Beyond these principles stated above, Branch will continue to find ways to design our services to respect end user privacy. We’re committed to making sure our customers understand how we use data they entrust to us and how they can control it so that they can, in turn, be transparent with their end users.
Branch Metrics, Inc. ("Branch", "us", "our" or "we") offers a linking and analytics platform enabling developers of applications (our "Clients")--whether those applications are websites or "apps," and across different types of devices--to improve their end users’ ("Users") cross-application experiences, and to derive additional insights into how their Users download and utilize those applications. Branch recognizes and believes that data privacy is important to all Internet users, and therefore we design and operate our services in a privacy-first manner.
Below, we explain what information we collect on behalf of our Clients through the Services, and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
Branch provides a variety of Services intended to help Clients understand the use of their digital properties by their Users across a wide array of platforms, devices and applications. Branch helps Clients by connecting User interactions across siloed applications (email, SMS, web browsers, social platforms, native applications and others), so that Clients understand the multiple steps that a User took to ultimately complete a transaction with the Client. The Client can use this information to better inform marketing and product decisions as well as to provide improved user experiences by using their knowledge of continuity.
The key use cases of Branch’s Services are:
Branch requires that each Client commit to share with Branch only information that it has lawfully obtained (including, where necessary, by obtaining consent from Users), and that it has the right to share with Branch. We strongly discourage Clients from sharing sensitive User information with us, as such information is not necessary for the provision of the Services, and we prohibit them from providing us with data relating to children under 13 (or, in certain jurisdictions, under 16).
In the charts below, we summarize the information collected automatically by the Services.
Branch collects the following information from URLs created by the Client (i.e., Branch Links) and pixels placed on Client websites. Branch Links may be embedded into QR Codes as configured by the Client. Some of this information is considered personal data under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual) (“Personal Data”).
|Type of Information Collected||Purpose|
|IP Address||Standard web HTTP request; used for attribution and to understand general location|
|Cookie||Standard web cookies, used for device identification and attribution|
|Link Data||Metadata controlled by the Client, which may be used to interpret the data for reporting, or for analytics|
|User Agent||Standard web browser user agent metadata; used for device identification and attribution|
|Referer||Standard web browser HTTP referer; may be used for reporting and analytics|
|Request||Standard web HTTP request|
|Phone Number||(Optional) used only to facilitate the “Text me the app” feature if used|
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the webpage from which such ads were displayed, and webpages on Client’s website visited by a User.
Other interactions, events and actions Clients choose to measure and analyze within their website (e.g., add to cart, purchases made, clicks, engagement time etc.).
SDKs are Software Development Kits that include code that allows Clients to use the Branch Services. The Branch Mobile App SDKs, Web SDKs, and Over-the-Top (OTT) SDKs collect the following information when Clients use these SDKs in their applications or websites, some of which may be considered Personal Data under applicable law:
|Type of Information Collected||Purpose|
|Advertising identifier (e.g., GAID, Android ID, IDFA, IDFV, RIDA)||Used for device identification and attribution|
|Branch Cookie ID||Used for device identification and attribution|
|IP Address||Standard web HTTP request; used for device identification, attribution, and to understand general location|
|Referer||Standard web browser HTTP referer; may be used for reporting and analytics|
|Central Processing Unit (CPU) Type||Metadata feature used for device identification and attribution|
|System build version||Metadata feature used for device identification and attribution|
|Internet connection type||Metadata feature used for device identification and attribution|
|Application version||Metadata feature used for device identification and attribution|
|Device model||Metadata feature used for device identification and attribution|
|Manufacturer||Metadata feature used for device identification and attribution|
|Operating system||Metadata feature used for device identification and attribution|
|Operating system version||Metadata feature used for device identification and attribution|
|Screen size (height, width)||Metadata feature used for device identification and attribution|
|Screen resolution||Metadata feature used for device identification and attribution|
|Mobile network status (Wi-Fi, etc.)||Metadata feature used for device identification and attribution|
|Device locale (country and language)||Metadata feature used for device identification and attribution|
|Local IP address||Metadata feature used for device identification and attribution|
|Mobile platform||Metadata feature used for device identification and attribution|
|Branch SDK version||Metadata feature used for device identification and attribution|
|Developer ID||(optional) Client-supplied unique identifier; metadata feature Used for device identification and attribution|
|Carrier ID||Metadata feature used for device identification and attribution|
Information relating to the Client’s ad campaigns and User interactions, such as clicks on Client ads, Client ad impressions viewed, audiences or segments to which an ad campaign is attributed, type of ads and the application page from which such ads were displayed, pages on Client’s application visited by a User, downloads, opt-in status for certain tracking mechanisms, and installations of applications.
