Privacy Policy

1. Data Controller

BDE Score™ (“we”, “us”, “our”) is the data controller for personal data collected through this service. This policy describes what data we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) and other applicable privacy laws.

2. Data We Collect

2.1 Account Data

• Email address — collected during waitlist signup or payment confirmation, used solely for account identification and communication
• Payment records — blockchain transaction hashes (tx_hash), wallet addresses, payment amounts, and timestamps; recorded to verify subscription status

2.2 Usage Data

• API usage logs — request timestamps, IP addresses (for rate limiting), and query parameters; retained for 30 days for abuse prevention
• API key metadata — key creation date, tier level, and active/inactive status

2.3 Data We Do NOT Collect

• No cookies or tracking pixels
• No browser fingerprinting
• No third-party analytics (no Google Analytics, no Mixpanel)
• No personal identification beyond email address
• No device information or location data

3. Purpose of Data Collection

We collect data exclusively for the following purposes:

• Service delivery — providing API access, verifying payments, managing subscriptions
• Abuse prevention — rate limiting, detecting unauthorized access, preventing fraud
• Communication — sending subscription confirmations and service-related notices

4. Data Storage & Security

• All data is stored locally on our own servers — no cloud third-party data processors
• Data is stored in encrypted SQLite databases with file-level access controls
• API keys are generated using cryptographically secure random number generation
• All connections are encrypted via TLS 1.3 (enforced by Cloudflare Tunnel with HSTS)
• No data is transferred outside the European Economic Area (EEA)

5. Data Sharing

The only exception is if required by law (e.g., a valid court order), in which case we will notify you unless legally prohibited.

6. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art.15) — request a copy of all data we hold about you
• Right to Rectification (Art.16) — correct inaccurate data
• Right to Erasure (Art.17) — request deletion of all your data (“right to be forgotten”)
• Right to Restrict Processing (Art.18) — limit how we use your data
• Right to Data Portability (Art.20) — receive your data in a machine-readable format
• Right to Object (Art.21) — object to processing of your data

7. Cookie Policy

8. Data Retention

• Email addresses: retained for the duration of your subscription + 90 days after expiration
• Payment records: retained for 1 year for audit purposes, then permanently deleted
• API usage logs: retained for 30 days, then automatically purged
• Analysis data: aggregate stock analysis results (not personal data) may be retained indefinitely

9. Children’s Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, please contact us for immediate deletion.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via our website. Continued use after changes constitutes acceptance of the updated policy.

11. Contact & Data Protection

For privacy-related inquiries, data requests, or complaints:

• GitHub: github.com/hbhqq9/bde-score
• Waitlist form: Available on our homepage

We are committed to resolving any privacy concerns promptly. If you are unsatisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority.