Privacy Policy

1. Who we are

Exchange Rate Management ("we", "us") operates exchangerate.management: a service that lets businesses publish their own currency exchange rates to their websites and in-store screens. This policy explains what information we collect, why, who processes it for us, and the choices you have. It covers our website, dashboard, widget, TV rate board, APIs, and MCP server (the "Services").

2. Information we collect

• Account information. Your email address and password (stored by our authentication provider in hashed form — we never see or store your plain password), and your subscription tier and status.
• Billing information. Payments are processed by Stripe. We store your Stripe customer reference and subscription status; your card details go to Stripe directly and never touch our servers.
• Your rate data. The currency pairs, buy and sell prices, settings, and API keys you create. These are business data you chose to publish; your public rates are, by design, visible to anyone your widget or board is shown to.
• Messages. If you use the contact form, we store your name, email address, topic, and message so we can reply.
• Usage data on our own website. Standard analytics on exchangerate.management (pages visited, approximate location, device and browser type) via Google Analytics and Google Tag Manager, plus Vercel’s hosting analytics; and standard server logs (IP address, request path, timestamp) kept for security and troubleshooting.
• Advertising measurement. We advertise on Google Ads and measure which ads lead to sign-ups and purchases. This uses Google’s cookies and identifiers on our own website, as described in Section 7.

3. Requests from your visitors’ browsers

When your website embeds our widget, or a screen shows your rate board, the visitor’s browser requests your current rates from our servers. Like any web request, that involves the requester’s IP address and standard request metadata, which appear in our short-lived server logs. We use them only to serve the request, keep the Services secure, and enforce rate limits — we do not build profiles of your visitors, and Section 4 lists what we deliberately avoid collecting.

4. What we deliberately do not collect

• No tracking on your website. The embeddable widget and the TV rate board set no cookies and run no analytics or advertising code on the sites and screens where you use them. The widget stores your latest rates in the browser’s local storage — on your own site, purely so a reloaded page can show rates instantly — and nothing else.
• No raw IP addresses in the contact form. Contact-form rate-limiting stores a salted one-way hash of the sender’s IP address, not the address itself.
• No selling of personal information. We do not sell or rent personal information, and we do not share it with anyone for their own marketing.

5. How we use information

• to provide the Services: authentication, serving your rates, billing;
• to respond when you contact us;
• to send transactional email (for example account, security, and billing notices). We do not send marketing email without your consent, and anything promotional would include an unsubscribe link;
• to understand how our website and product are used, and to measure advertising, so we can improve both;
• to keep the Services secure and enforce our Terms; and
• to comply with legal obligations.

Where the law of your jurisdiction requires a legal basis (for example in the EEA or UK): we process account, rate, and billing data to perform our contract with you; analytics, advertising measurement, and security on the basis of legitimate interests or your consent where required; and legal compliance where we are obliged to.

6. Who processes data for us

We share personal information only with the service providers that run the Services, each bound by its own data-processing terms:

• Supabase — authentication and database hosting (account and rate data);
• Stripe — payment processing and billing;
• Vercel — website hosting, content delivery, and hosting analytics;
• Google — analytics (GA4 via Google Tag Manager) and advertising measurement on our own website;
• Resend — delivery of transactional and contact-form email.

Beyond these providers, we disclose personal information only if required by law or legal process, to protect the rights, safety, or property of us, our customers, or others, or as part of a merger, acquisition, or sale of the Services — in which case the recipient must honour this policy.

7. Cookies and similar technologies

On exchangerate.management itself we use:

• Essential cookies — authentication session cookies (set by our Supabase integration) that keep you signed in to the dashboard. The Services cannot work without them.
• Analytics and advertising cookies — Google Analytics and Google Ads measurement, loaded through Google Tag Manager, and Vercel’s privacy-focused hosting analytics.
• Local storage — small application caches in your browser (for example your subscription tier, to avoid refetching it on every page).

You can block or delete cookies in your browser settings, and control Google’s advertising personalization at adssettings.google.com. Blocking essential cookies will prevent signing in. As Section 4 says, none of this applies to your own website: the widget places no cookies there.

8. Data retention

• Account and rate data: kept while your account is active. If you ask us to delete your account, we delete or anonymize your personal information within 30 days, except what we must keep for legal, tax, or accounting reasons (for example billing records, which Stripe and we retain as required by law).
• Contact messages: kept as long as needed to handle the conversation.
• Server logs: kept for a short operational window, then discarded.
• Analytics data is retained on Google’s standard retention settings for GA4.

9. Security

All traffic to the Services is encrypted in transit (HTTPS). Data is stored with established providers (Supabase, Stripe, Vercel) with access controls, and database-level row security restricts each account’s data to that account. Passwords are hashed by our authentication provider; card data is handled only by Stripe. No internet service can promise perfect security, but we design for the failure modes we can foresee and keep the amount of personal data we hold small — the best-protected data is data never collected.

10. Your rights

Depending on where you live (including under Canada’s PIPEDA, the EU/UK GDPR, and California’s CCPA), you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. You can:

• see and edit your rates, settings, and API keys in the dashboard;
• email info@exchangerate.management or use the contact form for anything else, including account deletion or a copy of your data.

We respond within 30 days. We may need to verify your identity first, and we will never require more information to verify you than we already hold. You also have the right to complain to your local data-protection authority (in Canada, the Office of the Privacy Commissioner).

11. International transfers

Our service providers store and process data in the United States and other countries, which may have different data-protection laws than yours. Where required, transfers rely on the providers’ safeguards, such as Standard Contractual Clauses in their data-processing agreements.

12. Children

The Services are for businesses and are not directed at children under 16. We do not knowingly collect personal information from children; if you believe we have, contact us and we will delete it promptly.

13. Changes to this policy

When we change this policy, we update the date at the top; if a change is material, we will notify you by email or a notice in the dashboard before it takes effect.

14. Contact

Privacy questions and requests: info@exchangerate.management or the contact form.