Privacy Policy — CRODE Labs
1. Overview
This Policy explains how we collect, use, store, and share personal data when you use our websites, SaaS platforms, or digital tools (the "Services"). By using the Services, you consent to the practices described here, unless a different policy is presented to you for a specific product.
2. Who We Are
CRODE Labs is operated by Not a Parent Company Pvt Ltd ("NAPCo", "we", "us"). We act as data controller for personal data we collect directly, and as an independent controller alongside our payment partners for checkout-related data.
3. What Information We Collect
- Account Data: Name, email, login credentials, and basic profile information you provide.
- finance Data: Limited finance details handled by third‑party payment providers on our behalf (we never see full card data).
- Usage Data: IP address, device type, browser metadata, interaction logs, and aggregated analytics.
- Communications: Support emails, form submissions, and other messages you send us.
4. How We Use Data
- To provide, maintain, and improve the Services
- To authenticate users and secure accounts
- To process finance and manage subscriptions
- To comply with legal, regulatory, and compliance obligations
5. Payments & Third‑Party Processors
Payments are processed by verified third‑party providers on our behalf. They handle order processing, finance, and tax compliance under their own privacy and security standards. When payments are processed through a Merchant‑of‑Record or payment processor, that provider acts as an independent controller for checkout data in addition to NAPCo.
6. Cookies & Tracking
- Essential cookies: Used for security, session management, and core site functionality.
- Analytics cookies: Used in aggregated form to understand how the Services are used and to improve performance.
7. Data Retention
We retain personal data only as long as necessary for the purposes described in this Policy or as required by applicable law. When data is no longer needed, we securely delete or anonymize it.
8. Security
- Administrative, technical, and physical safeguards to protect against unauthorized access, alteration, or loss.
- Payment data processed exclusively through PCI‑DSS‑compliant payment providers and, where applicable, Merchant‑of‑Record partners.
9. Your Rights
- Access, correct, delete, or export your personal data, subject to legal limits
- Withdraw consent for processing where consent is the legal basis
10. International Transfers
Personal data may be processed in Maldives, the EU, the UK, or other jurisdictions where our service providers operate. When data is transferred internationally, we use appropriate safeguards such as standard contractual clauses or equivalent mechanisms, where required.
11. Children
Our Services are not directed to minors under 18, and we do not knowingly collect personal data from children. If we become aware that a child has provided personal data, we will take steps to delete it.
12. Changes
We may update this Policy from time to time. The effective date above reflects the latest version. Material changes will be highlighted on this page or communicated through the Services.