Privacy Policy

1. What we collect

• Account data: the email address you use to sign up, and (for paid plans) billing-related metadata such as the organization name associated with the account.
• API keys: we store cryptographic hashes of your API keys, not the raw key values. We display the raw key once at creation time only.
• Usage metrics: per-request metadata such as endpoint path, response status, timestamp, and aggregate request counts tied to your API key. This is used for rate limiting, billing, and operational monitoring.
• Payment data: payment is handled by Stripe. We do not see or store raw card numbers. We receive and store only a Stripe customer identifier and limited billing metadata (plan, invoice status, last four digits of the payment method).

2. What we don't collect

We do not log the content of API request bodies or response bodies in a way that is tied to your identity. We do not sell personal information. Beyond the aggregate usage counters described above, the substantive content of your queries is not retained and associated with your account.

3. Third-party subprocessors

We rely on the following subprocessors to operate the Service. Each receives only the data needed to perform its function.

• Stripe — payment processing.
• Railway — application hosting.
• Neon — managed Postgres database.
• Backblaze B2 — raw source document storage.
• Sentry — error monitoring.
• PostHog — product analytics.

4. Cookies

We use standard first-party cookies to maintain your session and authenticate you to the customer dashboard. We also use a product-analytics cookie set by PostHog to understand how the dashboard is used in aggregate. We do not use third-party advertising cookies.

5. Your rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete personal information we hold about you, and to object to or restrict certain processing. This includes rights under the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). To exercise any of these rights, email support@hyperfeed.io. We will respond within the timeframes required by applicable law.

6. Data retention

• Usage metrics are retained for 24 months, then aggregated or deleted.
• Event data (Hyperfeed's curated event catalog) is retained indefinitely — it is the product.
• Account data is retained until you request deletion, subject to any retention required for tax, accounting, or legal compliance.

7. International transfers

Account, usage, and event data are stored in the United States (Neon, us-east region; Backblaze B2, us-east-005 region). If you access the Service from outside the United States, you consent to the transfer and processing of your information in the United States under this Privacy Policy.

8. Children

The Service is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email to the address associated with your account before the changes take effect.

10. Contact

Privacy questions and data-subject requests should be sent to support@hyperfeed.io.

Data Gateway LLC