Last updated: January 15, 2026

Privacy Policy

This Privacy Policy explains how Pexafy ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our website and API. We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR).

1. Data Controller

Pexafy is the data controller for personal data processed through this Service, based in Paris, France. For any privacy-related inquiries, contact us at [email protected].

2. Data We Collect

Account Data

Email address — used for account creation, login, and communications
Password — stored as a bcrypt hash (never in plaintext)

Usage Data

API requests — timestamp, endpoint, response code (stored for 90 days)
Search queries — anonymized after 24 hours (no link to your account)

Technical Data

IP address — stored for security/rate-limiting (hashed in logs)
User-Agent — browser/client information
Session cookies — Django session ID for authentication

Contact Form Data

Name, email, subject, and message when you contact us
Retained for 1 year then deleted

3. How We Use Your Data

Provide the Service — authenticate you, process API requests, manage your subscription
Security — detect abuse, enforce rate limits, prevent unauthorized access
Communications — transactional emails (account-related, not marketing)
Analytics — anonymized, aggregated usage statistics to improve the Service
Legal obligations — comply with applicable law

4. Legal Basis (GDPR Article 6)

Purpose	Legal basis
Account management, API access	Performance of contract (Art. 6(1)(b))
Security, fraud prevention	Legitimate interest (Art. 6(1)(f))
Transactional emails	Legitimate interest / Contract performance
Analytics (anonymized)	Legitimate interest (Art. 6(1)(f))
Cookie consent	Consent (Art. 6(1)(a)) — for non-essential cookies only

5. Data Retention

Account data — retained until you delete your account
API usage logs — 90 days
Search queries — anonymized after 24 hours
Contact messages — 1 year
Billing records — 7 years (legal obligation)

We do not sell your personal data. We share data only with:

Stripe — payment processing (subject to Stripe's Privacy Policy)
Infrastructure providers — cloud hosting (data stored in the EU/France)
Legal authorities — only when required by law

7. Your GDPR Rights

Under the GDPR, you have the following rights regarding your personal data:

Right of access — request a copy of your data
Right to rectification — correct inaccurate data
Right to erasure — request deletion of your data ("right to be forgotten")
Right to portability — receive your data in a machine-readable format
Right to object — object to processing based on legitimate interest
Right to restrict processing — limit how we use your data

To exercise any right, email [email protected] with the subject "GDPR Request". We respond within 30 days. You may also contact your local data protection authority (in France: CNIL).

8. Cookies

We use only essential and functional cookies. See our Cookie Policy for details.

9. Children's Privacy

The Service is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us immediately.

10. International Transfers

Your data is processed and stored within the European Union (France). If any processing occurs outside the EU, we ensure adequate safeguards are in place (Standard Contractual Clauses or equivalent).

11. Security Measures

We implement appropriate technical and organizational measures to protect your data, including:

HTTPS/TLS encryption for all data in transit
bcrypt password hashing (cost factor 12+)
API keys hashed before storage
Redis sessions with short TTL
Regular security audits

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or in-app notice. Continued use of the Service after changes constitutes acceptance.

13. DPO Contact

For all data protection inquiries: [email protected]