Privacy Policy

For your own account data (name, email, billing details), Crediball is the controller under GDPR.

For data about your end users that flows through the Service — the credit balances and usage events your integration reports — you are the controller and Crediball is the processor, acting only on your instructions. Our Data Processing Agreement governs that processing.

• Account information: name and email address, via our authentication provider.
• Billing information: handled directly by Stripe — we never see or store your full card number.
• Usage of the dashboard and API: the actions, apps, and settings you configure, for the purpose of operating the Service and calculating the revenue-share fee described in our Terms.
• Support communications you send to us.

By design, Crediball asks you to pass only an opaque user identifier (“userId”) that you already use in your own system — not a name or email address. We store that identifier together with credit balances, action keys, and usage timestamps, so we can track credits, price actions, and generate your dashboard’s analytics.

We do not require, and do not intentionally collect, names, email addresses, or other directly identifying information about your end users. If the identifier you choose to send us happens to contain personal data (for example, if you pass an email address as the userId), you are responsible for that choice and for having a lawful basis to share it with us as your processor.

• To operate the credit-billing engine: deducting credits, enforcing balances, and issuing the paywall/insufficient-credits responses your app relies on.
• To power your dashboard: analytics, pricing suggestions, the AI Monetization Agent, and the Models page.
• To calculate and invoice the revenue-share fee described in our Terms of Service.
• To operate the optional referral program (referral codes, click and reward tracking) when you enable it.
• To maintain and secure the Service, and to comply with legal obligations.
• In aggregated, anonymized form only, to build cross-app benchmarks (the "network intelligence" used by the AI Monetization Agent) — never in a way that reveals one developer's data to another.

We share data with the infrastructure and payment providers listed on our Subprocessors page, each bound by contract to protect it, and we do not sell personal data. We may disclose information if required by law or to protect the rights, property, or safety of Crediball, our developers, or the public.

We retain account and usage data for as long as your account is active, and for a reasonable period afterward to comply with legal, tax, and accounting obligations (typically up to 7 years for financial records) or to resolve disputes. You can request deletion of your account data as described below, subject to those retention obligations.

We use industry-standard technical and organizational measures — encryption in transit, access controls, and secret-key based authentication for the API — to protect data. No system is perfectly secure, and we will notify affected developers without undue delay if we become aware of a breach affecting their data, consistent with our obligations under GDPR and our DPA.

If you are in the European Economic Area or another jurisdiction with similar rights, you may request access to, correction of, deletion of, or an export of your personal data, or object to certain processing, by writing to hello@crediball.ai. You also have the right to lodge a complaint with the Austrian data protection authority (Österreichische Datenschutzbehörde) or your local supervisory authority.

If you are an end user of an app built with Crediball and want to exercise a data right, please contact that app’s developer first — they control your account and relationship, and can instruct us as their processor.

Our subprocessors are based in the United States and the European Union. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

The Service is a developer tool and is not directed at children. We do not knowingly collect personal data from children through the Service.

We will post any changes to this policy here with an updated effective date, and will make a reasonable effort to notify you directly of material changes.

Questions about this policy or a privacy request? Write to hello@crediball.ai.