Privacy Policy

Last updated: 2026-08-06

1. Data Controller

The data controller responsible for the personal information described in this Policy is:

Placeholder[Operator / company legal name - to be provided]

Placeholder[Registered business address - to be provided]

privacy@ordinexdata.com

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with data-transfer requirements, your information may be processed in a different country than where you are located, including in connection with the third-party infrastructure providers described in Section 9 (Security).

2. What We Collect

This API is designed to collect the minimum needed to operate:

• Signup information: if you obtain an API key via self-service signup (POST /signup), we collect the email address you provide and, optionally, a label for the key. Email addresses are used to enforce a one-active-key-per-email limit and are not required for manually issued keys.
• API key metadata: a human-readable label you (or we) supply when a key is created, the key's active/revoked status, and its creation time. The raw API key itself is shown once at creation and is never stored - only a SHA-256 hash of it is kept, so we cannot recover or view your actual key value after issuance.
• Usage and security information: in-memory counts of requests per endpoint, their HTTP status class, and response duration, used for operational monitoring and abuse detection (for example, per-key and per-IP rate limiting). This is aggregated by endpoint, not tied to individual users beyond what is needed for rate limiting, and resets whenever the server restarts.
• Recent error logs: the text of recent server-side errors (for debugging), also in-memory and reset on restart.

3. What We Don't Collect

We do not use cookies, browser fingerprinting, third-party analytics, or advertising trackers. We do not build behavioral profiles of individual end users beyond what is needed for rate limiting and abuse prevention described above, and we do not sell or share any collected data with third parties.

4. Lawful Basis for Processing

For users in jurisdictions that require a lawful basis for processing personal information (such as the EU/UK GDPR), we process your information on the following bases:

• Performance of a contract: processing your email address and API key metadata is necessary to provide the Service you requested (issuing and maintaining your API key access);
• Legitimate interests: processing usage and security information is necessary for our legitimate interest in securing the Service, detecting and preventing abuse, and maintaining operational reliability;
• Legal obligations: we may process or retain information where necessary to comply with applicable law or respond to lawful requests from public authorities.

5. How We Use It

Collected data is used solely to operate, secure, and debug the Service - for example, issuing and enforcing API key scope, detecting abuse, diagnosing errors, and understanding which endpoints are under load.

6. Data Retention

Request metrics and error logs are held in memory only and are lost on every server restart - they are not persisted to any database. API key records (including the email address associated with a self-service key, if any) are retained for as long as needed to operate the Service, secure it against abuse, and comply with legal obligations.

Revoking an API key does not automatically delete its record - revocation immediately disables the key but the record is retained as an audit trail. Where applicable law grants you a right to request deletion of your personal information (see Section 7), we will act on verified deletion requests, subject to any legitimate need to retain limited records for security, abuse prevention, or legal-compliance purposes.

7. Your Rights

Depending on your jurisdiction, you may have rights over your personal information, including the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information (for example, a label or email address associated with your key);
• Delete your personal information, subject to the retention exceptions described in Section 6;
• Object to certain processing, where our processing relies on legitimate interests;
• Port your data to another provider, where technically feasible and applicable.

To exercise any of these rights, contact us using the details in Section 10 (Contact). We may need to verify your identity (for example, by confirming the email address on file) before acting on a request.

8. Third-Party Data Sources

To serve financial data, the Service makes outbound requests to SEC EDGAR, an unofficial market-data endpoint, and FRED (Federal Reserve Bank of St. Louis). These are one-way data fetches for the Service's own operation - no data about you or your usage is sent to these sources.

9. Security

We apply reasonable technical measures to protect your information, including:

• Encrypting traffic to the Service in transit via HTTPS;
• Storing API keys as a one-way SHA-256 hash, never in plaintext - we cannot recover your raw key value;
• Access controls restricting administrative functions (such as key management and scheduler controls) to a separate, dedicated credential;
• Rate limiting to reduce the impact of abusive or automated traffic;
• Monitoring of errors and request patterns to detect operational and security issues.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security of your information.

10. Children's Privacy

The Service is not directed at, or knowingly used by, children.

11. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by updating the date at the top of this page.

12. Relationship to Our Terms of Service

This Policy should be read together with our Terms of Service, which govern your use of the Service more broadly.

13. Contact

Questions about this Policy, or requests to exercise the rights described in Section 7, can be directed to privacy@ordinexdata.com. You may also raise general questions via GitHub issues.