Privacy
Krystal Labs, LLC dba Credoble. Last updated October 24, 2026.
1. Who we are and what this policy covers
Last updated: October 24, 2026
This Privacy Policy explains how Krystal Labs, LLC, a Washington limited liability company doing business as Credoble ("Credoble," "we," "us"), collects, uses, and shares personal information when you visit credoble.com (the "Site"), fill out a form, request a free audit, buy the Shortlist Program, book a call, or otherwise contact us.
We are the controller of the personal information described here. Our mailing address is 2442 NW Market St, PMB 985, Seattle, WA 98107, and you can reach us about privacy at [email protected].
This policy does not cover information we process on behalf of clients during a paid engagement. That processing is governed by the client's agreement with us. It also does not cover third-party sites or tools we link to.
2. Information we collect
| Category | Examples | Source |
|---|---|---|
| Contact and business details | Name, work email, phone, job title, company name, company website, city or region | You, through forms, email, checkout, or booking a call |
| Engagement inquiry details | What you want help with, which product you are interested in, timeline, anything else you write in a form or email | You |
| Free audit requests | Your name, work email, and the website you ask us to audit | You, through the audit form |
| Purchase details | Billing name and email, the amount paid, and a payment confirmation. Card details are entered on Stripe's checkout page and handled by Stripe; we never receive your full card number | You and Stripe |
| Meeting information | Scheduled time, attendees, and, with notice at the start of the call, meeting notes or recordings | You and our scheduling and meeting tools |
| Device and usage data | Pages viewed, clicks on buttons and links, referring page, UTM campaign tags, browser and device type, operating system, screen size, approximate location derived from IP address | Collected automatically through PostHog (see section 3) |
| Business information from public sources | Your company's public website, business listings, reviews, and how search engines and AI assistants currently describe your company | Public sources, when you buy an audit, ask us to prepare an assessment, or when we research a potential engagement |
We do not ask for, and ask you not to send through the Site, sensitive personal information such as government ID numbers, financial account numbers, health information, or information about children.
3. Analytics and cookies
We use PostHog, a product and web analytics service provided by PostHog, Inc., to understand how visitors use the Site and to improve it. PostHog processes this data on our behalf as a service provider under a data processing agreement, and stores it in the European Union.
What PostHog records. PostHog records page views, clicks on buttons and links, the opening of questions on our FAQ, the fact that a contact form was sent and which product interest was selected (not what you typed), referrer and campaign tags, device and browser details, and an approximate location derived from your IP address.
No cookies, no profiles. We run PostHog in cookieless mode for every visitor, everywhere. It sets no cookie and stores nothing in your browser. Visits are counted with a privacy-preserving hash that changes every day and cannot identify you across days. We do not build visitor profiles, and we do not link analytics data to the contact details you give us.
Session replay. We do not use session replay.
Cookies set by others. The Site itself sets no analytics or advertising cookies. Cloudflare, which protects the Site and its contact form, may set cookies that are strictly necessary for security. Stripe sets its own cookies on its checkout page when you pay, and Cal.com sets its own cookies on its booking page when you book a call.
Your choices.
- Because our analytics uses no cookies and no persistent identifier, the Site does not show a consent banner.
- We honor Global Privacy Control (GPC). When your browser sends a GPC signal, analytics does not load for that browser.
- Anywhere, you can also block analytics with a browser extension. The Site's content works without it.
We do not currently respond differently to browser "Do Not Track" signals, because no common standard for them exists; we treat GPC as the recognized signal.
4. How we use information and our legal bases
| Purpose | Information used | Legal basis (EU/UK visitors) |
|---|---|---|
| Respond to inquiries, schedule and hold calls | Contact, inquiry, and meeting details | Steps at your request before a contract; legitimate interest in answering business inquiries |
| Produce and send the free audit you request | Your name, work email, the website you give us, public business information | Steps at your request before a contract |
| Take payment for and deliver the Shortlist Program | Contact and purchase details, public business information | Performance of a contract |
| Prepare assessments and proposals you ask for | Contact details, inquiry details, public business information | Steps at your request before a contract |
| Deliver Services under a signed Client Agreement | Contact and business details | Performance of a contract |
| Understand and improve the Site | Device and usage data, collected without cookies or persistent identifiers | Legitimate interest in measuring and improving the Site |
| Send occasional business emails about our Services to business contacts | Name, work email, company | Legitimate interest in B2B marketing; you can opt out any time via the unsubscribe link or by emailing us |
| Keep the Site secure and prevent abuse | Device and usage data, IP address | Legitimate interest in security |
| Meet legal, tax, and accounting obligations and enforce our terms | Any of the above, as needed | Legal obligation; legitimate interest |
We do not use your information for automated decisions that produce legal or similarly significant effects on you.
