🔒 Privacy Policy

Last updated: June 6, 2026 — Version 2.0 (GDPR/CCPA Updated)

GDPR/CCPA Notice: This policy complies with the EU General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA). You have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data. California residents have the right to know, delete, and opt-out of sale of personal information.

1. Information We Collect

We collect minimal information necessary to provide our services:

Account Data: Email address, name (optional), and payment information (processed through LemonSqueezy — we never store payment details).
Usage Data: API request logs (endpoint, timestamp, response size, IP address) for rate limiting, abuse prevention, and security monitoring.
Technical Data: Browser type, operating system, device information, and referral source for analytics and debugging.
Wallet Addresses: Optional cryptocurrency wallet addresses you provide for receiving payments or donations.
Correspondence: Communications you send to us (support tickets, feedback, inquiries).

2. Legal Basis for Processing (GDPR Article 6)

We process your personal data on the following lawful bases:

Contract Performance (Art. 6(1)(b)): To provide API access, dashboard, and subscription services you requested.
Legitimate Interest (Art. 6(1)(f)): Security monitoring, fraud prevention, service improvement, and analytics.
Legal Obligation (Art. 6(1)(c)): KYC/AML compliance, tax reporting, and regulatory requirements.
Consent (Art. 6(1)(a)): Marketing communications (opt-in only), analytics cookies (where applicable).

3. How We Use Your Data

To provide and maintain our services (API access, dashboard, predictions)
To enforce rate limits, prevent abuse, and ensure security
To comply with legal obligations (KYC/AML where applicable)
To process payments and manage subscriptions via LemonSqueezy
To communicate service updates, security notices, and account changes
We do NOT sell your personal data to third parties
We do NOT use your data for advertising or behavioral profiling

4. Data Storage & Security

Account data is stored encrypted at rest using AES-256-GCM. API keys are stored using environment variables with file permissions restricted to the running user (chmod 600). Access logs are retained for 90 days. We use industry-standard security practices including TLS 1.3 for data in transit.

Data Location: Primary infrastructure hosted in the US (GitHub Pages, Vercel). By using our service, you consent to transfer of your data to the US.

5. Third-Party Services

LemonSqueezy: Payment processing, subscription management, tax compliance (Merchant of Record). Privacy Policy: lemonsqueezy.com/privacy
GitHub: Source code hosting, issue tracking. Privacy Policy: github.com/about/privacy
NousResearch: LLM API provider for agent reasoning (agent output only, no user data). Privacy Policy: nousresearch.com/privacy

6. Data Retention

Usage logs (API requests, IP): 90 days
Account data (email, name, preferences): Until account deletion + 30 days
Payment records (via LemonSqueezy): Per LemonSqueezy's retention policy (typically 7 years for tax)
Security logs: 1 year
Correspondence: 2 years

7. Your Rights

You have the following rights under GDPR and CCPA:

Access: Request a copy of your personal data
Rectification: Correct inaccurate or incomplete data
Erasure ("Right to be Forgotten"): Request deletion of your data
Restriction: Limit how we process your data
Portability: Receive your data in a structured, machine-readable format
Objection: Object to processing based on legitimate interest
CCPA Opt-Out: Opt-out of "sale" of personal information (we don't sell, but you can opt-out of sharing)
Withdraw Consent: Where processing is based on consent, withdraw at any time

To exercise any right, email eman56447@gmail.com with subject "Data Rights Request". We respond within 30 days (GDPR) or 45 days (CCPA).

8. Children's Privacy

Our service is not intended for individuals under 16 (GDPR) or 13 (CCPA). We do not knowingly collect data from children. If you believe we have collected data from a minor, contact us immediately.

9. International Transfers

Your data may be processed in the US. The EU has not issued an adequacy decision for the US. We rely on Standard Contractual Clauses (SCCs) and your explicit consent for transfers. By using our service, you consent to this transfer.

10. Changes to This Policy

We will notify registered users of material changes via email and update the "Last updated" date above. Continued use after changes constitutes acceptance.

11. Contact

Data Controller: Money Room (eman56447@gmail.com)

Data Protection Officer: eman56447@gmail.com

EU Representative: Not appointed (service targets US primarily; contact us for EU inquiries)