Privacy Policy

Acceptance

By using this website or opening an account, you acknowledge that your personal data is handled as described here. Where the law requires a specific legal basis for processing, it is set out under Legal Bases, not assumed from this acknowledgement.

What Personal Data Is

Personal data is any information that relates to an identified or identifiable living person, such as a name, an email address, an account identifier, or an online identifier linked to you.

The market data we sell is recorded from public venue feeds and a public blockchain. It describes orders and trades, not our customers, and it is not covered by this policy.

Who Is Responsible

The controller of your personal data is TODO: legal entity name, company number TODO: company number, registered office TODO: registered address.

You can reach us about privacy at TODO: contact email. Data protection officer: TODO: DPO, or a statement that none is appointed. Representative in the EU or UK, where required: TODO: EU / UK representative.

Information We Collect and How We Use It

Account. When you register we store your email address and a hashed form of your password (argon2). We never store the password itself. We also store your plan, whether the account is an administrator, how the account was opened (password or Google), and when it was created. We use these to run your account and to send you invoices and service messages.

Google sign-in. If you sign in with Google, we ask Google only for the openid and email scopes. We store Google's stable identifier for your Google account and your email address, which we accept only if Google says it is verified. We do not request or store your name, picture or any other profile information.

API keys. For each key we store a short public prefix, a one-way hash of the full key, its name, when it was created, when it was last used and, if so, when it was revoked. The full key is shown to you once and never stored.

Usage and downloads. Each time we issue a signed download URL, we record which account it was for, the object it points to, and when it was issued and expires. A separate usage ledger counts events against your plan's quota, with the time each occurred. We use this to enforce quotas, keep download issuance accountable, detect abuse and answer billing questions.

Orders. When you order a plan we store the plan, the term, the amount, whether a founder price applied, the order's status, any note you add (for example who the invoice should be addressed to), and when and by whom it was decided.

Technical data. Like any web service, our servers may process your IP address and request details in order to deliver pages and API responses. Our web server keeps an access log of requests (time, IP address, method, path, status and user agent). It is rotated at 20 MB and the last five files are kept, so entries age out as traffic replaces them; it is used only to operate and secure the service. TODO: confirm the access-log retention period in days.

What we do not collect: no payment card or bank details are collected on this website, no analytics or advertising trackers run on it, and we do not buy personal data from anyone.

Legal Bases

Under the GDPR and UK GDPR we rely on these legal bases:

• Contract: to open and run your account, issue keys, deliver the data and process your orders.
• Legitimate interests: to secure the service, prevent abuse, enforce quotas and licences, and keep an auditable record of downloads. We have weighed these interests against your rights and consider the processing proportionate.
• Legal obligation: to keep invoicing and accounting records as the law requires.

We do not currently rely on consent for any processing. If we ever do, we will ask first, and you will be able to withdraw that consent at any time.

Data Security

Passwords are stored only as argon2 hashes and API keys only as one-way hashes. Traffic to this website and the API is encrypted in transit with TLS. Download links are signed and expire shortly after issue. Google sign-in uses the authorization-code flow with PKCE, a signed state and a nonce, and every ID token is verified against Google's published keys.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority where the law requires it.

Sharing and Processors

We do not sell your personal data. We share it only with service providers that process it on our behalf, under contract, and only as far as needed:

• hosting and database: TODO: hosting provider;
• object storage for data delivery: TODO: object storage provider;
• Google, only if you choose to sign in with Google;
• email delivery for invoices and service messages: TODO: email provider.

We may also disclose personal data where the law requires it, to protect our rights or the security of the service, or to a successor if our business is transferred.

Retention

We keep account data for as long as your account exists. When an account is deleted, its API keys, usage ledger, download records and orders are deleted with it.

Invoices, and the records accounting or tax law requires us to keep, are retained for TODO: retention period for invoicing records, even after the account is deleted. Usage and download records of an active account are kept for TODO: retention period for usage and download records.

Your Rights

If the GDPR or UK GDPR applies to you, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to our processing, including processing based on legitimate interests;
• receive your data in a portable format;
• not be subject to decisions based solely on automated processing that significantly affect you (we make none).

You can revoke API keys yourself from your dashboard. Every other request, including access, correction, export and deletion of your account, is handled by email to TODO: contact email. We will answer within one month, and may need to confirm your identity first, usually by replying from the email address on the account.

Similar rights may apply to you under other laws, and we will honour them on the same terms.

How to Complain and Contact Us

If you have a concern about how we handle your data, write to TODO: contact email and we will try to resolve it.

You also have the right to complain to a data protection authority, in particular in the country where you live or work, or where you think an infringement took place. In the UK that is the Information Commissioner's Office. Our lead supervisory authority is TODO: lead supervisory authority.

Children

This service is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has opened an account, contact us and we will delete it.

International Transfers

Your data is stored in TODO: hosting location. Where it is transferred outside the UK or the European Economic Area, including to Google if you use Google sign-in, we rely on an adequacy decision or on appropriate safeguards such as standard contractual clauses. TODO: confirm the transfer mechanisms in place with each processor.

Changes to This Policy

We will update this policy whenever what we collect or how we use it changes. The effective date at the top shows the current version. If a change is material, we will tell account holders by email before it takes effect.