Data Processing Agreement

The Processor processes personal data on the Controller’s behalf for the duration of the Controller’s use of the Service, plus any period afterward required to comply with retention obligations described in our Privacy Policy.

The Processor processes personal data solely to provide the Service: deducting and tracking credits, enforcing paywalls, generating dashboard analytics, operating the optional referral program, and issuing invoices for the fees described in the Terms. The Processor does not process personal data for any purpose of its own, and does not sell it.

Data subjects:the end users of the Controller’s application.

Categories of data: by design, an opaque user identifier chosen by the Controller, together with credit balances, action keys, timestamps, and usage metadata. Crediball does not require names or email addresses of end users. If the Controller chooses to include personal data inside an identifier or metadata field, that data falls under this DPA as well, and the Controller is responsible for having a lawful basis to share it.

• Process personal data only on the Controller's documented instructions (including those given through the SDK/API/dashboard), unless required otherwise by EU or Member State law.
• Ensure personnel authorized to process the data are bound by confidentiality.
• Implement appropriate technical and organizational security measures.
• Not engage a new sub-processor without giving the Controller notice and an opportunity to object, as described below.
• Assist the Controller, taking into account the nature of processing, in responding to data subject requests directed to the Controller.
• Notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data.
• At the Controller's choice, delete or return personal data at the end of the Service relationship, subject to legal retention requirements.
• Make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for audits by the Controller or an auditor mandated by the Controller, subject to reasonable notice and confidentiality.

The Controller authorizes the Processor to engage the sub-processors listed on our Subprocessors page, under a written agreement imposing data protection obligations equivalent to those in this DPA. We will update that page before engaging a new sub-processor; if you object to a new sub-processor on reasonable data-protection grounds, contact us at hello@crediball.ai and we will work with you in good faith to address the concern, which may include the option to stop using the Service without penalty if we cannot.

Where personal data is transferred outside the European Economic Area — for example to our United States-based hosting, database, or payments sub-processors — that transfer is covered by the European Commission’s Standard Contractual Clauses or another valid transfer mechanism, incorporated into this DPA by reference.

Each party’s liability under this DPA is subject to the limitations of liability set out in our Terms of Service.

This DPA takes effect when the Controller starts using the Service and terminates automatically when the Controller’s use of the Service ends and all personal data has been deleted or returned in accordance with this DPA.

This DPA is governed by the laws of Austria, consistent with our Terms of Service.

Questions about this DPA, or need a countersigned copy? Write to hello@crediball.ai.