Privacy Policy

1. Introduction

This Privacy Policy describes how Smart Money API ("we," "us," or "our"), operated by Ardit Tashi, collects, uses, and shares information about you when you use our website (smartmoneyapi.com), API services, dashboard, and related products (collectively, the "Service").

We are committed to protecting your privacy and processing your personal data in compliance with the General Data Protection Regulation (GDPR), the UK GDPR, and other applicable data protection laws.

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with any part of this policy, please discontinue use of our Service.

2. Data Controller

The data controller responsible for your personal data is:

For any questions or requests regarding your personal data, please contact us via our contact form.

3. Data We Collect

3.1 Information You Provide Directly

• Account registration: Email address, display name, and password (hashed) when you sign up via email. If you use Google Sign-In via Firebase Authentication, we receive your email address and Google profile name.
• Billing information: Payment method details are processed and stored by Stripe, our payment processor. We receive only non-sensitive billing summary data (last 4 digits of card, billing country, subscription status). We never store full card numbers.
• Contact form: Name, email address, subject, and message content when you contact us.
• API usage preferences: Watchlist symbols, alert rules, webhook URLs, and other configuration settings you save in the dashboard.

3.2 Information Collected Automatically

• API request logs: Timestamps, endpoint accessed, HTTP status codes, response times, and your API key identifier (not the key itself) for each request. Used for rate limiting, abuse prevention, and usage analytics.
• IP address: Collected for security, fraud prevention, and rate limiting. IP addresses are anonymised after 30 days.
• Browser and device information: Browser type, operating system, and viewport size collected via server logs and cookies. Used to improve compatibility. The user-agent string recorded at sign-up is also used for the check that keeps the free plan to one per person, described in section 4.
• Session data: Authentication tokens and session identifiers managed via Firebase Authentication secure cookies.
• Usage analytics: If you accept analytics cookies in our cookie consent banner, we record the pages you view, feature usage patterns, and navigation paths to understand how users interact with the Service. We also record the campaign or ad link that brought you (for example UTM tags or Google/Microsoft click IDs), and if you are logged in, or have saved an API key in this browser, we store it with your account. If you decline, or have not yet chosen, we do not collect this from your browser, with two exceptions. The first: every page you open sends a short presence signal, so that you appear on the visitor map. It carries your country (taken from Cloudflare's country header), your platform and a short code, calculated from your IP address and the date, that is used only for counting; nothing is stored on your device (see section 7.6). The second is a partner's referral link. If you arrive through a partner's referral link, we record that click (the page you landed on, your browser type, your approximate location and a hashed form of your IP address) so the partner can be credited.
• Approximate location and account-linked page views: Approximate location (your country, and the city you signed up from) is derived from your IP address via Cloudflare and stored with your account, to understand where our customers are. If we did not record your country when you signed up, we record the country we first see when you sign in or browse while signed in. If you are logged in, or have saved an API key in this browser, the pages you view are linked to your account. We keep this while your account is active.

3.3 Information from Third Parties

• Google / Firebase: If you sign in with Google, we receive your Google account email address and display name from Firebase Authentication.
• Stripe: Subscription status, plan tier, and billing information summary from Stripe webhooks when you subscribe or manage your subscription.

4. How We Use Your Data

We use the information we collect for the following purposes:

• Service delivery: To provide, operate, and maintain the API, dashboard, and associated services, including authenticating your identity and enforcing subscription tiers and rate limits.
• Account management: To create and manage your account, process payments through Stripe, send billing receipts, and notify you of account-related issues.
• Service improvement: To understand how users interact with our platform and where our customers are, identify bugs, and develop new features based on usage patterns.
• Security and fraud prevention: To detect and prevent unauthorised access, API abuse, and fraudulent activity. To keep the free plan to one per person, when a free account is created we compare the IP address and the browser user-agent string recorded at sign-up, and how similar the email address is, with other free accounts. Two free accounts are treated as one person, and share one free allowance, only on a strong match: the same IP address and the same user agent within 48 hours (within 60 minutes when that user agent is a very common browser string), or the same IP address within 30 days with near-identical email addresses before the @ sign. A weaker match, such as the same IP address alone, is only flagged for our review and links no one. A new free account that strongly matches two or more older free accounts receives no free API key until we review it. We record which rule matched so that we can review or undo a link; email [email protected] to ask for a review.
• Communications: To respond to your support requests and contact form submissions. We may also send infrequent product updates if you have an active account; you can unsubscribe at any time.
• Legal compliance: To comply with applicable legal obligations, respond to lawful requests from public authorities, and enforce our Terms of Service.

5. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

• Contract performance (Article 6(1)(b)): Processing necessary to provide the Service to you, including account creation, API access, and payment processing.
• Legitimate interests (Article 6(1)(f)): Processing for security, fraud prevention, service improvement, and analytics where our interests are not overridden by your rights.
• Legal obligation (Article 6(1)(c)): Processing required to comply with applicable laws and regulations.
• Consent (Article 6(1)(a)): For non-essential cookies and optional marketing communications, where you have given specific consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Data Sharing and Disclosure

We share your data only in the following circumstances:

• Service providers: We share data with trusted third-party service providers who assist us in operating the Service (see Section 7). These providers are bound by data processing agreements and may only use your data as directed by us.
• Legal requirements: We may disclose your data if required by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Smart Money API, our users, or the public.
• Business transfers: If Smart Money API is acquired, merged, or transfers assets, your data may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website before any transfer occurs.
• With your consent: We may share your data for any other purpose with your explicit consent.

We do not share individual user data with other users of the Service.

7. Third-Party Services

We use the following third-party services, each with their own privacy policies:

7.1 Firebase / Google (Authentication & Storage)

We use Firebase Authentication (provided by Google LLC) to manage user accounts and authentication. Firebase may collect device identifiers, IP addresses, and authentication event data. Firebase is covered by Google's Privacy Policy: policies.google.com/privacy. Data processed through Firebase may be stored in the United States. Standard Contractual Clauses (SCCs) apply for EEA users.

7.2 Stripe (Payment Processing)

All payment processing is handled by Stripe, Inc. (or Stripe Payments Europe Ltd. for EEA users). Stripe processes your payment card information in compliance with PCI DSS Level 1. Smart Money API never stores payment card numbers. Stripe's Privacy Policy: stripe.com/privacy.

7.3 Cloudflare (CDN & DDoS Protection)

Our website is served through Cloudflare's content delivery network. Cloudflare processes IP addresses, browser characteristics, and request headers for security and performance purposes. Cloudflare's Privacy Policy: cloudflare.com/privacypolicy.

7.4 Telegram (Optional Alerts)

If you configure Telegram bot alerts (Pro plan), your Telegram chat ID is stored securely and used only to deliver alerts you have configured. We do not access your Telegram message history.

7.5 Google Analytics 4 and Google Tag Manager (Google)

Google Tag Manager loads on most pages of this website before you make any cookie choice. Loading it is a request to Google, which therefore receives your IP address and browser details. Google Analytics 4 runs through it only after you accept analytics cookies, and then receives data about your visit: the address and title of the page you view, a random identifier stored in a cookie, your language and screen size, and your IP address. See our Cookie Policy and Google's Privacy Policy (policies.google.com/privacy).

7.6 Visitor map (location from Cloudflare)

You appear on the visitor map as a dot whether or not you accept analytics cookies. Each page you open on this site tells our server that you are online, and the page keeps doing so once a minute while it stays open on your screen. We do not send your IP address to any location service for this. If you have not accepted analytics cookies, the map shows only your country: our server reads it from the country that Cloudflare, which already handles every request to our site (section 7.3), attaches to the request, and the map draws you at the middle of that country. We use no city and no coordinates for you, nothing is stored on your device for this, and your browser sends no identifier and no location. If you accept analytics cookies, your approximate location also comes from Cloudflare: your country and, where Cloudflare provides them, an approximate latitude and longitude, which we round to 0.1 degree (about 11 km). We keep the rounded place, or just the country, for 5 minutes, together with your country, whether you use the website, iOS or Android, and a one-way code made from your IP address, a server secret and the date, which changes every day. We never store your IP address itself or the name of your city. During those 5 minutes the map shows you only as part of a count for your area, never as an individual entry, and visitors who share one network address are counted once. To avoid counting a visit twice, we also keep a similar one-way code made from your IP address and browser details for 2 days. We also add one to a plain count for your area and hour (see section 9). If you withdraw your consent, the map shows only your country from then on; your 5-minute record expires within 5 minutes and the 2-day code within 2 days. Counts already added stay, because nothing in them links back to you. The map also shows the approximate city of active connections to our API. For a request that carries an API key, our server reads the approximate latitude and longitude that Cloudflare attaches to the request, rounds it to 0.1 degree (about 11 km) and handles it like a visit to the website: the same kind of one-way code and the same 5-minute record, so on the live map an address that both browses the site and calls the API is one entry. The hourly counts are kept separately, so an address that does both can be counted once for each within the same hour. This does not depend on the cookie banner, which applies only to the website. Such a dot has no label saying that it comes from an API connection, and no account, API key or other identity is stored for it. Our own services appear together as one single point. When you click a dot, the map names the nearest large city from a list built into the page; nothing is sent to anyone for this.

