Privacy Policy

01Who is responsible

iAC Studio, operating GoalPulse at https://gp.iac-studio.com, is the controller for the data described below. Contact: [email protected].

02What we collect about you as a customer

• • Identity and contact details you send us: name, email address, and the WhatsApp or phone number you reach us on.
• • Billing details we actually need: the transaction reference for a payment, the plan purchased, and the amount and date.
• • Your license key and the application it was issued for (package name, platform, and where relevant the app store URL).
• • Support correspondence you start with us.

We do not ask for, and do not store, card numbers or bank credentials. Payments are processed by our payment provider (Lemon Squeezy); we keep only the transaction reference, never your card details.

03What we record for every API request

To enforce daily quotas, bill fairly, and spot abuse, every call to the API is written to a request log. The stored fields are:

• • the license key that made the call;
• • the endpoint path and the HTTP status we returned;
• • the client IP address, and a country code derived from it;
• • the timestamp, and whether we had to fetch from the upstream provider for that call.

Request bodies, query values that carry your users' information, and response payloads are not written to the log. The log exists for quota and security accounting — not for profiling your audience.

Logs are pruned by an automated retention job once they stop being needed for quota reconciliation and abuse investigation.

04Your app's end-users are never our users

There is no GoalPulse SDK in your application. Every request that reaches us is issued by your app or your server under your license key, so we see a machine and a count — never a name, device identifier, advertisement identifier, account, or location belonging to your users.

Push notifications and advertising are handled by services you configure yourself (OneSignal, Google AdMob). Their own privacy policies govern that processing, and any identifiers they issue are between you, your users, and them.

05Cookies and local storage on this website

The marketing site you are reading sets exactly one cookie: gp_landing_theme, which remembers whether you chose the light or dark appearance. It contains no personal data and is not used for advertising or tracking across other sites.

Product analytics that measure page performance and usage of this marketing site may be enabled by us; they collect aggregate usage, not customer identities, and they are configured to avoid storing raw IP addresses.

06Who else sees this data

• • Our hosting and managed-database providers, who process it on our instructions under their own terms.
• • Our payment provider (Lemon Squeezy), which processes card and PayPal payments — it sees the transaction, not your database.
• • Publicly reachable endpoints, when you use them: the health probe at /api/health is unauthenticated by design and returns only an aggregate up/down status with the API version and uptime — never customer data, backing-service names or process internals.

We do not sell customer data, and we do not share request logs with third parties except when legally compelled or when a provider must investigate abuse that originates from our platform.

07How we protect it

License keys live server-side. The public API requires the key header on every authenticated route, applies per-IP rate limits that also blunt key-guessing, and returns explicit errors rather than partial data when a check fails. Administration is limited to staff accounts, and this repository never contains production key values.

08Your rights

You can ask us for a copy of the customer record attached to your license, correct it, or ask for deletion — write to [email protected] from the address on the account. Where a record must stay because it is the proof of a payment or of a quota decision, we keep only that much and say so.

If you are an end-user of one of our customers' apps and want something removed from their analytics, that request belongs to that app's operator, not to us: we never held the data.

09Children

The API is a developer product and is not directed at children. Sports applications built with it are the responsibility of their own publishers, including any obligations they carry around children's data and age-appropriate design.

10Changes to this policy

If the set of stored fields changes materially, we update this page and tell active licensees by email at least 14 days before the change takes effect.