Other interactions, events and actions Clients choose to measure and analyze within their application (e.g., add to cart, purchases made, clicks, engagement time etc.).
In addition to the information identified above, the Branch Desktop SDKs collect the following identifiers when Clients use these SDKs in their desktop applications, some of which may be considered Personal Data under applicable law:
|Type of Information Collected||Purpose|
|MAC address||Used for device identification and attribution|
|Windows Advertising ID||Used for device identification and attribution|
|CPU ID||Used for device identification and attribution|
As part of Branch’s Services, Branch’s Clients may direct certain of their vendors or business partners (such as an ad network or vendor) to provide certain Engagement Data to Branch on the Client’s behalf.
Data Branch collects through the Services is processed:
We may aggregate and/or de-identify the data we collect through the Services. After data has been aggregated and/or de-identified, Branch cannot use it to personally identify an individual. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also share such data with any third parties, including business partners, Clients, and/or others.
Our Clients may use the information collected via the Services to improve their Users’ app experiences, customize their apps to Users, and to better understand their app marketing programs and how Users discover their apps. For example, a User may want to share information about a hotel that she found in a travel app with a friend. When that User sends her friend a Branch link to that hotel, after clicking the link the friend is brought directly to the content relating to that hotel within the app, rather than landing on the app’s homepage and having to search for the hotel. The travel app would also gain insights and analytics as to how the content is being shared from its app.
Branch recognizes a number of consumer choice mechanisms. Due to the nature of the Services, some functionality may be degraded or no longer work as a result if you exercise certain of the opt-outs below.
Branch’s Browser Cookie Opt-Out: Our cookie-based opt-out can be accessed by clicking here. This will place a Branch opt-out cookie on your browser. Where Branch detects the presence of that opt-out cookie, we will no longer read or set cookies (beyond the opt-out cookie itself). Cookie-based opt outs must be performed on each device and browser that you wish to have opted-out. For example, if you have opted-out on your computer browser, that opt out will not be effective on your mobile device.
NAI Browser-Based Opt-Out: Branch is a member of the Network Advertising Initiative (“NAI”) and adheres to its Code of Conduct. NAI provides you with the opportunity to opt out (on a browser-by-browser basis) from interest-based advertising by participating NAI members, including Branch. That opt-out is available here.
Device-Based Opt-Out: You can submit a request to opt out of the Branch Services on a particular device by submitting a request here.
Device Identifiers: To use your device’s privacy settings controls, please visit the privacy settings menu of your device to review and access the privacy controls made available on the device. Branch will only be able to collect information from the device as permitted by these settings.
Client App Opt-out Controls: Branch‘s SDK Privacy Controls allow Clients to respect granular controls regarding User data. Clients can flag in the Branch SDK that a particular User’s data should not be processed by Branch, in which case Branch will no longer process engagement data on behalf of the Client for that User.
Engagement Builder: Branch's Engagement Builder feature may be used to help Clients conduct re-engagement and re-targeting campaigns. We require that Clients using Branch’s Engagement Builder feature for such purposes respect User opt-out preferences passed to them by Branch.
Branch collects information from Website visitors (“you” or “Website Users”) located at www.branch.io (the “Website”), which includes the dashboard provided to our Clients located at dashboard.branch.io. The types of information we may collect and our privacy practices depend on the nature of the relationship you have with us and the requirements of applicable law. Below are the legal bases and some of the ways we collect information and how we use it. We process information in a way that is relevant for the purpose for which it was collected as described below.