8. Cookies and Tracking

We use cookies and similar technologies to operate the Service and improve your experience. For full details on the cookies we use and how to manage them, please see our Cookie Policy.

In summary:

• Essential cookies: Required for authentication, session management, and security. Cannot be disabled without breaking core functionality.
• Analytics cookies: Used to understand usage patterns. Can be declined via the cookie consent banner.
• Third-party cookies: Set by Stripe and Firebase for payment and authentication flows.

You can change your cookie choice at any time by clicking "Cookie Settings" in the website footer, or by adjusting your browser settings.

9. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy:

• Active accounts: Account data and preferences, including the approximate location stored with your account and the page views linked to it, are retained while your account is active.
• Visitor map: The online-now record (your country and, only if you accepted analytics cookies, your rounded location; also the platform and a daily-changing one-way code) is kept for 5 minutes. The duplicate-check code is kept for 2 days. Visit counts are kept per area of about 11 km and per hour for 30 days, then merged into areas of about 110 km per day and kept indefinitely. They contain no code or other link to a visitor. The approximate location of an active API connection is kept in the same way.
• API request logs: Detailed logs are retained for 90 days for debugging and security. Aggregate anonymised statistics are retained indefinitely.
• IP addresses: Full IP addresses are anonymised after 30 days. Anonymised records may be retained for security analytics.
• Billing records: Stripe payment and subscription records are retained for 7 years to comply with financial record-keeping obligations.
• Deleted accounts: Upon account deletion, your personal data (email, preferences, API keys) is deleted within 30 days. Anonymised aggregate analytics data may be retained. Records of linked free accounts are deleted with the account. The IP addresses in them are kept only as keyed hashes (one-way codes made with a server secret), never as the address itself.
• Contact form submissions: Retained for up to 2 years to track support history, then deleted.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right of access (Article 15 GDPR): Request a copy of the personal data we hold about you.
• Right to rectification (Article 16 GDPR): Request correction of inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Article 17 GDPR): Request deletion of your personal data where there is no overriding legal reason for us to continue processing it.
• Right to restriction of processing (Article 18 GDPR): Request that we restrict processing of your data in certain circumstances.
• Right to data portability (Article 20 GDPR): Receive your data in a structured, machine-readable format and have it transferred to another controller.
• Right to object (Article 21 GDPR): Object to processing based on our legitimate interests.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
• Right to lodge a complaint: Lodge a complaint with your national data protection authority (e.g., the ICO in the UK, or your local EU supervisory authority).

To exercise any of these rights, contact us via our contact form. We will respond within 30 days. We may ask you to verify your identity before fulfilling certain requests.

11. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• HTTPS/TLS encryption for all data in transit
• API keys hashed using bcrypt before storage
• Firebase Authentication industry-standard session management
• SQLite databases with restricted file system permissions
• Cloudflare DDoS protection and WAF
• Access controls limiting data access to the minimum required

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant supervisory authorities as required by law.

12. International Data Transfers

Smart Money API is operated from within the European Economic Area. However, some of our third-party service providers (including Google/Firebase and Stripe) process data in the United States. Where we transfer personal data outside the EEA or UK, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Binding Corporate Rules where applicable

You can request information about the specific transfer mechanisms we rely on by using our contact form.

13. Children's Privacy

Our Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us via our contact form and we will delete the data promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify registered users via email where changes significantly affect your rights
• Display a prominent notice on our website

We encourage you to review this policy periodically. Your continued use of the Service after changes become effective constitutes your acceptance of the revised policy.

15. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with a data protection authority. As we are established in Italy, the lead authority is the Garante per la protezione dei dati personali (garanteprivacy.it); EU/EEA users may also contact their local supervisory authority.