GDPR
Compliance

Data Controller

CFXDATA acts as the data controller for all personal data collected through the platform and API. Any request relating to your data may be addressed directly to our team via official contact channels.

Personal Data Collected

We collect only the data strictly necessary to provide our services:

• Account data — email address, username, encrypted password
• Billing data — cryptocurrency wallet addresses (no bank card stored)
• Technical data — IP addresses, browser type, request timestamps
• Usage logs — API access logs, credit consumption, endpoints called
• Communications — messages sent through our support (Discord / Telegram)

Legal Basis for Processing

In accordance with Article 6 of the GDPR, our processing activities are based on the following legal grounds:

• Contract performance — processing necessary to provide the subscribed API access
• Legitimate interest — abuse prevention, platform security, service improvement
• Legal obligation — data retention required by applicable law
• Consent — for optional marketing communications only

Purposes of Processing

Your data is used exclusively to:

• Provide, maintain, and improve access to the CFXDATA API
• Manage your account and subscriptions
• Detect and prevent abusive or fraudulent usage
• Provide customer support and respond to your requests
• Comply with our legal and regulatory obligations

Data Sharing & Transfers

CFXDATA never sells, rents, or transfers your personal data to third parties for commercial purposes. Transfers may only occur in the following cases:

• Upon request from a competent judicial or administrative authority
• To technical sub-processors (hosting, infrastructure) bound by GDPR-compliant contractual clauses
• To protect the rights, property, or security of CFXDATA or its users

Data Retention

• Account data — retained for the duration of the active subscription, then deleted within 30 days of cancellation
• API logs — retained for 90 days for security and debugging purposes
• Billing data — retained for 5 years in accordance with legal accounting obligations
• Support data — retained for 12 months after the ticket is closed

Your GDPR Rights

As an EEA resident, you hold the following rights, which you may exercise at any time:

Data Security

CFXDATA applies state-of-the-art technical and organisational security measures:

• All communications encrypted via HTTPS / TLS 1.3
• Passwords hashed using the bcrypt algorithm (high cost factor)
• API keys encrypted and never stored in plain text
• Access to production data restricted to authorised personnel only
• Continuous access monitoring with anomaly alerts

Cookies & Trackers

CFXDATA uses only cookies strictly necessary for the platform to function (authentication session, language preferences). No advertising or third-party tracking cookies are placed on your device. No additional consent is required for these essential cookies.