Your information deserves clarity.

This Privacy Policy explains how RevenueStack ("we," "us," or "our"), based in Kenya, collects, uses, stores, protects, shares, and otherwise processes personal information in connection with RevenueStack, including our website at revenuestack.app, our software, dashboards, APIs, AI and MCP functionality, integrations, communications, and related products and services (collectively, the "Services").

RevenueStack is a platform that helps developers, businesses, and other users manage aspects of their applications, subscriptions, pricing, integrations, and related operations across supported third-party platforms.

By accessing or using RevenueStack, you acknowledge the practices described in this Privacy Policy.

If you have questions about this Privacy Policy or our privacy practices, contact us at:

RevenueStack Kenya Email: hello@revenuestack.app Website: revenuestack.app

1. Scope of This Privacy Policy

This Privacy Policy applies to personal information that we process when you:

• visit the RevenueStack website;
• create or use a RevenueStack account;
• subscribe to a RevenueStack paid plan;
• connect a third-party platform or account to RevenueStack;
• use RevenueStack's dashboards, APIs, automation, AI, or MCP functionality;
• communicate with our support team;
• subscribe to our marketing communications;
• participate in surveys, promotions, beta programs, or research;
• interact with RevenueStack through another supported service; or
• otherwise interact with us in connection with the Services.

This Privacy Policy does not govern the privacy practices of independent third parties, including Apple, Google, Stripe, Paddle, or other services that you choose to connect to or access through RevenueStack.

Those companies may independently process information according to their own terms and privacy policies.

2. Who Controls Your Personal Information

RevenueStack provides the Services described in this Privacy Policy.

Depending on the circumstances, RevenueStack may act as a data controller, business, or similar entity that determines why and how personal information is processed.

In certain situations, particularly where RevenueStack processes information on behalf of a business customer, we may instead act as a data processor, service provider, or equivalent entity.

Where we process personal information solely on behalf of a customer, that customer's privacy policy and instructions may also apply.

3. Information We Collect

The information we collect depends on how you interact with RevenueStack and which features and integrations you use.

3.1 Account Information

When you create or maintain a RevenueStack account, we may collect information such as:

• your name;
• email address;
• company or organization name;
• account identifiers;
• login and authentication information;
• password information in securely protected form;
• OAuth authentication information;
• account preferences;
• account settings; and
• other information you choose to add to your account.

We do not need to know your plaintext password where authentication systems use cryptographic password protection.

If you sign in through a third-party authentication provider, we may receive information permitted by that provider and by the permissions you grant.

4. Information From Connected Services

RevenueStack allows users to connect supported third-party accounts and platforms.

These may include:

• Apple App Store Connect
• Google Play Console
• Stripe
• Paddle

When you connect a service, RevenueStack may access information from that service as necessary to provide the functionality you request.

Depending on the integration and permissions you authorize, this may include information concerning:

• applications;
• application identifiers;
• subscription products;
• subscription configurations;
• base plans;
• offers;
• pricing;
• currencies;
• territories and countries;
• product availability;
• connected accounts;
• account configuration;
• subscription metadata;
• transaction or revenue-related information;
• product identifiers;
• store configuration;
• billing configuration;
• deployment information;
• changes made through RevenueStack;
• synchronization status;
• API responses;
• errors and diagnostic information; and
• other information made available through the integration's authorized API.

RevenueStack only seeks to access connected-account information necessary or reasonably useful for providing the features you request.

The exact information available to RevenueStack depends on the third-party service, your account configuration, the permissions granted, and the RevenueStack features you use.

5. Integration Credentials and Secrets

Certain RevenueStack integrations may require credentials or authorization information.

Depending on the service, these may include:

• API keys;
• access tokens;
• refresh tokens;
• service account credentials;
• service account configuration;
• App Store Connect credentials;
• Google Play service account credentials;
• Stripe credentials;
• Paddle credentials; and
• similar authentication secrets.

RevenueStack treats integration credentials as sensitive information.

Credentials and secrets stored by RevenueStack are encrypted.

We use these credentials to authenticate authorized requests and provide functionality requested by the user.

Users should only provide credentials they are authorized to use.

You should never provide RevenueStack with credentials belonging to another individual or organization unless you have permission to do so.

When you disconnect an integration, credentials associated with that integration are deleted from RevenueStack's active systems, subject to limited retention that may be technically or legally required, including temporary backups, security logs, fraud prevention records, or records required by law.

When your RevenueStack account is deleted, connected-service credentials associated with the account are also deleted, subject to similar limited legal, security, and backup exceptions where applicable.

