Privacy Policy

1. About this policy

This policy explains how RateExchanger.io ("we", "us") handles personal information when you use our website, dashboard and API. We are based in Canada and handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

We are responsible for the personal information we hold. Our privacy officer can be reached at contact@rateexchanger.io.

2. Information we collect

We only collect what we need to run the service:

• Account details: your first and last name, email address, password (stored only as a secure hash), country, language, timezone, preferred base currency and, if you upload one, a profile photo. If you sign in with Google, we receive your name, email address and Google account ID.
• Billing details: the billing name, email, address and tax ID you enter, your plan and subscription history, and your invoices. Card numbers are collected and stored by Stripe; we only keep the card brand, last four digits and expiry date.
• API usage: for each API request, the endpoint, query parameters, response status and size, the API key used, your IP address and the time.
• Support messages: the name, email address and messages you send through our contact form or support tickets.
• Sign-in sessions: while you're signed in, your IP address and browser details, to keep your session secure.

3. How we use it

We use personal information to:

• create and secure your account and authenticate your API requests;
• count your requests, apply your plan's limits and show usage in your dashboard;
• take payments, issue invoices and refunds, and meet tax and accounting obligations;
• send emails about your account, such as your welcome email, invoices, usage alerts when you reach 80% or 100% of your plan, notices that your access is paused, and replies to your support requests;
• answer your questions and support requests;
• detect and prevent fraud, abuse and security problems, and comply with the law.

We don't sell or rent your personal information, we don't use it for advertising, and we don't build profiles about you for marketing.

4. Cookies

The site needs a few cookies to work: a session cookie that keeps you signed in, a security token that protects forms, a "remember me" cookie if you choose that option when you log in, and a cookie that remembers your cookie choice.

With your permission, we also use Google Analytics to understand how people find and use the site, such as which pages are visited. Google Analytics sets its own cookies (_ga and _ga_*) only after you accept them in the cookie banner. If you decline, or don't choose, no analytics cookies are set. You can change your choice at any time with Cookie settings at the bottom of the page; declining removes the analytics cookies already set. We don't use advertising cookies.

If you sign in with Google, Google may set its own cookies under its privacy policy.

5. Who we share it with

We share personal information only with service providers that help us run RateExchanger.io, and only what each one needs:

• Stripe processes payments, stores your card details and handles refunds;
• Google, if you choose to sign in with Google, and Google Analytics, only if you accept analytics cookies;
• Amazon Web Services stores profile photos;
• our email delivery provider sends account and support emails;
• our hosting and database providers run the servers the service is on.

These providers may only use the information to provide their services to us. We may also disclose information when the law requires it, to protect the rights and safety of our users or the service, or as part of a merger or sale of the business, in which case this policy continues to apply. The exchange-rate data providers we use never receive your personal information.

6. Where your information is stored

Our service providers may store and process your information outside Canada, including in the United States. While it's there, it may be accessible to courts, law enforcement and national security authorities under the laws of that country.

7. How long we keep it

We keep your account details while your account is open. API request logs are deleted automatically after about six months.

When you close your account, we delete your API keys, request logs, collections, saved payment methods, billing details, support tickets, notifications, sign-in sessions and profile photo, and anonymize your profile by removing your name, email address and Google sign-in link. We keep subscription and invoice records, including the billing details on each invoice, for as long as tax and accounting laws require.

Messages sent through the contact form by people without an account are kept for as long as we need them to answer and follow up. You can ask us to delete them at any time.

8. How we protect it

All traffic to the website and API is encrypted with HTTPS. Passwords are stored as secure hashes, tax IDs and invoice billing details are encrypted in our database, and access to personal information is limited to people who need it to run the service. You can revoke API keys at any time from your dashboard.

No system is perfectly secure. If a breach creates a real risk of significant harm to you, we'll notify you and the Office of the Privacy Commissioner of Canada as the law requires.

9. Your choices and rights

You can see and correct most of your information yourself in your dashboard, turn usage emails on or off in your email preferences, and close your account at any time.

You can also ask us for a copy of the personal information we hold about you, ask us to correct or delete it, or withdraw your consent to how we use it, by emailing contact@rateexchanger.io. We'll answer within 30 days. Withdrawing consent to information we need to run your account may mean we can't keep providing the service.

If you're not satisfied with how we handle your request, you can complain to the Office of the Privacy Commissioner of Canada. Depending on where you live, you may have further rights under local law, such as in the European Union, the United Kingdom or some US states, and we'll honour them.

10. Children

RateExchanger.io is a service for developers and businesses and isn't meant for children under 16. We don't knowingly collect personal information from them. If you think a child has given us personal information, contact us and we'll delete it.

11. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If we make significant changes to how we use your personal information, we'll email you before they take effect.

12. Contact

Questions, requests and complaints about privacy can be sent to our privacy officer at contact@rateexchanger.io.