Privacy Policy

Last updated: 2026-08-27

1. Data Controller

The data controller responsible for the personal information described in this Policy is:

Placeholder[Operator / company legal name - to be provided]

Placeholder[Registered business address - to be provided]

privacy@ordinexdata.com

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with data-transfer requirements, your information may be processed in a different country than where you are located, including in connection with the third-party infrastructure providers described in Section 9 (Security).

2. What We Collect

This API is designed to collect the minimum needed to operate:

• Signup information: if you obtain an API key via self-service signup (POST /signup), we collect the email address you provide and, optionally, a label for the key. Email addresses are used to enforce a one-active-key-per-email limit and are not required for manually issued keys.
• API key value and metadata: a human-readable label you (or we) supply when a key is created, the key's active/ revoked status, its rate limit, and its creation time. The API key value itself is stored as a one-way SHA-256 hash, never in plaintext - the raw value is shown to you once at creation and is not recoverable by us afterward, including by our own staff. We verify a request's key by hashing the value you send and comparing it against the stored hash, the same way a password would be checked, not by storing or looking up the raw value.
• Request logs: for every authenticated request, we persistently store the associated API key, the HTTP method, the request path, and a timestamp - used for rate limiting, usage tracking, and (in the future) billing. This is a real, persisted database table, not an in-memory counter that resets on restart. We do not log request bodies, query parameter values beyond the path, or your IP address in this table (a per-request IP is used transiently to enforce the self-service signup rate limit described below, and is not persisted alongside it).
• Signup rate-limit tracking: the IP address of a self-service signup request is checked against a short-lived, in-memory counter (resets hourly and on server restart) to enforce a per-IP signup rate limit - not persisted to any database.

3. What We Don't Collect

We do not use cookies, browser fingerprinting, third-party analytics, or advertising trackers on this site. We do not build behavioral profiles of individual end users beyond what is described in Section 2, and we do not sell or share any collected data with third parties.

4. Lawful Basis for Processing

For users in jurisdictions that require a lawful basis for processing personal information (such as the EU/UK GDPR), we process your information on the following bases:

• Performance of a contract: processing your email address and API key metadata is necessary to provide the Service you requested (issuing and maintaining your API key access);
• Legitimate interests: processing request logs and signup rate-limit information is necessary for our legitimate interest in securing the Service, detecting and preventing abuse, and maintaining operational reliability;
• Legal obligations: we may process or retain information where necessary to comply with applicable law or respond to lawful requests from public authorities.

5. How We Use It

Collected data is used solely to operate, secure, and debug the Service - for example, issuing and enforcing API key scope and rate limits, detecting abuse, diagnosing errors, understanding which endpoints are under load, and (in the future) determining usage-based billing once paid tiers exist.

6. Data Retention

Request logs (Section 2) are retained indefinitely at this time, since they are the intended basis for future usage-based billing - this will be revisited once a concrete retention period is set alongside that feature. Signup rate-limit counters are held in memory only and are lost on every server restart. API key records (including the email address associated with a self-service key, if any) are retained for as long as needed to operate the Service, secure it against abuse, and comply with legal obligations.

Revoking an API key does not automatically delete its record - revocation immediately disables the key but the record is retained as an audit trail. Where applicable law grants you a right to request deletion of your personal information (see Section 7), we will act on verified deletion requests, subject to any legitimate need to retain limited records for security, abuse prevention, or legal-compliance purposes.

7. Your Rights

Depending on your jurisdiction, you may have rights over your personal information, including the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information (for example, a label or email address associated with your key);
• Delete your personal information, subject to the retention exceptions described in Section 6;
• Object to certain processing, where our processing relies on legitimate interests;
• Port your data to another provider, where technically feasible and applicable.

To exercise any of these rights, contact us using the details in Section 10 (Contact). We may need to verify your identity (for example, by confirming the email address on file) before acting on a request. Revoking a key immediately and permanently prevents it from being used to authenticate, even before any deletion request is processed - and because we only ever store a one-way hash of the key value (see Section 2), we cannot look up or disclose a lost raw key value to you even upon request; a lost key must be revoked and a new one issued.

8. Third-Party Data Sources

To serve energy-market data, the Service makes outbound requests to the U.S. Energy Information Administration (EIA), NOAA's Climate Data Online, and ERCOT's Public API - the sources this Service serves publicly - plus CAISO's OASIS system and NYISO's public market information system, used only for our own internal research (see our Terms of Service, Section 4). These are one-way data fetches for the Service's own operation - no data about you or your usage is sent to these sources.

9. Security

We apply reasonable technical measures to protect your information, including:

• Encrypting traffic to the Service in transit via HTTPS;
• Storing API key values as a one-way SHA-256 hash, never in plaintext - we cannot recover your raw key value, including in the event of a database compromise;
• Access controls restricting administrative functions (such as key management and scheduler controls) to a separate, dedicated credential, distinct from any individual API key;
• Rate limiting (both per-API-key and per-signup-IP) to reduce the impact of abusive or automated traffic;
• Automated daily backups of the underlying database, retained on a rolling basis.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security of your information. Because we only ever store a hash of your API key, treat the raw value the same way you would a password: keep it out of client-side code and public repositories, and revoke it immediately (via the self-service process or by contacting us) if you believe it has been exposed - we cannot tell you the value back, only confirm whether a given value matches what's on file.

10. Children's Privacy

The Service is not directed at, or knowingly used by, children.

11. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by updating the date at the top of this page.

12. Relationship to Our Terms of Service

This Policy should be read together with our Terms of Service, which govern your use of the Service more broadly.

13. Contact

Questions about this Policy, or requests to exercise the rights described in Section 7, can be directed to privacy@ordinexdata.com. You may also raise general questions via GitHub issues.