The following entity details have not been provided yet and are marked “[To be provided]” in the text. They must be completed before launch:
Registered addressGoverning lawCourt of jurisdiction
Privacy Policy
Last updated: 2026-09-18
This policy explains what personal data CrestRate ("we", "us") collects when you use the CrestRate API and https://crestrate.com (the "Service"), why we collect it, and what rights you have.
1. Data we collect
Account data. Email address, password (stored only as an Argon2id hash with a random salt — we never store or can recover your plaintext password), preferred language, whether and when your email address was verified, account creation time, and last login time.
API credentials. API keys are stored only as SHA-256 hashes, together with the key's name and a short non-secret prefix that helps you tell keys apart. The plaintext key is shown once at creation and cannot be retrieved afterwards — not by you, and not by us.
Usage data. Per account and per API key: request counts per day and per month, the time a key was
last used, and counts of requests rejected by quota or rate limits. Quotas and rate limits are applied
to your account as a whole. We record these counts for billing and abuse prevention. We do not log
the currency pairs or amounts you query, so we cannot see what your business is pricing. Quotes you
create through the API (currency pair, amount, and the optional reference you supply) are held only
until they expire, so that you can retrieve them, and are then deleted automatically.
Session and security data. When you sign in we keep a session record containing the IP address and browser user agent used; session tokens are stored only as SHA-256 hashes. IP addresses are also used to throttle sign-up, login, and password-reset attempts.
Website demo. If you use the live demo on our home page without an account, we use your IP address only to apply short-lived per-network rate limits, and Cloudflare Turnstile checks that the request comes from a human (see section 3). Demo requests are not linked to any account.
Technical data. Server logs, which may include IP address, request path, and user agent. Server logs are kept only in rolling storage with a fixed size limit and are not archived (see section 5).
Email records. For each service email we send: recipient address, email type, subject, language, delivery status, and time. We do not store the content of those emails.
Billing data. If you subscribe to a paid plan, payment is processed by Stripe. We never see or store your card number. We store the Stripe customer and subscription identifiers, your plan and its status, and invoice and payment records received from Stripe (amount, currency, status, and invoice links). We also keep the payment notifications Stripe sends us, reduced to what we need to process and reconcile payments (event and object identifiers, amounts, currency, status, and billing periods); we do not keep your name, email address, phone number, or address from them.
Audit data. Security-relevant events — registration, login, failed login, password change, key creation and revocation, plan changes — with timestamp and IP.
2. Why we process it, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Service, authenticating you, enforcing quotas | Performance of a contract |
| Billing and tax records | Contract; legal obligation |
| Security, abuse prevention, rate limiting, bot checks (including on the website demo) | Legitimate interests |
| Service and security notification emails | Contract; legitimate interests |
| Product or marketing email (only if you opt in) | Consent |
Service emails — email verification, password reset, quota alerts, and material changes to these terms — are necessary to operate your account and are not marketing. You cannot opt out of them while your account is active. Failed-payment notices are sent by Stripe, depending on our Stripe account settings.
3. Who we share it with
We use these processors, and only for the purposes listed:
| Processor | Purpose | Data |
|---|---|---|
| Stripe | Payment processing, invoicing, tax | Email, billing details you enter with Stripe, subscription and invoice records |
| Amazon Web Services (Amazon SES, Asia Pacific (Tokyo) region) | Sending transactional email | Email address, message content |
| Cloudflare | Delivering and protecting traffic to the website and API (proxy, TLS, DDoS and bot protection); human verification (Turnstile) on sign-up, login, password reset, and the website demo | IP address, request metadata, browser signals |
We do not sell personal data, and we do not share it for advertising. We may disclose data where legally required, and will notify you unless prohibited from doing so.
4. International transfers
Transactional email is processed by Amazon Web Services in Japan (Tokyo region). Stripe and Cloudflare may process data outside your country, including in the United States; Cloudflare handles traffic at data centres around the world. Transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision where applicable.
5. Retention
| Data | Retained |
|---|---|
| Account and API key records | While your account is active |
| Session records (including IP address and user agent) and email verification and password-reset tokens | 30 days after the session expires or ends, or the token expires or is used |
| Usage aggregates | 24 months (billing disputes and capacity planning) |
| Server logs | Rolling storage with a fixed size limit: the oldest entries are deleted automatically as new ones are written, so the period depends on traffic. Logs of the application services (website, API, and background jobs) are also deleted in full whenever a new version is deployed; logs of the database, cache, and other supporting services are rotated by size only |
| Audit log | 24 months |
| Email records | 12 months |
| Payment notifications received from Stripe | 90 days |
| Billing records | As required by tax law (typically 7 years) |
After account deletion we erase account, key, and usage data within 30 days, except billing records we are legally required to keep.
6. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your data, to object to or restrict processing, and to withdraw consent. You can change your password from your dashboard. To change your email address, obtain a copy of your data, or delete your account, email [email protected].
For anything else, email [email protected]. We respond within 30 days. If you are in the EEA or UK you may also complain to your local data protection authority; if you are in Japan, to the Personal Information Protection Commission.
7. Security
Passwords are hashed with Argon2id. API keys, session tokens, and email verification and password-reset tokens are stored only as SHA-256 hashes. Traffic is served over TLS. Access to production data is limited to personnel who need it. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authority as required by law.
8. Cookies
We do not use cookies for login or tracking. Your session token and language preference are kept
in your browser's localStorage, and the session token is sent only to our own servers. Cloudflare may
set strictly necessary security cookies (such as __cf_bm) to protect the Service from automated
abuse, and Cloudflare Turnstile may use its own browser storage for bot detection on the sign-up,
login, and password-reset pages and on the home page demo.
9. Children
The Service is not directed at children under 16 and we do not knowingly collect their data.
10. Changes
We will post updates here and, for material changes, notify account holders by email.
11. Contact
CrestRate [To be provided] [email protected]