Who is responsible
RevenueDot is operated by Circo, Inc. For this website and for RevenueDot Cloud account data, Circo, Inc. is the controller. For the purchase data your apps send to RevenueDot Cloud, you are the controller and we act as your processor (see the DPA summary). Contact: legal@revenuedot.app.
Self-hosted RevenueDot
When you run RevenueDot on your own servers, we receive no data from it. The self-hosted server has no telemetry and does not contact our servers. It talks only to Apple, Google, your webhook endpoints and any forwarding URL you configure.
This website
- Analytics. We use DataFast (datafa.st) on revenuedot.app and in the RevenueDot Cloud dashboard to count visits and see which channel (referrer, campaign, search, social post) brought a visitor and which paid plans that channel produced. It records the page, referrer, UTM tags, browser, device, country and region, and the actions we track as goals, such as clicking Sign up. Outside the EEA, the UK and Switzerland it sets three first-party cookies (see the Cookie policy). Inside them it runs in cookieless mode: no cookies, and a visitor id that is hashed from the IP address and browser and changes daily. In the dashboard, and when you send the contact-sales form, we also send your email address and name to DataFast, plus your plan and project count, and Stripe payment details (amount, plan, customer email) reach DataFast through our Stripe connection. We do not send project names, passwords or card numbers. We also use Cloudflare Web Analytics, which sets no cookies, where it is switched on. DataFast also tells us when search and AI crawlers request our pages.
- Hosting logs. The site is served by Cloudflare, which processes IP addresses and request details to deliver pages and block attacks. We do not use these logs to identify visitors.
- No ad trackers. This website loads no advertising or social-media trackers. Fonts are served from our own domain.
- Email. If you email us, we keep your message and address to reply and to keep a record of the conversation.
RevenueDot Cloud
Account data (we are the controller)
- Your name, work email, hashed password and the projects you belong to, to run your account and sign you in.
- Billing details for Pro and Enterprise, processed by our payment provider, Stripe; we do not store full card numbers.
- Service logs and security events (IP address, time, action), to secure the Service and investigate abuse.
Customer Data (you are the controller)
The purchase, subscription, receipt and customer data your apps and stores send to the Service, including app user IDs and any attributes you choose to set, such as an email address. We process it only on your instructions, to provide the Service. We never sell it, use it for advertising or combine it across customers. Anonymized, aggregated benchmarks would be offered only if you opt in.
Legal bases (EEA and UK)
- Performing our contract with you: running your account and the Service.
- Legitimate interests: securing the Service, preventing abuse, measuring which marketing channels bring customers, and answering your messages. You can object to analytics at any time by emailing us or blocking datafa.st.
- Legal obligations: tax and accounting records.
Who we share data with
We share personal data only with providers who help us run the Service, under contracts that limit their use of it, and when the law requires. Current providers: Cloudflare, Inc. (hosting, network, database connectivity, web analytics); DataFast (web analytics and marketing attribution, datafa.st). We list any new provider on the DPA summary before it starts processing Customer Data.
International transfers
Our providers may process data in the United States and other countries. Where the law requires, we rely on the EU Standard Contractual Clauses or an equivalent safeguard.
How long we keep data
- Account data: while your account is open, then up to 30 days.
- Customer Data: while your project exists; deleted within 30 days after you delete the project or close your account.
- Security logs: up to 90 days. Email: as long as needed to handle your request.
Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict its processing, and complain to your data protection authority. Email legal@revenuedot.app. If your request is about an app that uses RevenueDot Cloud, we will pass it to that app's developer, who controls that data. We do not sell or share personal data for cross-context advertising.
Children
The Service is for developers and businesses, not children. Apps that use it are responsible for their own users' privacy, including children's.
Changes
We will post changes here and update the date above. For material changes to how we handle Cloud data, we will also email account owners.