metadata feature used for device identification and attribution
Engagement Data
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.
Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).
In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
Type of Information Collected
Purpose
MAC address
Used for device identification and attribution
Windows Advertising ID
Used for device identification and attribution
CPU ID
Used for device identification and attribution
Information Collected By Third Parties
As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) to provide certain Engagement Data to Branch on the Client’s behalf.
How Does Branch Use Information Collected by Our Services?
Data Branch collects through the Services is processed:
  • to better understand how and from where Users come to download certain apps, what types of apps are popular, or to infer that certain browsers and devices are operated by the same User based upon connections Branch has derived across non-affiliated apps and websites.
  • to provide, maintain, optimize, research and improve the Branch Services we provide our Clients, including to support other Branch products and services, develop new products and services, and market products or services; to support the products and services of our Clients; and as permitted or required by applicable law.
  • to fulfill Clients’ and prospective Clients’ requests for the Services including processing data at the Client’s direction and transferring User data to them. Branch does not control how Clients use information Branch shares with Clients and Users should read Clients’ Privacy Policies to understand how they use information they receive from Branch.
  • to aggregate data across various sources, including data from various Clients or third parties.
  • to create reports based on aggregated information, which is information that cannot reasonably be linked back to any individual person or Client and share these reports with the public.
  • for anti-fraud protection and analysis relating to the Services to ensure more accurate attribution measurement, general fraud prevention, or where otherwise required by law.
We may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also share such data with any third parties, including business partners, Clients, and/or others.
Our Clients’ Use of Information
Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their apps to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to share information about a hotel that she found in a travel app with a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being shared from its app.
We require that our Clients utilize our Services responsibly and in accordance with our Terms & Conditions. Branch is not responsible for the data practices of any of our Clients through the Services or otherwise. Each Client’s practices are subject to each Client’s individual privacy policy. Users should review the privacy policy of each Client to understand how that Client uses User information collected through the Services.
User Choices
Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”) and adheres to its Code of Conduct. NAI provides you with the opportunity to opt out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.
Collection and Use of Information from Our Website and for Marketing Purposes
What Information Does Branch Collect about Website Visitors and Potential Customers?
Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io (the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
What We Collect from Clients that Use the Website
Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:
Type of Information Collected
Purpose
IP Address
Standard web HTTP request; may be used for limited security login controls
Cookie (ours)
Standard web cookie used for dashboard session management
Cookie (third-party)
Third-party web tracking tools used for business intelligence
First, Last Name
Used for team user identification
Work Email
Used as the primary login identifier
Password
Account registration, secure our Services and prevent fraud
Account Holder Primary Role
Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners
User Agent
Standard web browser user agent metadata; may be used for limited security login controls
Referer
Standard web browser HTTP referer; may be used for general internal business analytics
Request
Standard web HTTP request; may be used for general internal business analytics
Github ID
(optional) Can be used as a login method
Billing information
Payment account registration
Log Data
Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law
Account holder feedback
Help us improve your experience on the account dashboard

We also require Clients to set up a user ID and unique password for account security purposes. Clients must not share their passwords with anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our third-party payment and contract processors.
Third-Party Connection Information: Some features of the dashboard Services allow you to share your information through your accounts with other companies such as Facebook and Google. If you choose to connect Branch to such third-party services, we may collect information related to your use of those third-party services, such as authentication tokens that allow us to connect to your third-party service accounts. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected third-party services.
Information from Other Sources: In addition to the information collected through our Website, we or our third-party service providers may obtain additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or third-party databases. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form on the Website. We use this information to answer their question(s), and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage third-party service providers to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website. This may include mouse movements and how you scroll through the Website, but we do not collect keystroke data.
If you permit the use of cookies and web beacons when you visit and continue to use the Website, we will collect information through those tools. Cookies are small data files stored on your hard drive by a website and web beacons are electronic images that may be used on our Website or in our emails. Cookies help us improve your experience on the Website as well as our marketing activities. We use cookies to see which areas and features are popular and to count visits to our Website. For more information about cookies and web beacons, please visit http://www.allaboutcookies.org/. For more information about how to opt-out of cookies and web beacons after you have consented to their use, see the “Opt-out from Website Cookies/Web Beacons” section below.
