Privacy Policy

Zero-Tracking & Cookieless Philosophy

NaxosData believes that institutional market data infrastructure must maintain absolute user privacy. We do not use third-party marketing trackers, advertising cookies, behavioral fingerprinting scripts, social media tracking pixels, or cross-site analytics beacons.

Client preferences—such as active subscription tier previews, dashboard layout filters, and local inspection states—are maintained locally in your browser sandbox using standard client-side storage (localStorage) and are never transmitted to advertising networks or data brokers.

Account Registration & Billing Information

When you register an account or provision API keys for NaxosData tiers (Hobbyist, Quant Pro, or Institutional), we collect the minimum business contact details required to securely authenticate your requests and maintain service continuity:

• User institutional or individual email address
• Cryptographically salted password hashes (one-way bcrypt hashing; plaintext passwords are never stored or transmitted)
• Six-digit time-based email verification tokens
• Declared quantitative trading or academic research use case

Payment processing is conducted through certified, PCI-DSS compliant payment gateways. NaxosData does not store, process, or transmit full credit card numbers, CVVs, or bank routing credentials on our internal application servers.

API Telemetry, Quotas & Operational Logs

To enforce tier rate limits (60 req/min for Hobbyist, 360 req/min for Quant Pro, 1,800 req/min for Institutional), track monthly historical Level 2 row export quotas, and protect our infrastructure from distributed denial-of-service (DDoS) attacks, our edge gateways record operational request metadata:

• SHA-256 hashed API key identifier
• HTTP method, request URI path, and query parameters
• Originating IP address and autonomous system number (ASN) for edge routing
• Response HTTP status code, payload byte size, and round-trip execution latency in milliseconds (X-Naxos-Latency-Ms)

Operational ingress logs are retained on an automated rolling 14-day schedule strictly for performance optimization, abuse mitigation, and security diagnostics, after which they are permanently expunged.

Seven-Venue Feeds & Public Ledger Data

NaxosData normalizes and archives public prediction market information across all seven supported trading venues: Polymarket, Kalshi, ForecastEx (IBKR), Limitless, PredictIt, Drift BET, and Smarkets.

Information served via our Trades Tape, Whale Tracker, and Apache Arrow Parquet historical archives—including transaction hashes, public smart contract event logs, public pseudonyms, and on-chain Polygon/Base/Solana wallet addresses—constitutes inherently public blockchain and exchange orderbook data.

NaxosData does not combine public wallet addresses with personal customer account records, and we do not engage in off-chain real-world identity de-anonymization.

Open-Source Runtimes, SDKs & MCP Servers

Our open-source client libraries (naxosdata on PyPI, @naxosdata/sdk on npm) and Model Context Protocol servers (kalshi-mcp-server, @naxosdata/polymarket-mcp-server) execute locally within the subscriber's computational environment or AI agent harness (e.g., Cursor, Claude Desktop).

All exchange API keys, private wallet keys, or trading environment variables configured locally in these tools remain strictly on your local machine. NaxosData client libraries contain zero telemetry backdoors, telemetry spyware, or credential exfiltration mechanisms.

Data Retention, GDPR & CCPA Rights

Under the European General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and applicable global data privacy statutes, you possess explicit legal rights regarding your account information:

• Right of Access: Request a full, machine-readable export of all stored personal profile data.
• Right to Rectification: Update or correct inaccurate account credentials at any time.
• Right to Erasure ("Right to be Forgotten"): Request permanent purging of your account, API keys, and associated telemetry logs.
• Right to Restriction of Processing: Restrict marketing communications and non-essential telemetry.

Erasure requests are acknowledged within 24 hours and fully executed across active production databases and backup snapshots within 48 business hours.

Data Security & Cryptographic Standards

All data in transit across NaxosData endpoints is enforced via modern Transport Layer Security (TLS 1.3) with strict cipher suite requirements. HTTP requests on insecure channels are automatically redirected to encrypted endpoints with HSTS (HTTP Strict Transport Security) headers.

API authentication secrets and session credentials stored at rest are encrypted using AES-256-GCM. Production clusters are firewalled with isolated internal networks and least-privilege role-based access controls.