Privacy policy

Last updated: 9 October 2026

Who we are

MarketAPI ("we") runs MarketAPI, a market-data API and on-chain price oracle. We are responsible for the personal data described here. Questions or requests: use the contact form.

What we collect

• Account: your name, e-mail address, a hash of your password (never the password itself), and, if you turn it on, your two-factor sign-in secret and recovery codes (stored encrypted).
• API use: the API keys you create (stored as hashes), and for each request the time, endpoint, symbols, status, credits charged and IP address. We need these to bill correctly, apply rate limits and stop abuse.
• Payments: balances, top-ups and receipts. For crypto payments: the network, deposit address and transaction hash. Card payments are processed by Stripe or Paddle; we receive the payment result and the payment provider's reference, never your card number.
• Messages: what you send us through the contact form or support tickets, and newsletter subscriptions (only if you opt in).
• Technical data: server logs with IP addresses and browser type, kept for security and troubleshooting.
• Cookies: see Cookies below.

Why we use it (and our legal basis)

• To provide the service you signed up for, run your account and bill your usage: performance of a contract.
• To keep the platform secure, prevent fraud and abuse, and fix problems: legitimate interests.
• To keep accounting and tax records: legal obligation.
• To measure our website and advertising (Google Analytics / Google Ads), and to send newsletters: your consent, which you can withdraw at any time.

Who receives it

Only the service providers we need to run the platform: our server hosting provider, our e-mail provider, payment processors (Stripe, Paddle) when you pay by card, public blockchains when you pay in crypto (transactions are public by nature), and Google, only if you accept analytics and advertising cookies. We do not sell personal data.

Some of these providers may process data outside the UK or the European Economic Area. Where they do, they are bound by appropriate safeguards such as the standard contractual clauses.

How long we keep it

• Account data: while your account exists. You can ask us to delete it at any time.
• API request logs and server logs: as long as needed for billing, security and support, normally no longer than 12 months.
• Payment and invoice records: as long as accounting and tax law requires (in the UK, generally six years).
• Backups are encrypted and overwritten on a rolling schedule.

Your rights

You can ask for a copy of your data, its correction or deletion, to restrict or object to its use, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time (for cookies: Cookie settings). You also have the right to complain to a data protection authority; in the UK this is the Information Commissioner's Office (ico.org.uk).

Security

Passwords and API keys are stored only as hashes, two-factor secrets are encrypted, traffic is encrypted (HTTPS), and access to the servers is restricted. No system is perfectly secure; if a breach affecting you happens, we will tell you as the law requires.

Cookies

• Always on (essential): sign-in session, security token against forged requests, and your cookie choice itself. The site cannot work without them.
• Only with your permission: Google Analytics (how the site is used) and Google Ads (whether our ads lead to sign-ups and purchases). Until you accept, Google's tags store nothing on your device.

You can change your choice at any time: Cookie settings.

Children

The service is meant for developers and businesses and is not directed at children under 16.

Changes

We may update this policy. The date at the top shows the latest version; for important changes we will notify account holders by e-mail.