Branch collects Personal Data and non-personal data via the Website. For example, when Clients register to use our Services, we ask them to provide us with Personal Data, including first and last name and email address.
Dashboard Information: Information we collect from visitors who register for an account on our dashboard includes the following, some of which is considered Personal Data under applicable law:
|Type of Information Collected||Purpose|
|IP Address||Standard web HTTP request; may be used for limited security login controls|
|Cookie (ours)||Standard web cookie used for dashboard session management|
|Cookie (third-party)||Third-party web tracking tools used for business intelligence|
|First, Last Name||Used for team user identification|
|Work Email||Used as the primary login identifier|
|Password||Account registration, secure our Services and prevent fraud|
|Account Holder Primary Role||Account registration, tell Clients about products and services offered by Branch and Branch’s selected partners|
|User Agent||Standard web browser user agent metadata; may be used for limited security login controls|
|Referer||Standard web browser HTTP referer; may be used for general internal business analytics|
|Request||Standard web HTTP request; may be used for general internal business analytics|
|Github ID||(optional) Can be used as a login method|
|Billing information||Payment account registration|
|Log Data||Provide the Services, tell Clients about products and services offered by Branch and Branch’s selected partners, personalize our experience, secure our Services and prevent fraud, and defend our legal rights and comply with the law|
|Account holder feedback||Help us improve your experience on the account dashboard|
When a Client creates an account and uses the Services, Branch may collect certain log data, such as IP address from which a Client is connecting to the Services, information related to the device being used to connect to the Services (e.g., browser type and version, device type, OS version) and the features and functions of the Services used by the Client (“Log Data”).
We also require Clients to set up a user ID and unique password for account security purposes. Clients must not share their passwords with anyone. Clients also have the option of adding other team members to their account. This account information enables us to set up an account for Clients, to provide the Services, and to otherwise manage Client accounts. We may also use this information to notify Clients about updates to our Services and provide them with promotional emails. We offer a mechanism to opt out from promotional emails as described in the “Opt-Out from Promotional Emails” section below.
Account and Billing Information: To the extent that we charge a fee for the Services, we may also collect limited billing, payment, and contract information from Clients through our third-party payment and contract processors.
Third-Party Connection Information: Some features of the dashboard Services allow you to share your information through your accounts with other companies such as Facebook and Google. If you choose to connect Branch to such third-party services, we may collect information related to your use of those third-party services, such as authentication tokens that allow us to connect to your third-party service accounts. We will ask you for permission before you authorize our collection of this information. We may also collect information about how you are using the Services to interact with those connected third-party services.
Information from Other Sources: In addition to the information collected through our Website, we or our third-party service providers may obtain additional information, such as job title or contact information, from other public and non-public sources such as business websites, social networking platforms, or third-party databases. We use this information to better enable Branch to identify and contact businesses that might be interested in engaging our Services, and to gain a better understanding of a potential Client’s business needs.
Communications with Branch: Some Website Users may provide Personal Data to Branch by sending us an email or filling out an online form on the Website. We use this information to answer their question(s), and may store that information for our record keeping, marketing, and advertising purposes.
Research/Survey Solicitations: From time to time, we may perform research (online and offline) via surveys. We may engage third-party service providers to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve individuals by learning more about their needs and the quality of the products and services we provide. The survey responses may be utilized to determine the effectiveness of our Website, various types of communications, advertising campaigns and/or promotional activities.
Cookies, Pixels and Web Beacons: We also collect other data via the Website from Website Users, including Website Users employed by or affiliated with Clients, through cookies and/or web beacons. Such information, some of which may be considered Personal Data under applicable law, may include IP address, pages viewed, browser type, Internet browsing and usage habits, how you browse and navigate the Website, Internet Service Provider, domain name, the time/date of your visit to the Website, the referring URL, and your computer’s operating system. For example, we may collect on a real-time basis information on how you use and navigate the Website. This may include mouse movements and how you scroll through the Website, but we do not collect keystroke data.
