--- url: >- https://acquirer-api-docs-v4-en.pingpongx.com/en/notes/integrate/app-compliance/overview/index.md description: >- Overview of PPCashDeskSDK submission and compliance requirements, including the actions merchants need to complete before publishing on iOS and Android. --- Integrating PPCashDeskSDK affects your App's privacy declarations and review configurations on the App Store and Google Play. The SDK has fulfilled its own compliance requirements (Privacy Manifest, data encryption, etc.). The following describes what merchants need to know and do. ## SDK Data Collection ### Data Collected Directly by the SDK | Data Type | Details | Purpose | Storage | |-----------|---------|---------|---------| | Payment Information | Card number, CVV, expiry date | Complete payment authorization | Encrypted via RSA-OAEP for transmission; no plaintext stored | | Billing Address | Name, street, city, state/province, postal code, country, email, phone | Payment verification and risk control | Not persisted locally | | Device Identifier | IDFV (iOS only) | Unique device identification; not an advertising identifier | Not persisted locally | | Usage Data | App version, device type (iOS/Android) | Compatibility and feature support | Not persisted locally | | Diagnostics | Request ID (random UUID), error logs | Request tracing and troubleshooting | Not persisted locally | | Language Preference | Current language setting | SDK UI localization | Not persisted locally | ### Data Collected Indirectly via the Risk Device Fingerprint Module | Data Type | Default State | Purpose | Configurable | |-----------|--------------|---------|-------------| | Sensor Data (accelerometer, gyroscope) | **Enabled** | Device environment profiling | Can be disabled via configuration | | Behavioral Biometrics (touch patterns, interaction behavior) | **Enabled** | Fraud behavior detection | Can be disabled via configuration | | System Boot Time | **Enabled** | Anti-tampering / timestamp verification | Not configurable | | File Timestamps | **Enabled** | File integrity check | Not configurable | | Disk Space | **Enabled** | Device environment profiling | Not configurable | | Precise Location | **Disabled** | High-precision geolocation risk control | Can be enabled via configuration | | Coarse Location | **Disabled** | Region-level geolocation risk control | Can be enabled via configuration | ::: tip Configuration For items marked "Can be disabled/enabled via configuration", refer to the [Embedded SDK - iOS Integration Guide](../native-sdk-ios.md) or [Embedded SDK - Android Integration Guide](../native-sdk-android.md) for details. ::: ## Impact on Store Review The data collection described above requires merchants to complete platform-specific privacy declaration configurations before submission: **iOS App Store** — Verify Privacy Manifest integration, complete App Privacy Labels, and disclose SDK information in Review Notes. **Android Google Play** — Complete Data Safety declaration and verify permission declarations. **Privacy Policy (both platforms)** — Disclose the use of PPCashDeskSDK for payment processing in your App's privacy policy, including the Risk Device Fingerprint Module's data collection behavior. ::: tip Compliance Inquiries For further questions about data collection and privacy compliance, please contact your PingPong account manager or legal team. ::: ## iOS App Store Submission Guide This section describes the compliance impact of integrating PPCashDeskSDK on iOS App Store review, and the actions merchants need to take. ### Privacy Manifest Requirements #### Privacy Manifest Included in the SDK ::: tip SDK includes Privacy Manifest PPCashDeskSDK ships with a `PrivacyInfo.xcprivacy` file covering all built-in modules, including the Risk Device Fingerprint Module. Xcode automatically merges the SDK's Privacy Manifest with the app's Privacy Manifest at build time. No manual copying is required. ::: Apple states: > Any version of a listed SDK, as well as any SDKs that repackage those on the list, are included in the requirement. This means that as long as the SDK itself has correctly declared its API usage, the app does not need to re-declare the APIs used internally by the SDK. #### What merchants need to do 1. **Verify the integration method**: Integrate PPCashDeskSDK via CocoaPods or Swift Package Manager and confirm that the SDK's `PrivacyInfo.xcprivacy` file is included in the app bundle. 2. **Check the Xcode merge result**: After building, review the Privacy Manifest merge log in Xcode's **Report Navigator** and confirm there are no errors. 3. **Declare app-level data separately**: If the app itself, outside the SDK, collects additional data, declare it in the app's own `PrivacyInfo.xcprivacy`. #### Required Reason API declarations PPCashDeskSDK declares the following Required Reason APIs in its Privacy Manifest: | API Category | Reason Code | Purpose | |-------------|------------|---------| | UserDefaults | CA92.1 | Stores SDK runtime configuration and session state | | File Timestamp | C617.1 | Risk Device Fingerprint Module reads file timestamps for device characteristic collection | | Disk Space | E174.1 | Risk Device Fingerprint Module reads disk space information for device characteristic collection | ::: warning Note These APIs are used internally by the SDK. Merchants do not need to re-declare these entries in their own Privacy Manifest unless the app code independently uses the same APIs. ::: ### App Store Connect compliance configuration The following configurations are required in App Store Connect due to SDK integration: | Item | Guideline | Merchant Action | |------|-----------|----------------| | App Privacy Labels include SDK data collection items | 5.1.1 | Refer to the SDK data collection tables above and accurately fill in the SDK data types in Privacy Labels | | Privacy Policy discloses use of PPCashDeskSDK | 5.1.2 | Describe the SDK data types and purposes in the privacy policy, including the Risk Device Fingerprint Module | | Review Notes explain that the SDK includes a Risk Device Fingerprint Module | 2.3.1 | Proactively disclose this to prevent reviewers from flagging it | ### Changelog | Date | Change | |------|--------| | 2026-04-15 | Initial version | ## Android Google Play Submission Guide This section describes the compliance impact of integrating PPCashDeskSDK on Google Play review, and the actions merchants need to take. ::: warning Note This section is derived from general SDK behavior. Some Android-specific configuration items are still pending final confirmation from the Android SDK team. Items marked as pending confirmation should be verified against the SDK release notes. ::: ### Data Safety Declaration Google Play requires all apps to accurately declare data collection practices in the Data Safety form in Play Console. The following items need to be declared due to PPCashDeskSDK integration. #### SDK data type mapping | SDK Collected Data | Data Safety Category | Purpose | Optional | |---|---|---|---| | Payment info (card number, CVV) | Financial info > Credit/debit card info | App functionality | No | | Billing address | Personal info > Address | App functionality | No | | Device identifier | Device or other IDs | App functionality | No | | Sensor data (accelerometer, gyroscope) | App activity > Other actions | Fraud prevention, Security | Yes (can be disabled by configuration) | | Behavioral biometrics (touch patterns) | App activity > Other actions | Fraud prevention, Security | Yes (can be disabled by configuration) | ### Permission Requirements #### Android permissions used by the SDK | Permission | Type | Purpose | |---|---|---| | `android.permission.INTERNET` | Normal permission | Initiate payment network requests | | `android.permission.ACCESS_NETWORK_STATE` | Normal permission | Detect network connectivity | These are normal permissions and are granted automatically by the system, without requiring user prompts. #### Permissions not used by the SDK The following sensitive permissions are **not requested or used by PPCashDeskSDK**: `CAMERA`, `READ_CONTACTS`, `ACCESS_FINE_LOCATION` / `ACCESS_COARSE_LOCATION` (unless the merchant explicitly enables location features), and `READ_PHONE_STATE`. #### What merchants need to do 1. Confirm that only actually used permissions are declared in `AndroidManifest.xml` 2. In Play Console under **App content > Permissions**, provide a usage description for SDK-related permissions ### Changelog | Date | Change | |------|--------| | 2026-04-15 | Initial version, derived from general SDK behavior | ## References - [Third-party SDK requirements](https://developer.apple.com/support/third-party-SDK-requirements/) - [App Store Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - [Privacy Manifest Files](https://developer.apple.com/documentation/bundleresources/privacy_manifest_files) - [App Privacy Details on the App Store](https://developer.apple.com/app-store/app-privacy-details/) - [Google Play Data Safety](https://support.google.com/googleplay/android-developer/answer/10787469) - [Google Play Developer Policy Center](https://play.google.com/about/developer-content-policy/)