Last updated December 20, 2024

    Privacy Policy

    1. Introduction

    cred.diy ("we," "our," or "us") is committed to protecting your privacy and ensuring compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our credit management platform and API services.

    2. Data Controller

    cred.diy is the data controller responsible for your personal data. For any questions about this policy or our data practices, please contact our Data Protection Officer at dpo@cred.diy

    3. Information We Collect

    Account Information

    When you create an account, we collect your email address, name, and any other information you choose to provide in your profile.

    Usage Data

    We automatically collect information about your use of our services, including API calls, credit transactions, and feature usage patterns.

    Payment Information

    Payment processing is handled by Stripe. We do not store your complete payment card information on our servers.

    4. Legal Basis for Processing (GDPR)

    Under the GDPR, we process your personal data based on the following legal grounds:

    • Contract Performance: Processing necessary to provide our services to you
    • Legitimate Interests: Processing for fraud prevention, security, and service improvement
    • Consent: Processing based on your explicit consent (e.g., marketing communications, analytics)
    • Legal Obligation: Processing required to comply with applicable laws

    5. How We Use Your Information

    • To provide and maintain our services
    • To process transactions and send related information
    • To send administrative information and service updates
    • To respond to inquiries and provide customer support
    • To monitor and analyze usage patterns to improve our services (with consent)
    • To detect, prevent, and address technical issues or fraud

    6. Data Sharing

    We do not sell your personal information. We may share your information with:

    • Service Providers: Third parties who assist in operating our platform (payment processors, cloud hosting)
    • Legal Requirements: When required by law or to protect our rights
    • Business Transfers: In connection with a merger, acquisition, or sale of assets

    All service providers are bound by data processing agreements ensuring GDPR compliance.

    7. International Data Transfers

    Your data may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or transfers to countries with adequacy decisions.

    8. Data Retention

    We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

    • Account Data: Retained while your account is active and for 30 days after deletion
    • Transaction Records: Retained for 7 years for legal and accounting purposes
    • Usage Logs: Retained for 90 days
    • Support Communications: Retained for 2 years

    9. Data Security

    We implement industry-standard security measures to protect your information, including:

    • Encryption in transit (TLS 1.3) and at rest (AES-256)
    • Secure API authentication using hashed keys
    • Regular security audits and penetration testing
    • Access controls and employee training

    10. Your Rights Under GDPR

    If you are located in the European Economic Area, you have the following rights:

    • Right of Access: Request a copy of your personal data
    • Right to Rectification: Correct inaccurate or incomplete data
    • Right to Erasure: Request deletion of your personal data ("right to be forgotten")
    • Right to Restrict Processing: Limit how we use your data
    • Right to Data Portability: Receive your data in a machine-readable format
    • Right to Object: Object to processing based on legitimate interests
    • Right to Withdraw Consent: Withdraw consent at any time

    You can exercise these rights through your account settings or by contacting us at privacy@cred.diy

    11. Cookies

    We use cookies and similar technologies to enhance your experience. You can manage your cookie preferences at any time. For detailed information, please see our Cookie Policy

    12. Children's Privacy

    Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

    13. Changes to This Policy

    We may update this Privacy Policy from time to time. We will notify you of any material changes by email and/or a prominent notice on our website at least 30 days before the changes take effect.

    14. Supervisory Authority

    If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with a supervisory authority in your country of residence.

    15. Contact Us

    For questions about this Privacy Policy or to exercise your data rights: