Privacy policy

The controller is [Company legal name], a [Legal form] registered at [Registered address] under number [Registration number] ("CryptickData", "we"). Contact for all privacy matters: access@cryptickdata.com.

This policy covers the website cryptickdata.com, the terminal at app.cryptickdata.com, the documentation at doc.cryptickdata.com and the REST and WebSocket APIs (together, the "Service"). It is written to comply with the EU General Data Protection Regulation (GDPR).

• Account details. Username, a hash of your password, your role, entitlements, quotas and rate limits, and the company you represent.
• Correspondence. Your name, email address, company and the content of emails you exchange with us, including enquiries, onboarding and invoicing.
• API keys. The name, creation, expiry and revocation dates of each key. We store only a SHA-256 hash of the key itself, never the key.
• HTTP request log. For each API or terminal request: account id and username, method, endpoint and query string, client IP address, origin (web or API), status code, response size, handler time and timestamp.
• Connection audit. For each live WebSocket stream: account id, origin, the subscribed topic, client IP address, open and close times, close reason, bytes and items sent.
• Rate limiting. Per-address request counters, keyed by the client IP address (the first X-Forwarded-For entry, or the socket address).

Guest access needs no account. Guest requests are still recorded in the request log, the connection audit and the rate-limit counters, identified by IP address only.

We do not ask for, and ask you not to send us, any special category of personal data.

• Providing the Service and billing (accounts, API keys, entitlements, invoices, support): performance of our contract with you (Art. 6(1)(b) GDPR).
• Security, rate limiting, quota enforcement and abuse prevention (request log, connection audit, IP addresses): our legitimate interest in keeping the Service available, fair and secure (Art. 6(1)(f)).
• Answering enquiries from prospective clients: our legitimate interest in responding to you, and steps taken at your request before a contract (Art. 6(1)(b) and (f)).
• Accounting and tax records: our legal obligations (Art. 6(1)(c)).

We do not use your data for advertising or profiling, and we do not make automated decisions with legal effect on you.

• HTTP request log: 30 days.
• Connection audit: 30 days after the stream closes.
• Session tokens: access tokens expire after 15 minutes, refresh tokens after 30 days.
• Revoked or expired API keys: deleted 30 days after revocation.
• Account details: for the life of the account. When an account is deleted its API keys, sessions and connection audit rows are deleted; request log rows for the remaining 30 days lose the username.
• Email correspondence: [Retention period for correspondence].
• Invoices and accounting records: as long as required by applicable accounting and tax law, [Retention period for accounting records].

We use a small number of service providers who process data on our behalf under a data processing agreement:

• Hosting: [Hosting provider and location].
• Email: [Email provider and location].
• Invoicing and payment: [Payment or invoicing provider and location].

We do not sell personal data and do not share it with anyone else, except where the law requires it or to defend our legal rights.

Our servers are located at [Hosting provider and location]. If a provider processes data outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission or on the Commission's standard contractual clauses. You may request a copy of the safeguards in place.

The website cryptickdata.com sets no cookies and runs no analytics or tracking of any kind.

The terminal at app.cryptickdata.com sets no cookies and runs no analytics. It uses your browser's local storage, which stays on your device and is not read by us, for three items:

• mdf.auth.v1: your session tokens, so you stay signed in between visits;
• mdf.layout.v1: your chart layout;
• mdf.recent-markets.v1: your recently opened markets.

Signing out removes the session tokens. Clearing your browser's site data removes all three.

Under the GDPR you may ask us to:

• confirm whether we process your data and give you access to it;
• rectify inaccurate or incomplete data;
• erase your data, where no legal basis for keeping it remains;
• restrict processing while a dispute about it is resolved;
• object to processing based on our legitimate interests;
• receive the data you gave us in a portable format.

Write to access@cryptickdata.com. We answer within one month. We may ask you to confirm your identity first.

You may also lodge a complaint with your supervisory authority. If we are established in France, this is the CNIL (Commission Nationale de l'Informatique et des Libertés, cnil.fr). You may complain to the authority of your own place of residence or work instead.

All traffic to the Service is encrypted in transit. Passwords are stored hashed. API keys are stored as SHA-256 hashes and are shown once, at creation. Audit and account data are accessible only to CryptickData staff with a moderator or administrator role. Access and refresh tokens are short-lived and revoked on logout, password change or account disablement.

If a breach affects your personal data we will notify you and the supervisory authority as the GDPR requires.

We may update this policy. Account holders are emailed before a material change takes effect. The current version is always available on this page, with the date of its last update at the top.

[Company legal name], [Registered address]. Email: access@cryptickdata.com.