Branch processes the data described in the section above for the following purposes:
In some cases, we rely on your consent to process Personal Data about you. In those cases, and where you have consented to Branch's processing of your Personal Data in connection with your use of the Website, you may withdraw that consent at any time by following the instructions below. Additionally, before we use Personal Data collected with your consent for any new purpose not originally authorized by you, we will provide information regarding the new purpose and ask for your consent for the new purpose. Where your consent for the processing of Personal Data is otherwise required by law or contract, we will comply with the law or contract. In other cases, we do not rely on your consent to process Personal Data about you (for example, if we have a different legal basis to process that data).
Also, you can choose to set your browser to remove cookies and to reject cookies. To exercise the Do Not Track settings available on certain web browsers, please visit the privacy settings of your browser. Where Branch is able to see that such a selection has been made, we will not use information collected from that device to target advertising on that browser. Dashboard users must use the “Cookie Consent” feature to revoke permission to place cookies.
Note that, even if you opt out, we may still collect and use non-personal data regarding your activities on our Website. This also does not opt you out of being served advertising altogether; you will continue to receive generic advertisements.
The Website utilizes third-party tracking tools from third-party service providers, which may enable these third parties to analyze our Website traffic for analytics purposes. Some of these third-party service providers may collect information from this Website for retargeting and interest-based advertising purposes. For more information about these forms of ad targeting and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/. All of these tools are hosted by the third parties who provide them, and your interactions with these features are governed by the privacy policies of the third parties providing them. These tools include, but are not limited to, those below.
Google. We may use Google Analytics and Google Analytics Demographics and Interest Reporting to collect information regarding visitor behavior and visitor demographics on our Website, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt-out of Google’s collection and processing of data generated by your use of the Website by going to http://tools.google.com/dlpage/gaoptout.
Mixpanel. We use a service provided by Mixpanel, Inc. (“Mixpanel”) to provide us with analytics data regarding Website Users’ interactions with our Website and Services. You may opt-out of Mixpanel’s automatic retention of data that is collected while using the Services by visiting https://mixpanel.com/optout/. To track opt-outs, Mixpanel uses a persistent opt-out cookie placed on your device. Please note that if you get a new computer, install a new browser, erase or otherwise alter the browser’s cookie file (including upgrading certain browsers), you may delete the Mixpanel opt-out cookie.
Drift. We use certain tools offered by Drift to power our Website’s live-chat experience. If you provide information about yourself through that live-chat experience, then we may store that information for marketing purposes. Drift may also infer information about the company that you work for you based on your IP address.
We provide Clients with a mechanism to access, review and update information via the dashboard. If you wish to review or update your information, please visit branch.io and login using the username and password you created. Next, please select “Account Settings” which can be found in the lower left corner of the dashboard screen, then select the “User” tab near the top. If you would like to delete your account, please email firstname.lastname@example.org.
Under California law, California residents who have an established business relationship with us may choose to opt-out of the disclosure of Personal Data about them to third parties for such third parties’ direct marketing purposes. Our policy is not to disclose Personal Data collected through our Website to a third party for direct marketing purposes without your approval. If you choose to opt-out at any time after granting approval, email email@example.com.
California residents who have provided us with Personal Data can also request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their Personal Data (if any) for such third parties’ direct marketing purposes in the prior calendar year, as well as the type of Personal Data disclosed to those parties. If you are a California resident and would like such a list, please email firstname.lastname@example.org.
Securing the information provided by our Clients and collected through our Website is important to us. Branch has implemented industry-standard technical, administrative, and physical safeguards to help protect the information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Data are no longer secure, please promptly notify us at email@example.com.
For our Services: Branch stores the information collected by our Services (see the “What Information Does Branch Collect from our Services?” section above) so long as our systems continue to encounter that User. After that User has been inactive for 30 days (or 90 days for specific attribution products), identifiers collected from that User will be deleted unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Usage activity logs, which are used for the purpose of reporting and analytics, are stored in an identifiable form for no more than 7 days (or up to 60 days as determined by the Client or for specific fields), after which these logs are removed or pseudonymized. Any and all pseudonymized logs are deleted after 12 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Aggregated reporting metrics shared with Clients are retained (in aggregate and anonymized form) for up to 24 months, unless otherwise required by applicable law or otherwise agreed between Branch and the Client.
Branch may retain information collected by our Services beyond these periods for fraud prevention, analysis, or response, or to protect the safety of Branch, its Clients, Users or the public.
For the Website: We store Personal Data such as email address or billing details for so long as you continue to have a business relationship with Branch and for a reasonable time thereafter for record-keeping purposes. If applicable to you, you may ask us to delete that information as described in the “Data Subject Rights” section below or pursuant to your right of erasure as described in the “Data Subject Rights” section below.
The Website and/or Services may contain links to other websites and other websites may reference or link to our Website and/or Services. These other domains and websites are not controlled by Branch, and we do not endorse or make any representations about third-party websites or social media platforms. We encourage you to read the privacy policies of each and every website and application that you interact with. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.
Branch no longer relies on the EU-U.S. Privacy Shield to transfer data that originated in the EEA or the United Kingdom to the U.S.
Branch is subject to the investigatory and enforcement authority of the US Federal Trade Commission.
Pursuant to the Privacy Shield Frameworks we are obliged to inform EU, UK, and Swiss individuals whose data is being transferred into the United States that we may be required to release Personal Data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.
Branch remains liable for the onward transfer of EU, UK, and Swiss personal data to agent third parties pursuant to the Privacy Shield unless we can prove we were not a party to the actions giving rise to the damages.
We acknowledge the right of EU, UK, and Swiss individuals to access their Personal Data pursuant to the Privacy Shield. EU, UK, and Swiss individuals wishing to exercise this right may do so by contacting firstname.lastname@example.org.
In compliance with the Privacy Shield Principles, Branch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to Privacy Shield. European Union, UK, and Swiss individuals with Privacy Shield inquiries or complaints should first contact Branch at:
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at email@example.com
Branch has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU PRIVACY SHIELD, operated by the Council of Better Business Bureaus. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit http://www.bbb.org/EU-privacy-shield/for-eu-consumers for more information and to file a complaint. This service is provided free of charge to you.
If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 at https://www.privacyshield.gov/article?id=ANNEX-I-introduction.
California Consumer Privacy Act
The California Consumer Privacy Act of 2018 (“CCPA”) provides certain rights to natural persons who are residents of California. Our CCPA privacy notice is available here.
Rights of Residents of the European Economic Area and United Kingdom
The European General Data Protection Regulation of 2018 (“GDPR”) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (“UK Data Protection Law”) provides certain rights to residents of Europe. Information on how you can exercise rights under the GDPR and UK Data Protection Law are set forth here.
Lei Geral de Proteção de Dados
Lei Geral de Proteção de Dados (“LGPD”) provides certain rights to residents of Brazil. Information on how you can exercise rights under the LGPD are set forth here.
Services: The Branch Services are not directed to children. We require that Clients agree to not send to us data relating to any children under 13 (or, in certain jurisdictions, under 16). If you are a Client and want to learn more about Branch SDK Privacy Controls that you can use in your compliance with the U.S. Children’s Online Privacy Protection Act (COPPA), GDPR, or any other applicable law, please contact firstname.lastname@example.org.
If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16) in violation of applicable law, please contact us at email@example.com, so that Branch can promptly investigate and delete any information that it may have been provided inappropriately.
Website: The Branch Website is not directed to children. We do not knowingly collect through the Website Personal Data from anyone under the age of 13 (and in certain jurisdictions under the age of 16). If you are under 13 (and in certain jurisdictions under 16), please do not attempt to register or send any information about yourself to us, including your name, address, telephone number, or email address. No one under 13 (and in certain jurisdictions under 16) may provide any Personal Data to us. In the event that we learn that we have collected any such data from a child under 13 (and in certain jurisdictions under 16) through our Website, we will take reasonable steps to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 13 (and in certain jurisdictions under 16), please contact us at firstname.lastname@example.org, so that Branch can promptly investigate and delete any inappropriately obtained information.
Branch Metrics, Inc.
195 Page Mill Road, Suite 101
Palo Alto, CA 94306
or by email at email@example.com