How Does Branch Use the Information Collected?
Branch processes the data described in the section above for the following purposes:
  • to provide, maintain, optimize, research and improve the Website;
  • to fulfill your and prospective Clients’ requests for the Services;
  • to send information about the Services including confirmations, invoices, payment processing, technical notices, updates, security alerts, and support and administrative messages;
  • to communicate about products and services offered by Branch and Branch's selected partners. We receive opt-in consent to send promotional and marketing messages to Website Users where required by applicable law. You can opt-out of receiving these messages at any time as described below in the section titled: “Opt-out from Promotional Emails”;
  • to conduct research;
  • to manage your information and account, to improve and administer our Website, to contact Website Users to answer questions or resolve problems, or to verify your identity;
  • to conduct research to help us to optimally deliver our existing Services or develop new products, processes and services;
  • for ad delivery and reporting purposes and to create data and analytics products and services;
  • to make the Website easier to use by reducing the need for Clients and Website Users to enter information;
  • for other purposes disclosed to you at the time you provide data to us;
  • with your consent; or
  • where Branch otherwise has a legitimate interest in collecting the data, such as direct marketing, individual or market research, product improvement, anti-fraud protection, protecting the safety of us, our Website Users, or third parties, or where required by law.
Opt-Out & Do Not Track - Your Choice Mechanisms
In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).
Opt Out from Promotional Emails
You can opt-out of receiving promotional emails from us by following the instructions in those emails, or by filling out this form. You can also opt-out of certain categories of emails using this form. If you opt-out using any of these tools, we may still send you non-promotional emails, such as certain updates about your account or updates to our Terms & Conditions and this Privacy Policy and/or use of the Services.
Opt Out from Website Cookies/Web Beacons
We will only use cookies consistent with your cookie settings and permissions granted on our Website. If you permit us to use cookies/web beacons as discussed above (“What Information Does Branch Collect from our Website”), but would like to opt-out:
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the Do Not Track settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.
Third-Party Tools/Analytics on the Website
The Website utilizes third-party tracking tools from third-party service providers, which may enable these third parties to analyze our Website traffic for analytics purposes. Some of these third-party service providers may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the third parties who provide them, and your interactions with these features are governed by the privacy policies of the third parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Facebook. We may use certain tools offered by Facebook, Inc. (“Facebook”) that enable it to collect or receive information about actions Website Users take on our Website through use of cookies, web beacons and other storage technologies or in order to provide measurement services, targeted ads and other services. For more information regarding the collection and use of such information by Facebook, please see the Facebook Data Policy, available at: https://www.facebook.com/policy.php.
Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.
Policies Applicable to Both Our Services & Our Website
How does Branch Share Information?
In addition to the ways described in our Terms & Conditions and this Privacy Policy, Branch may also share information with others under the following circumstances:
  • With third-party vendors, consultants and other service providers who work for us and need access to information we collect to do that work.
  • With our Clients and their agents, as described in this Policy.
  • To third parties (such as advertising networks or vendors used by our Clients), as directed by our Clients.
  • To comply with laws or to respond to lawful requests and legal process including to meet national security or law enforcement requirements, and in order to investigate, prevent, or take action regarding suspected, or actual, prohibited activities, including but not limited to fraud and situations involving potential threats to the physical safety of any person.
  • To protect the rights and property of Branch, our agents, Clients, Users, Website Users, and others including to enforce our agreements, policies, and Terms & Conditions.
  • To Branch’s subsidiaries and affiliates as necessary to help us provide, support, and maintain the Services.
  • In connection with or during negotiation of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
Updating Your Information and Contact Preferences; California Shine the Light Law
We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings” which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email support@branch.io.
Under California law, California residents who have an established business relationship with us may choose to opt-out of the disclosure of Personal Data about them to third parties for such third parties’ direct marketing purposes. Our policy is not to disclose Personal Data collected through our Website to a third party for direct marketing purposes without your approval. If you choose to opt-out at any time after granting approval, email privacy@branch.io.