6. Payment and Billing Information

RevenueStack may offer free and paid plans.

RevenueStack currently uses Paddle to process payments for RevenueStack subscriptions and related purchases.

When you purchase a paid RevenueStack service, Paddle may collect information such as:

• name;
• billing address;
• payment method;
• card or financial information;
• country;
• tax information;
• transaction information;
• purchase history; and
• other information required to process your transaction.

Payment card information may be collected and processed directly by Paddle rather than RevenueStack.

RevenueStack may receive limited billing information from Paddle, such as your:

• subscription status;
• plan;
• customer identifier;
• transaction identifier;
• payment status;
• renewal status;
• billing period;
• currency;
• amount paid;
• country;
• applicable tax information; and
• other information necessary to administer your RevenueStack subscription.

Paddle's own terms and privacy practices apply to information that Paddle independently processes.

7. Usage and Technical Information

When you access RevenueStack, we may automatically collect technical and usage information.

This may include:

• IP address;
• browser type;
• browser version;
• device type;
• operating system;
• approximate geographic location derived from an IP address;
• language;
• time zone;
• referring URLs;
• pages viewed;
• features used;
• buttons or controls interacted with;
• session information;
• timestamps;
• authentication events;
• API activity;
• integration activity;
• deployment activity;
• error reports;
• crash information;
• performance information;
• diagnostic information;
• security events; and
• similar technical information.

We may use this information to operate RevenueStack, maintain security, diagnose errors, improve performance, understand feature usage, prevent abuse, and improve our Services.

8. Cookies and Similar Technologies

RevenueStack may use cookies, local storage, session storage, pixels, SDKs, and similar technologies.

These technologies may be used for purposes such as:

• keeping you signed in;
• authenticating your account;
• maintaining sessions;
• remembering preferences;
• protecting accounts;
• preventing fraud and abuse;
• understanding use of RevenueStack;
• measuring performance;
• diagnosing technical problems;
• improving the Services; and
• measuring marketing effectiveness where permitted.

Where required by applicable law, we will request appropriate consent before using non-essential cookies or similar technologies.

You may also be able to control certain cookies through your browser settings or available RevenueStack privacy controls.

Disabling essential technologies may prevent portions of RevenueStack from functioning correctly.

9. AI and MCP Features

RevenueStack may provide artificial intelligence, AI-assisted functionality, Model Context Protocol ("MCP") functionality, automation, intelligent recommendations, or similar features.

Depending on the feature you use, information processed by these systems may include:

• prompts;
• instructions;
• requests;
• responses;
• app information;
• subscription information;
• pricing information;
• territory information;
• configuration information;
• connected-service information;
• relevant account information; and
• other context necessary to perform the action requested by you.

RevenueStack may use third-party technology providers to support certain AI or computational functionality.

Where information is provided to a service provider, we seek to limit the information to what is reasonably necessary for the applicable functionality and handle it in accordance with applicable contractual and legal requirements.

Users should not submit highly sensitive personal information, passwords, payment card numbers, private authentication credentials, or secrets through AI prompts unless a RevenueStack feature specifically requires such information and is designed to process it securely.

AI-generated information may be incomplete or inaccurate. Users remain responsible for reviewing AI-generated suggestions and for determining whether to implement actions affecting their applications, products, pricing, subscriptions, or third-party accounts.

10. MCP Connections and Third-Party AI Clients

RevenueStack may permit users to interact with RevenueStack functionality through MCP-compatible applications, AI assistants, developer tools, or other third-party clients.

When you connect RevenueStack to a third-party client, information may be exchanged between RevenueStack and that client in response to your instructions and according to the permissions you authorize.

Third-party clients are not necessarily operated or controlled by RevenueStack.

You are responsible for reviewing the privacy, security, and data-handling practices of third-party clients before granting them access to your RevenueStack account or data.

RevenueStack is not responsible for independent processing performed by third-party applications outside our control.

11. How We Use Personal Information

We may use information we collect to:

• create and maintain RevenueStack accounts;
• authenticate users;
• provide RevenueStack functionality;
• connect authorized third-party services;
• synchronize subscription and product information;
• manage products, pricing, territories, and configurations;
• execute actions requested by users;
• provide AI and MCP functionality;
• process RevenueStack subscriptions;
• administer billing;
• provide customer support;
• respond to requests;
• maintain and improve the Services;
• develop new features;
• monitor system performance;
• identify and fix errors;
• analyze product usage;
• prevent fraud;
• detect abuse;
• protect accounts and infrastructure;
• enforce our agreements;
• comply with legal obligations;
• resolve disputes;
• establish, exercise, or defend legal claims;
• communicate important service information;
• send product announcements;
• send marketing communications where permitted;
• conduct internal research and analytics; and
• protect RevenueStack, our customers, users, and the public.