AI tools. We use AI tools, including large language models and AI agents we build, to run audits, draft responses, summarize meeting notes, and analyze public business information. When we do, we use business or API versions whose terms state that providers do not train their models on the data we send.
Free audit. When you request the free audit, AI models, including Anthropic's Claude, read your website and write the audit, and see your name and website while they do. To check how AI assistants such as ChatGPT answer a buyer's questions, we send those questions and your website address through our search data provider, OpenSEO. We never send your name or email address to an AI assistant.
5. How we share information
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
We share personal information only with:
- Service providers that run the Site and our business on our behalf, under contracts that limit their use of the data: PostHog (analytics), Oracle Cloud Infrastructure and Cloudflare (website hosting, delivery, and security), Sanity (website content management), Resend (delivery of contact form messages), Stripe (payment processing for the Shortlist Program), OpenSEO (search and AI answer data for audits), Google Workspace (email, calendar, documents, e-signature), Cal.com (scheduling calls), Mercury (invoicing and payments, for clients), and AI model providers used as described in section 4.
- Subcontractors who help deliver a paid engagement, under confidentiality obligations, and only the information they need for that work.
- Professional advisers, such as lawyers and accountants, under confidentiality duties.
- Authorities or other parties when we believe in good faith the law requires it, or to protect our rights, safety, or property, or those of others.
- A buyer or successor if we are involved in a merger, acquisition, financing, or sale of assets, subject to this policy.
- Anyone else with your consent or at your direction.
We will never publish your name, your company's name, or engagement results as a case study or reference without your written permission.
6. Retention, security, and international transfers
We keep personal information only as long as we need it for the purposes in this policy:
| Information | Retention |
|---|---|
| Inquiries that do not become engagements | 24 months after last contact, then deleted |
| Free audit requests and the audits we send | 24 months after last contact, then deleted |
| Client contact and engagement records | Term of the engagement plus 7 years for tax, accounting, and legal claims |
| PostHog analytics events | 12 months, PostHog's standard retention on our current plan (up to 7 years if we move to one of its paid plans) |
| Meeting recordings, if made | 90 days unless you agree to longer |
Security. We use reasonable administrative, technical, and physical safeguards, including encrypted connections (HTTPS), access limited to people who need it, and multi-factor authentication on our business accounts. No system is fully secure, and we cannot guarantee the security of information sent over the internet.
International transfers. We are based in the United States and our team also works from the European Union. Our service providers may process information in the United States and other countries. When we transfer personal information of EU, UK, or Swiss residents to countries without an adequacy decision, we rely on the provider's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where available, or on Standard Contractual Clauses.
7. Your rights and choices
Depending on where you live, you may have the right to:
- know what personal information we hold about you and get a copy;
- correct inaccurate information;
- delete your information;
- receive your information in a portable format;
- opt out of targeted advertising, sale, or profiling (we do none of these, but you may still submit a request);
- object to or restrict certain processing, including processing based on legitimate interests;
- withdraw consent at any time, without affecting processing done before withdrawal;
- not be discriminated against for exercising these rights.
These rights come from laws such as the California Consumer Privacy Act, other US state privacy laws (including those of Washington, Colorado, Virginia, Connecticut, Oregon, and Texas), the EU and UK GDPR, and the Swiss FADP. We extend the same choices to all visitors regardless of whether a specific law applies.
How to make a request. Email [email protected] with the subject "Privacy request." We will verify your identity by confirming your email address or asking for details that match our records, and respond within 30 days (45 days where US state law allows, with notice). An authorized agent may submit a request on your behalf with signed permission. If we decline your request, you may appeal by replying to our decision, and we will respond within 45 days.
Complaints. EU, UK, and Swiss residents may also complain to their local data protection authority. In the Czech Republic that is the Office for Personal Data Protection (UOOU).
8. Children
The Site is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has sent us information, contact us and we will delete it.
9. Changes to this policy
We may update this policy as our Site, services, or the law change. We will post the updated version here and change the "Last updated" date. If a change materially affects how we use information you already gave us, we will notify you by email or a notice on the Site before it takes effect.
10. Contact us
Krystal Labs, LLC dba Credoble, 2442 NW Market St, PMB 985, Seattle, WA 98107. Privacy: [email protected].