California residents who have provided us with Personal Data can also request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their Personal Data (if any) for such third parties’ direct marketing purposes in the prior calendar year, as well as the type of Personal Data disclosed to those parties. If you are a California resident and would like such a list, please email privacy@branch.io.
We Secure the Information We Collect
Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at privacy@branch.io.
Our Data Retention Policy
For our Services: Branch stores the information collected by our Services (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), identifiers collected from that User will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Usage activity logs, which are used for the purpose of reporting and analytics, are stored in an identifiable form for no more than 7 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Aggregated reporting metrics shared with Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.
For the Website: We store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.
Links to Other Websites
The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about third-party websites or social media platforms. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.
International Data Transfers
All information collected via the Website and Services is stored on servers located in the United States. In the process of providing the Services, we may transfer information across borders from other countries or jurisdictions into the United States. By using the Services, each Client and Website User consents to the transfer and processing of information to the U.S. in accordance with this Privacy Policy. Data transfers from the European Union, United Kingdom, and Switzerland are transferred on the basis of legal mechanisms approved by the European Commission and other relevant authorities for cross-border data transfers, such as Standard Contractual Clauses or the Privacy Shield mechanism discussed in the “Privacy Shield For EU, UK, and Swiss Personal Data Transferred into the United States” section below.
Privacy Shield For EU, UK, and Swiss Personal Data Transferred into the United States
Branch complies with the E.U.-U.S. Privacy Shield Framework and the Swiss-US Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data from European Union member countries (including European Economic Area member countries), the United Kingdom, and Switzerland transferred to the United States pursuant to Privacy Shield. Branch recognizes that the Court of Justice of the European Union ruled in July 2020 that a certification under the EU-U.S. Privacy Shield Framework no longer can serve as the basis by which entities subject to the GDPR export personal data to jurisdictions outside the European Economic Area, and that the Swiss Data Protection Authority similarly held the Swiss-US Privacy Shield inadequate. Branch will continue to honor its obligation to comply with the Privacy Shield Principles with respect to data that was transferred pursuant to the EU-U.S. and Swiss-U.S. Privacy Shield Framework. If there is any conflict between the policies in this Privacy Policy and data subject rights under the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification page, please visit visit https://www.privacyshield.gov.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
Branch is subject to the investigatory and enforcement authority of the US Federal Trade Commission.
Pursuant to the Privacy Shield Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to agent third parties pursuant to the Privacy Shield unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Privacy Shield. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting privacy@branch.io.
In compliance with the Privacy Shield Principles, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to Privacy Shield. European Union, UK, and Swiss individuals with Privacy Shield inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at privacy@branch.io
Branch has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU PRIVACY SHIELD, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit http://www.bbb.org/EU-privacy-shield/for-eu-consumers for more information and to file a complaint. This service is provided free of charge to you.
If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 at https://www.privacyshield.gov/article?id=ANNEX-I-introduction.
Data Subject Rights
California Consumer Privacy Act
The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to natural persons who are residents of California. Our CCPA privacy notice is available here.
Rights of Residents of the European Economic Area and United Kingdom
The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.
Lei Geral de Proteção de Dados
Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.
Our Policy Regarding Children
Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 16). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact privacy@branch.io.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16) in violation of applicable law, please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 13 (and in certain jurisdictions under the age of 16). If you are under 13 (and in certain jurisdictions under 16), please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 13 (and in certain jurisdictions under 16) may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 13 (and in certain jurisdictions under 16) through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16), please contact us at privacy@branch.io, so that Branch can promptly investigate and delete any inappropriately obtained information.
Contact Us, Questions, Changes to This Privacy Policy
We may change this Privacy Policy at any time in our sole discretion. We will post all changes to this Privacy Policy on this page and will indicate at the top of the page the modified Privacy Policy’s effective date. If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at info@branch.io
Compliance
This Privacy Policy shall be implemented by Branch and all its operating divisions, subsidiaries and affiliates. Branch has put in place mechanisms to verify ongoing compliance with Privacy Shield Principles and this Privacy Policy.