We may also use aggregated or de-identified information for analytics, research, security, product development, and other lawful purposes where that information no longer identifies an individual under applicable law.

12. Legal Bases for Processing

Where laws such as the GDPR or UK GDPR require us to identify a legal basis for processing, we may rely on one or more of the following:

Performance of a Contract

We process information when necessary to provide RevenueStack, administer your account, maintain integrations, process subscriptions, and perform other services you request.

Legitimate Interests

We may process information where necessary for legitimate business interests, such as:

• securing RevenueStack;
• preventing fraud;
• improving the Services;
• understanding product usage;
• communicating with customers;
• maintaining infrastructure;
• troubleshooting;
• protecting legal rights; and
• developing RevenueStack.

We consider the impact of such processing on the rights and interests of individuals where required.

Consent

We may rely on consent for certain activities, including particular marketing communications or non-essential cookies where applicable.

Where processing is based on consent, you may withdraw your consent, subject to applicable law.

Legal Obligations

We may process information where necessary to comply with tax, accounting, regulatory, court, law-enforcement, or other legal obligations.

Legal Claims and Protection

We may process information where necessary to establish, exercise, or defend legal claims or protect the rights and safety of RevenueStack, our customers, users, or others.

13. How We Share Information

We do not sell personal information.

We may disclose information in limited circumstances described below.

Service Providers

We may engage companies that assist us with functions such as:

• cloud hosting;
• database services;
• authentication;
• infrastructure;
• security;
• email delivery;
• customer support;
• payment processing;
• analytics;
• error monitoring;
• communications;
• AI functionality;
• fraud prevention; and
• other technical or operational services.

These providers may process information on our behalf as necessary to provide their services.

We do not publicly disclose sensitive details concerning our infrastructure where doing so could unnecessarily increase security risks.

Connected Platforms

When you instruct RevenueStack to communicate with a connected service, we transmit information to that service as necessary to perform the requested action.

Professional Advisers

We may disclose information to lawyers, accountants, auditors, insurers, consultants, and similar professional advisers where reasonably necessary.

Legal Requirements

We may disclose information when we reasonably believe disclosure is required to:

• comply with applicable law;
• respond to valid legal process;
• respond to lawful government requests;
• comply with court orders;
• protect our legal rights;
• investigate fraud or security incidents;
• enforce agreements; or
• protect the rights, property, or safety of RevenueStack, our users, or others.

Business Transactions

If RevenueStack is involved in a merger, financing, acquisition, restructuring, sale of assets, insolvency, or similar transaction, information may be disclosed or transferred as part of that transaction, subject to applicable law.

14. We Do Not Sell Personal Information

RevenueStack does not sell personal information.

We do not sell customer account information, connected-account credentials, API credentials, or integration data to data brokers.

If our practices materially change in the future, we will update this Privacy Policy and provide any choices or notices required by applicable law.

15. Marketing Communications

We may send emails concerning:

• RevenueStack features;
• new products;
• product updates;
• educational content;
• offers;
• promotions;
• events;
• surveys; and
• other RevenueStack news.

Where required, we will send promotional communications based on your consent or another legally permitted basis.

You may unsubscribe from promotional email communications using the unsubscribe mechanism provided in those communications or by contacting us at hello@revenuestack.app.

Even if you unsubscribe from marketing communications, we may continue sending non-promotional messages that are necessary for your account, such as:

• security alerts;
• billing notifications;
• password or authentication messages;
• integration alerts;
• material Terms or Privacy Policy updates;
• service announcements; and
• other transactional communications.

16. International Data Transfers

RevenueStack operates internationally.

Your information may therefore be processed in Kenya or in other countries where we or our service providers operate.

Those countries may have privacy and data protection laws different from those in your country.

Where required by applicable law, we use appropriate safeguards for international transfers of personal information.

Depending on the jurisdiction and circumstances, these safeguards may include:

• contractual protections;
• Standard Contractual Clauses;
• applicable adequacy mechanisms;
• approved transfer mechanisms;
• data-processing agreements; and
• other legally recognized safeguards.

17. Users in Kenya

RevenueStack is based in Kenya.

Where applicable, personal information is processed in accordance with the Kenya Data Protection Act, 2019, its implementing regulations, and other applicable Kenyan data protection requirements.

