Privacy

Who we are

The Belfort Data API (api.belfortagent.xyz), its documentation (docs.belfortagent.xyz) and its account website (data.belfortagent.xyz) are run by Belfort Research, a sole proprietorship based in Thailand (“we”). This page says what we collect, why, who else handles it, how long we keep it, and what you can ask us to do. Questions: support@belfortagent.xyz.

What we collect

If you have an account (card customers):

Your email address, to sign you in, to send sign-in codes and purchase emails, and to answer you.
Sign-in records. A sign-in code expires after 10 minutes and is stored only as a keyed hash. The request is deleted after 2 days. A session lasts 30 days or until you sign out, and we store only a hash of its token.
API keys. A hash of each key, its label and its first 12 characters, so you can tell your keys apart. The full key is shown to you once and never stored.
Usage. For each UTC day, the number of calls and the credits used, per key and per route. Our database keeps no record of each call, or of which companies you asked about.
Purchases. The pack, the price, the date, your country, the type of tax ID you gave (never its number), and Stripe’s references and receipt link. We never see or store your card number.
Your network address, as a keyed hash only, never the address itself: for the address you signed up from and for each sign-in request. We use it to limit sign-ups and sign-in codes per network.

If you pay per call with x402: there is no account. Your wallet address and each payment are public on the Base blockchain. For each payment, our server log keeps the network, the asset, the amount, the paying wallet address and the transaction hash. We don’t record x402 payments in our database. While you are calling, we count calls per paying wallet in the server’s memory, to apply the per-minute limit.

If you call a demo company with no key and no payment: we count calls per network (an IPv4 address without its last part, or the first half of an IPv6 address) in the server’s memory for an hour, to apply the hourly limit. When a network reaches the limit, that network is written once to our server log.

Every request passes through our hosting provider, Vercel. Its request logs record the address the request came from, the URL, the time and the client’s name. Our own log lines never contain request URLs, headers, API keys or email addresses.

How we use it

To run the service: sign you in, check keys, count and charge credits, show your balance, usage and receipts, handle withdrawals and refunds, prevent abuse, fix problems, answer support requests, and keep the records that tax and accounting law requires. We don’t sell your data, show ads, or use analytics or advertising trackers on the API, the documentation or the account website.

Who else handles it

Only these providers, each for its part of running the service:

Stripe takes card payments and issues receipts. It receives your email address and what you enter on its checkout page: card details, billing address, country and any tax ID.
Resend sends our emails: sign-in codes and withdrawal confirmations, and internal alerts to us about payments that need a person (a held purchase, a withdrawal to refund, a dispute), which carry account and payment references, the country and the amount, never your email address. It receives your email address and the message.
Vercel hosts the API, the documentation and the account website, so every request passes through it.
Supabase hosts our database, where account, key, usage and purchase records are kept.
Railway runs the nightly job that loads data from the SEC. That job works only with SEC data.
Coinbase verifies and settles x402 payments as the payment facilitator, and the Base blockchain records them publicly.

These providers may process data in the United States and other countries. We share data with anyone else only when the law requires it.

How we protect it

Every connection uses HTTPS.
Sign-in codes, session tokens and API keys are stored only as hashes, and network addresses only as keyed hashes, so a copy of the database reveals none of them.
On the account website, your session lives in a cookie that page scripts can’t read (httpOnly, Secure, SameSite=Lax). A new API key is shown once and never stored in your browser.
The documentation’s API console doesn’t save your key, and its server forwards only the key and the request, with no cookies, and logs nothing.
Access to the database is limited to the service itself and to us.
Card payments are handled entirely by Stripe, on its own checkout page.

Cookies and browser storage

The API and the documentation set no cookies. The documentation remembers your light or dark theme in your browser’s local storage.

The account website sets three cookies, all needed for it to work and none for tracking:

the session, for 30 days or until you sign out;
a pending sign-in, for 10 minutes, holding the sign-in request and your email address, so the code screen survives a reload;
the time you last opened checkout, for 2 hours, so the purchases page can show which purchases are new.

How long we keep it

Sign-in requests: 2 days. Sessions end after 30 days or when you sign out.
Account, key and usage records: while your account is open.
Purchase records: as long as tax and accounting law requires, also after an account is closed.
Our server log and Vercel’s request logs: for the time our hosting plan keeps logs.
Rate-limit counters: in the server’s memory only, for at most an hour.

Your choices

You can ask for a copy of your data, a correction, or the deletion of your account by writing to support@belfortagent.xyz from your account’s address. Purchase records stay as long as the law requires. Nobody, including us, can change or delete what a blockchain records. Depending on where you live, data protection law, such as Thailand’s Personal Data Protection Act, may give you further rights; write to us and we will help.

Changes

If this policy changes, we update this page and its version date. See also the terms.