Privacy Policy

Effective Date: March 1, 2026 · Last updated: October 15, 2026

This Privacy Policy describes how Regime Intelligence ("Company", "we", "us") collects, uses, and protects your personal information when you use our API and related services ("Service").

1. Information We Collect

Account Information

• Email address — required for account creation and communication.
• Name — provided during registration for account identification.

Usage Data

• API usage logs — endpoint called, timestamp, response status, and tier. Used for rate limiting, billing, and service improvement.
• IP addresses: used for rate limiting, abuse prevention and security monitoring, and recorded with your email-preference choices. Our analytics and infrastructure providers also receive them (see Section 3). We do not use them for advertising. When you register we also record the country your connection appears to come from, so we know which privacy laws apply to our users.
• Browser details (user agent): recorded with your email-preference choices and may appear in server logs.

Payment Information

• Payment processing is handled entirely by Stripe. We do not store credit card numbers, bank account details, or other financial instrument data on our servers. We receive only a confirmation of payment status and subscription tier from Stripe.

2. How We Use Your Data

• Service delivery — authenticating API requests, enforcing rate limits, delivering data to your applications.
• Billing — processing subscription payments, managing tier upgrades/downgrades, sending invoices.
• Usage analytics — understanding API usage patterns to improve performance and plan capacity.
• Communication — sending service announcements, security alerts, billing notifications, and onboarding emails. We do not send marketing emails without your explicit consent.
• Security — detecting abuse, preventing unauthorized access, and protecting the integrity of the Service.

2A. Legal Bases (UK and EEA Users)

• Your account, the Service and billing: necessary to perform our contract with you.
• Rate limiting, security, abuse prevention and usage logs: our legitimate interests in running a secure and reliable service.
• The weekly Regime brief and any other marketing email: your consent, which you can withdraw at any time.
• Payment and tax records: our legal obligations.

2B. Business Contacts We Approach

If you work for a fund, trading desk or data buyer, we may write to your work email address to tell you about the Regime Data Feed, even though you have not used our service.

• What we hold: your name, firm, role and work email address, and a note of where we found them.
• Where it comes from: public professional sources, such as your firm's website, professional profiles and public code or research. Our first email names the specific source.
• Why, and on what basis: to offer a data licence to businesses that may use it. For UK and EEA recipients the basis is our legitimate interest in selling to businesses; you can object at any time and we will stop.
• How long: until you tell us to stop, or for 12 months after our last email if you never reply, whichever comes first. If you ask us not to write again, we keep your address on a do-not-contact list so that we do not.
• Who sees it: our email provider and the people who run Regime. We do not sell or share it with third parties for their own marketing.

To object, ask for a copy, or have your details removed, reply "no" to any of our emails or write to [email protected]. You can also complain to the UK Information Commissioner's Office or your local data protection authority.

3. Service Providers

We use the following service providers to run the Service. They process personal data on our behalf to provide their services to us, except where noted.

• Hetzner Online GmbH (hetzner.com): hosts our servers and databases in Nuremberg, Germany. Hetzner Privacy Policy.
• Cloudflare (cloudflare.com): CDN, DDoS protection, TLS termination and the secure tunnel to our servers. All requests to the Service pass through Cloudflare, which processes request metadata such as IP address and headers. Cloudflare Privacy Policy.
• Stripe (stripe.com): payment processing. Stripe's privacy policy governs payment data handling. Stripe Privacy Policy.
• Resend (resend.com): delivers our email, including account emails (such as API key delivery and billing notices) and, if you have subscribed, the weekly Regime brief. Resend Privacy Policy.
• Nexus Growth Engine: a business under common ownership with Regime. Its email system sends some issues of the weekly Regime brief to subscribers who have opted in.
• PostHog (posthog.com, United States hosting): product analytics. PostHog records the pages you view and the actions you take on our website, and once you register it links them to your account ID and plan. Since October 14, 2026 we no longer send it your email address or name; profiles created before that date may still hold them until we remove them. Since October 15, 2026 its code on our pages stores nothing in your browser (no cookie, no local storage), so it can link your activity only while a page stays open. PostHog Privacy Policy.
• Plausible Analytics (plausible.io): cookie-free website traffic statistics that do not identify you. Plausible Data Policy.