Subject to applicable law, individuals may have rights concerning access, correction, objection, restriction, deletion, and other aspects of the processing of their personal information.

Requests can be submitted to hello@revenuestack.app.

You may also have the right to lodge a complaint with the appropriate Kenyan data protection authority.

18. European Economic Area Users

If you are located in the European Economic Area ("EEA"), applicable data protection law may provide rights including the right to:

• access personal data;
• correct inaccurate data;
• request deletion;
• restrict processing;
• object to certain processing;
• receive certain data in a portable format;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a competent supervisory authority.

These rights are subject to legal limitations and exceptions.

You may exercise applicable rights by contacting hello@revenuestack.app.

19. United Kingdom Users

Users in the United Kingdom may have similar rights under applicable UK data protection law, including rights concerning:

• access;
• correction;
• deletion;
• restriction;
• objection;
• portability; and
• withdrawal of consent.

Users may also have the right to lodge a complaint with the relevant UK data protection authority.

20. United States Privacy Rights

Depending on your state of residence and whether applicable statutory thresholds are met, U.S. privacy laws may provide certain rights regarding personal information.

These may include rights to:

• know or access personal information;
• request correction;
• request deletion;
• obtain certain information in portable form;
• opt out of certain forms of targeted advertising;
• opt out of the sale or sharing of personal information where applicable; and
• appeal certain decisions concerning privacy requests.

RevenueStack does not sell personal information.

The exact rights available depend on your state, the applicable law, and whether that law applies to RevenueStack in the relevant circumstances.

We will not unlawfully discriminate against you for exercising applicable privacy rights.

Requests may be submitted to hello@revenuestack.app.

21. Canadian Users

Where Canadian privacy law applies, users may have rights to request access to or correction of certain personal information and to withdraw consent where processing is based on consent, subject to applicable legal restrictions.

You may contact us at hello@revenuestack.app regarding your privacy rights.

22. Australian Users

Where Australian privacy law applies, we handle personal information in accordance with applicable requirements.

Users may contact us regarding access, correction, privacy concerns, or complaints at hello@revenuestack.app.

23. Data Retention

We retain personal information for only as long as reasonably necessary for the purposes for which it was collected and for legitimate legal, operational, security, and business requirements.

Retention periods may depend on:

• how long you maintain a RevenueStack account;
• the type of information;
• the feature involved;
• contractual obligations;
• security requirements;
• fraud-prevention requirements;
• applicable limitation periods;
• tax and accounting requirements;
• legal obligations; and
• dispute-resolution requirements.

Different categories of information may therefore have different retention periods.

Information may temporarily remain in encrypted or protected backups after deletion from active systems until those backups are rotated or securely deleted according to our normal retention processes.

We may retain certain records where required by law or reasonably necessary to prevent fraud, enforce agreements, resolve disputes, or establish, exercise, or defend legal claims.

24. Account Deletion

RevenueStack users can request or initiate deletion of their accounts through available account functionality or by contacting us.

When an account is deleted, we will delete or de-identify personal information associated with the account in accordance with our retention practices, except where continued retention is permitted or required by law.

Credentials associated with connected services are deleted when the applicable integration is disconnected or the RevenueStack account is deleted, subject to limited technical, security, backup, or legal exceptions where applicable.

Account deletion may be irreversible.

Before deleting your account, you are responsible for preserving any information you need from RevenueStack.

25. Disconnecting Third-Party Integrations

Users may disconnect supported integrations.

Disconnecting an integration prevents RevenueStack from continuing to use the associated active credentials to access that service.

We delete stored credentials associated with disconnected integrations, subject to limited backup, security, and legal retention requirements where applicable.

Disconnecting RevenueStack does not automatically delete information held independently by Apple, Google, Stripe, Paddle, or another third party.

You may need to separately manage your information or permissions through those third-party services.

26. Security

We use administrative, organizational, and technical safeguards designed to protect information against:

• unauthorized access;
• unauthorized disclosure;
• alteration;
• destruction;
• loss;
• misuse; and
• other unauthorized processing.

Among other safeguards, credentials and secrets stored by RevenueStack are encrypted.

Depending on the information and systems involved, additional protections may include access controls, authentication controls, monitoring, logging, encryption, secure development practices, and other security measures.

However, no method of electronic transmission, software system, or storage technology can be guaranteed to be completely secure.

Users are responsible for protecting their own account credentials, using secure passwords, appropriately protecting API credentials, and maintaining the security of devices used to access RevenueStack.

