According to what I could find online, the data object should be added as URL params when my app loads
I don’t know what gave you that idea – but it’s just not true.
https://developers.facebook.com/docs/reference/dialogs/requests/:
data: Optional, additional data you may pass for tracking. This will be stored as part of the request objects created.
So you have to read the request object, using the request ID that is passed to your app.