Privacy Policy

1. What we collect

Email address (provided at signup)
IP address (used for rate limiting and abuse detection)
API usage logs: state, license number queried, timestamp, credits charged
Stripe-provided billing metadata (last 4 digits, billing address via Stripe Customer object)
Terms-acceptance audit record: timestamp, IP, user agent, accepted version

2. What we do not collect

No analytics trackers, no third-party cookies, no advertising pixels, no device fingerprinting, no behavioral tracking.

3. Third-party processors

Resend — verification email delivery
Stripe — payment processing and PCI scope
Railway — application hosting
Google Workspace — support email (hello@tradesapi.com)

4. Retention

API usage logs: 90 days
Account email and key metadata: until deletion request
Billing records: retained per Stripe and applicable legal requirements (typically 7 years)
Terms acceptance records: retained for the lifetime of the account (deleted when the account is deleted)

5. Your rights

Email hello@tradesapi.com to request deletion or export of your data.

California residents may have rights under the CCPA, including the right to know, delete, and opt out of sale (we do not sell personal information). Residents of other jurisdictions should contact us to discuss applicable rights; we will honor reasonable deletion and export requests on a best-effort basis.

Note: TradesAPI is offered to and intended for businesses operating in the United States. If you are a resident of the European Economic Area, the United Kingdom, or another jurisdiction with comprehensive data protection laws, the service may not be appropriate for your use.

6. Security

API keys are stored as SHA-256 hashes; plaintext keys are never stored after the moment of generation. HTTPS is enforced everywhere. Verification email codes are single-use and consumed atomically (Redis GETDEL).

7. Contact

hello@tradesapi.com