If you believe your RevenueStack account or credentials may have been compromised, contact hello@revenuestack.app promptly.

27. Data Breaches and Security Incidents

If we become aware of a personal data breach or security incident, we will investigate and respond in accordance with applicable law.

Where legally required, we may notify affected users, regulators, authorities, customers, or other relevant parties.

28. Automated Processing

RevenueStack may use automation to perform tasks requested by users, identify technical issues, detect suspicious activity, assist with configurations, or provide AI-assisted functionality.

Where applicable law grants rights concerning decisions based solely on automated processing that produce legal or similarly significant effects, we will honor those rights where the relevant requirements apply.

29. Children's Privacy

RevenueStack is intended for users who are 18 years of age or older.

RevenueStack is a professional service designed primarily for developers, businesses, application publishers, entrepreneurs, and other individuals managing software products and commercial accounts.

We do not knowingly permit children under 18 to create RevenueStack accounts.

If we learn that an individual under 18 has provided personal information through an account in violation of this requirement, we may close the account and take reasonable steps to delete the associated personal information.

If you believe a person under 18 has created a RevenueStack account, contact us at hello@revenuestack.app.

30. Third-Party Websites and Services

RevenueStack may contain links to, integrate with, or interact with third-party websites, platforms, APIs, applications, or services.

These third parties maintain their own privacy practices.

This Privacy Policy does not govern information processed independently by third parties.

We encourage users to review the applicable privacy policies and terms before connecting or using third-party services.

31. Business and Team Accounts

If you use RevenueStack through an organization, employer, customer, or team, the administrator of that account may have access to certain information associated with your use of RevenueStack.

Depending on the features available, administrators may be able to:

• add or remove users;
• manage permissions;
• manage integrations;
• view account activity;
• manage applications;
• manage subscriptions or products;
• manage billing;
• configure account settings; and
• control access to organizational resources.

Your organization is responsible for ensuring it has appropriate authority to provide information to RevenueStack and permit users to access connected services.

32. Your Responsibilities When Connecting Third-Party Data

If you connect an application, developer account, payment account, or other third-party service to RevenueStack, you represent that you have the necessary authorization to provide RevenueStack access to that account and its information.

You are responsible for configuring appropriate permissions and ensuring your use of RevenueStack complies with applicable laws, contracts, developer agreements, platform rules, and privacy obligations.

33. Privacy Requests

To exercise an applicable privacy right, contact:

hello@revenuestack.app

We may need to verify your identity before processing certain requests.

Depending on the nature of your request, we may ask you to provide information reasonably necessary to confirm that you are the account holder or otherwise authorized to make the request.

We will respond within the period required by applicable law.

Certain rights are subject to exceptions. For example, we may be permitted or required to retain information for legal obligations, security, fraud prevention, dispute resolution, or legal claims.

34. Authorized Agents

Where applicable law permits an authorized agent to submit a privacy request on your behalf, we may require evidence that the agent is authorized to act for you and may separately verify your identity.

35. Do Not Track and Browser Privacy Signals

Some browsers and devices provide privacy preference signals.

Our response to such signals may depend on applicable law, technical capabilities, and the processing occurring through the Services.

Where we are legally required to recognize a particular browser-based opt-out or privacy preference signal, we will endeavor to honor that signal as required by applicable law.

36. Email and Support Communications

If you contact RevenueStack, we may collect your:

• name;
• email address;
• company information;
• message contents;
• attachments;
• support history; and
• other information you voluntarily provide.

We use this information to respond to your request, provide support, investigate technical issues, improve RevenueStack, protect our Services, and maintain appropriate business records.

Please avoid sending passwords, secret API keys, full payment card details, or other unnecessary sensitive credentials through ordinary email or support communications.

37. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to RevenueStack;
• new features;
• new integrations;
• changes to our business;
• changes to our data-processing practices;
• security developments;
• regulatory requirements; or
• changes in applicable law.

When we make changes, we will update the "Last Updated" date at the top of this Privacy Policy.

Where required by law or where changes are material, we may provide additional notice through RevenueStack, by email, or through another appropriate method.

Your continued use of RevenueStack after an updated Privacy Policy becomes effective is subject to applicable law.

38. Contact Us

Questions, requests, complaints, and other privacy inquiries can be directed to:

RevenueStack Country: Kenya Website: revenuestack.app Email: hello@revenuestack.app

For privacy-rights requests, please include enough information for us to understand and respond to your request. Do not send passwords, API keys, service-account credentials, or other sensitive authentication secrets by email.

© 2026 RevenueStack. All rights reserved.