Privacy Policy

1. Who is responsible for your data

The data controller for LiMiT Quant is:

2. Scope

This policy applies to our website (limitquant.com), dashboard UI, and our API endpoints (served under the /quant/api/ path), including the API documentation pages.

3. Personal data we collect

3.1 Data you provide

• Account data: email address and password you set when creating an account. (Passwords should be stored hashed on the server — never in plain text.)
• Support/contact data: name, email, and message content submitted via the contact form (including payment reference + transaction hash when you paste them).
• Payment verification data: payment reference you generate and transaction hash you provide so we can verify a manual crypto payment.
• Affiliate/referral data: if you arrive with a referral code in the URL (e.g. ?aff=CODE or ?ref=CODE), we may record that referral for attribution.

3.2 Data we collect automatically

• Log and device data: IP address, user agent, timestamps, pages/endpoints accessed, and error logs (typical for security and debugging).
• Session data: cookies used to keep you signed in and to support credits/unlocks (website session authentication).
• Local storage data: your browser may store your API key locally (for convenience) and other UI preferences.
• Usage data: actions like unlocking a pair (credits), viewing unlocked tickets, or calling API endpoints.

3.3 Public blockchain data

Blockchain transactions (e.g., a transaction hash) are public. If you provide a transaction hash or wallet address for verification, that information can be publicly visible on the blockchain network you used.

4. Why we use your data

• Provide the Service: create accounts, authenticate sessions, show credits balance, and manage unlocked pairs.
• Key-based access + API: verify keys, authorize full endpoints, and prevent abuse.
• Payments and verification: generate payment references and verify manual crypto payments.
• Support: respond to contact requests and troubleshoot onboarding/API issues.
• Security: prevent fraud, detect abuse, and protect infrastructure.
• Operations: maintain logs needed for reliability, debugging, and service integrity.

5. Legal bases (GDPR)

When GDPR applies, we rely on the following legal bases depending on context:

• Contract necessity: to provide access you request (account, credits/unlocks, keys, API access).
• Legitimate interests: security, abuse prevention, service reliability, and basic attribution (referrals), balanced against your rights.
• Legal obligation: to comply with accounting/tax or lawful requests where required.
• Consent: where we explicitly ask for it (for example, optional cookies if you implement a cookie banner in the future).

6. Who we share data with

We do not sell your personal data. We may share data with:

• Infrastructure and security providers: e.g., CDN/WAF services (commonly Cloudflare) used to protect and deliver the site.
• Email delivery providers: to send verification emails and password reset links.
• Hosting/ops vendors: servers/databases used to run the dashboard and API.
• Legal authorities: if required by law or to protect rights/safety.

7. International transfers

Some vendors (CDNs, font/asset CDNs, email providers) may process data outside the EEA. Where required, transfers are protected using appropriate safeguards (e.g., contractual clauses) depending on the vendor and context.

8. Cookies, local storage, and third‑party assets

8.1 Essential cookies

We use essential cookies for session management (sign-in, credits/unlocks) and security. Without these, core features may not work.

8.2 Local storage

The dashboard may store certain values in your browser’s local storage (for example, an API key you paste for convenience). You can clear local storage in your browser settings to remove this data.

8.3 Third‑party asset CDNs

Our pages may load assets from third parties such as Google Fonts and the Tailwind CDN. When your browser requests these assets, those providers may receive technical data like your IP address and user agent as part of delivering the files.

9. Data retention

• Account data: kept while your account is active and as needed to provide the Service.
• Support messages: kept as long as needed to resolve issues and maintain support history.
• Payment verification records: kept as needed for fraud prevention and operational/accounting purposes.
• Logs: kept for a limited period appropriate for security and debugging.

You can request deletion where applicable — see “Your rights” below.

10. Security

We use reasonable technical and organizational measures to protect data (access controls, least privilege, monitoring, and secure handling of credentials). No system is perfectly secure; please use a strong password and protect your API keys.

11. Your rights (GDPR)

Depending on your location and applicable law (including GDPR), you may have rights to:

• Access your personal data
• Correct inaccurate data
• Request deletion (where applicable)
• Restrict or object to processing (in certain cases)
• Data portability (in certain cases)
• Withdraw consent where processing is based on consent

To exercise rights, email [email protected].

You also have the right to lodge a complaint with your local data protection authority. In Romania, this is ANSPDCP.

12. Children

The Service is not intended for children. If you believe a child provided personal data, contact us to remove it where applicable.

13. Changes to this policy

We may update this policy. The “Last updated” date and version at the top of this page will change accordingly. If changes are material, we may provide additional notice in the dashboard.

14. Contact

Privacy questions: [email protected]