Privacy Policy

1. Who we are

iGregulator is operated by Anatolii Ohorodnyk, registered as autónomo (self-employed) in Spain, Av. Los Pescadores 6, 38686 Alcalá, Spain. For data-protection purposes, you can reach us at privacy@igregulator.io.

2. What data we collect

We collect the minimum necessary to operate the Service:

• Account data — email, hashed password, timestamps of account creation and last login, and how you reached the sign-up form: the page of ours you came from, or the name of the site that sent you (its host only, never the full address).
• Billing data — only when you request an invoice from your account's Billing page: company name, contact person (optional), street address, city, postal code, country, VAT or tax ID, billing email, PO number (optional), and the plan and period you asked for. We use it to issue and keep your invoice. We receive no card data.
• Card subscriptions — when you pay by card, Paddle (§5) collects your card and billing details on its own checkout. From Paddle we receive your Paddle customer and subscription IDs, the plan and billing period, the subscription's status and the payment's dates and amounts — never the card number.
• API usage logs — endpoint name, timestamp, hashed IP, response status, response time, plan tier, request source (HTTP vs. MCP gateway). The IP is hashed with a per-deployment salt so logs are not directly attributable.
• Webhook + watchlist configuration — endpoint URLs you submit, signing secrets, watchlist operator slugs.
• Webhook delivery records — request body, response code, timestamp, retry state. Retained 30 days for replay support.
• Cookies + analytics — see §6.

3. How we use it

• Service delivery — authenticating API calls, enforcing rate limits, billing, sending operational email.
• Security — detecting abuse, investigating compromise, blocking malicious traffic.
• Analytics — aggregate usage statistics for product decisions; we do not sell or share usage data with third parties for marketing.
• Compliance — meeting our own legal obligations (tax records, anti-fraud).

4. Legal bases (GDPR Art. 6)

• Contract — to provide the Service you've subscribed to (account, API access, billing).
• Legitimate interests — abuse detection, security, basic product analytics.
• Legal obligation — financial record-keeping under Spanish law.
• Consent — non-essential cookies, marketing communications (where applicable).

5. Third parties / sub-processors

We share personal data only with the following sub-processors, each under a Data Processing Addendum:

• Cloudflare, Inc. — DDoS protection, CDN, DNS for igregulator.io and subdomains.
• Xolo — invoicing and accounting: the billing data of an invoice request (§2), when we issue your invoice.
• Paddle (Paddle.com Market Ltd, United Kingdom, and its affiliates) — our reseller and Merchant of Record for card payments. Paddle processes the payment, billing and tax data you give its checkout as an independent controller under its own privacy notice; we send it your account's email and ID to open the checkout.
• Resend (Resend.com) — transactional email (account verification, password reset, notices that a plan is ending or was renewed).
• Google LLC (Google Analytics 4) — anonymous traffic analytics, Consent Mode v2 enabled. Only fires after explicit opt-in via the consent banner.
• GitHub Container Registry (Microsoft) — software image hosting; no customer data.

6. Cookies

We use a minimum of strictly necessary cookies (auth session, CSRF tokens), plus igr_signed_in=1 on .igregulator.io while you are signed in to the app, so this site can link you straight back to it; it holds no identifier. Optional analytics cookies (Google Analytics) fire only after opt-in via the consent banner. You can revoke consent at any time by clearing site data or using the cookie banner re-prompt.

7. International transfers

Some sub-processors (Cloudflare, Google, Resend) are based in the United States, and Paddle in the United Kingdom. Transfers occur under Standard Contractual Clauses (SCCs) or equivalent EU-approved mechanisms. iGregulator's primary infrastructure is hosted in the EU.

8. Retention

• Account data — kept while your account is active. After cancellation, retained up to 7 years for tax / accounting compliance under Spanish law (LGT art. 66, Codigo de Comercio art. 30).
• API request logs — 12 months, then aggregated into monthly counters (no per-request rows kept).
• Invoice requests — while your account is active; the data on an invoice we issued is kept with our tax records (up to 7 years, as above).
• Card subscription records (Paddle IDs, plan, status, dates) and the payment notifications Paddle sends us — kept with our tax records (up to 7 years, as above).
• Webhook delivery records — 30 days.
• Webhook events (replay queue) — 30 days.
• Backups — encrypted snapshots retained up to 90 days for disaster recovery.

9. Your rights (GDPR Art. 15-22)

As a data subject you have the right to:

• Access a copy of your personal data;
• Rectify inaccurate data;
• Erase your account and associated data, subject to retention obligations above;
• Port your data in a machine-readable format;
• Restrict or object to processing based on legitimate interests;
• Withdraw consent for any processing based on consent;
• Lodge a complaint with the Spanish Data Protection Agency (AEPD, aepd.es) or your local supervisory authority.

To exercise any of these rights, email privacy@igregulator.io. We respond within 30 days.

10. Children

The Service is not directed at and not intended for individuals under 18. We do not knowingly collect personal data from children. If we become aware we have collected data from a minor, we delete it promptly.

11. Security

Personal data is encrypted in transit (TLS 1.3) and at rest. Account passwords are hashed with bcrypt; API keys are hashed with SHA-256. We follow the principle of least privilege internally; only the founder has production data access today. Security incidents affecting personal data are reported to the AEPD within 72 hours where required by GDPR Art. 33.

12. Changes to this policy

Material changes are announced via the changelog and to active subscribers by email at least 30 days before taking effect.