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

4. Data Retention

• Account data (email address, name, plan, hashed API keys): kept until you ask us to delete your account.
• API usage logs (endpoint, time, response status and response time, linked to your account): kept for 90 days, for rate limiting, billing, support and capacity planning. After that we keep only a count of your requests per day, with no endpoint detail, for as long as your account exists.
• Email preferences: if you subscribe to the weekly brief, we keep a record of what you agreed to, when, and the IP address and browser details at that moment, for as long as we rely on that consent and afterwards for as long as we may need to show what you agreed to. If you unsubscribe, we keep a record of that so that we do not email you again.
• Feedback you send us: kept until you ask us to delete it or delete your account.
• Server logs: may record IP addresses. We keep them only as long as we need them to operate and secure the Service.
• Payment records: retained as required by tax and accounting regulations (typically 7 years), managed by Stripe.

5. Your Rights

Regardless of your location, we provide the following rights to all users:

Right to Access

You can request a copy of all personal data we hold about you. We will provide this in a structured, machine-readable format (JSON) within 30 days.

Right to Deletion

You can request deletion of your account and all associated personal data. Upon request, we will:

• Delete your account and API keys immediately.
• Delete usage logs within 30 days.
• Retain only data required by law (e.g., payment records for tax compliance).

Right to Export

You can request an export of your data in JSON format, including your account information and usage statistics.

Right to Correction

You can request correction of any inaccurate personal data we hold about you.

Right to Object

You can opt out of non-essential communications at any time by contacting us or using the unsubscribe link in any email.

Right to Withdraw Consent

Where we rely on your consent (for example, the weekly brief), you can withdraw it at any time using the unsubscribe link in any email or by contacting us. This does not affect anything we did before you withdrew.

Right to Complain

If you are in the United Kingdom or the European Economic Area, you can complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, the authority in the country where you live or work. We would appreciate the chance to address your concern first.

6. Data Security

We implement the following security measures to protect your data:

• All API communication is encrypted via HTTPS/TLS.
• API keys are hashed before storage — we cannot retrieve your original key after issuance.
• Database access is restricted and not exposed to the public internet.
• Infrastructure is protected by Cloudflare's DDoS mitigation and WAF.

For full details on our security practices, see our Security page.

7. Where Your Data Is Stored and International Transfers

Regime is operated from the United States. Our application servers and databases, which hold your account details, API usage logs and email preferences, are hosted by Hetzner Online GmbH in a data centre in Nuremberg, Germany. We administer them from the United States.

Some of the service providers listed in Section 3 process personal data in the United States and other countries. These include Cloudflare, which handles all traffic to the Service through its global network, as well as Stripe, Resend and PostHog. Where personal data of people in the United Kingdom, the European Economic Area or Switzerland is transferred to the United States, we rely on the provider's certification under the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. Data Privacy Framework where the provider is certified. Otherwise we rely on the standard contractual clauses (with the UK International Data Transfer Addendum for UK data) in that provider's data processing terms.

You can ask us for more information about these safeguards, or for a copy of the relevant terms, using the contact details in Section 10.

8. Children's Privacy

The Service is not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from children. If we learn we have collected data from a child under 18, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post any change on this page and update the date above. If a change materially reduces your rights or changes how we use your personal data, we will also email account holders at least 14 days before it takes effect.

10. Contact Us

For privacy-related requests, questions, or data access/deletion requests, contact:

Regime Intelligence
Gunnar Thorderson, Data Controller
Email: [email protected]

We will respond to all data requests within 30 days.