Privacy Policy

Account data. Your name, work email, company name and hashed password. Passwords are hashed and are never recoverable, by us or anyone else.

Request logs. For each API call: the endpoint, timestamp, HTTP status, credits consumed, response latency and originating IP address. This is what powers your usage dashboard and your invoice, so we cannot bill accurately without it.

Demo and contact requests. The details you submit in those forms, plus the submitting IP address, which we use to enforce the anti-abuse limits.

Payment data. Handled by our payment processor. We store invoice records and the last four digits of a card, never full card numbers.

We do not see the amounts you convert or who you convert them for. Conversion is arithmetic performed against a rate; the inputs are not retained beyond the request log's endpoint and status fields.

There are no third-party advertising or analytics trackers on this site.

Keys are stored hashed. We can show you a prefix and the last four characters so you can identify a key, but we cannot show you the key itself again after issue — if you lose it, you rotate it.

The dashboard sets one httpOnly session cookie so you stay signed in. It is not readable by browser JavaScript and is not used for tracking. No cookies are set on the public marketing pages.

Request logs are retained for the history window included in your plan and then purged. Invoices are retained for the period required by accounting law. Account data is deleted on request, subject to those retention obligations.

Demo requests are retained so the per-domain cooldown can be enforced, and are removed once that window has passed.

Data is stored on servers in the European Union. Rate data itself is public market information and carries no personal data.

You can request access to, correction of, export of, or deletion of your personal data at any time by contacting us. We will respond within 30 days.

Questions about this policy, or a data request, go through the contact form.