Privacy Policy

NodeFlare (“we”, “us”, “our”) operates the NodeFlare API platform and dashboard at nodeflare.app. We are the data controller for personal data collected through the platform.

For any privacy-related questions or to exercise your rights, contact us at [email protected]. We aim to respond within 5 business days.

We collect only the data necessary to operate the Service:

• Account data — email address and display name provided when you register. Stored and managed by Clerk, our authentication provider.
• Billing data — payment method type, last four digits, billing address, and transaction history. Full card numbers are never stored by NodeFlare; they are processed directly by Stripe.
• API usage counters — the number of requests made per chain per calendar month, keyed to your API key. We do not log request bodies, response bodies, wallet addresses, transaction hashes, or any blockchain data you query.
• Technical logs — IP address, user-agent string, and request timestamp, retained for 7 days exclusively for security and abuse prevention purposes.
• Communication data — emails you send to our support or legal addresses, retained for as long as necessary to resolve the matter.
• Cookie data — a session cookie set by Clerk for authentication, and an optional consent preference cookie. See Section 08 for details.
• Analytics data — only if you accept analytics cookies, Google Analytics collects pseudonymous usage data (pages viewed, on-site events, approximate region, and device/browser type) so we can understand how the site is used. It is never linked to your account, API key, or any blockchain data you query. If you decline, no analytics data is collected. See Sections 07 and 08.

We do not collect or process special-category personal data (e.g., health data, biometric data, political opinions).

• To provision, operate, and deliver the NodeFlare API service.
• To authenticate you and maintain your session.
• To process subscription payments and issue invoices.
• To enforce per-plan rate limits and monthly usage quotas.
• To send transactional emails: account creation confirmation, invoice receipts, plan change confirmations, and service status alerts.
• To detect, investigate, and prevent abuse, fraud, or violations of our Terms of Service.
• To respond to your support or legal enquiries.
• To measure aggregate, pseudonymous website usage so we can improve the site — only where you have accepted analytics cookies.

We do not use your data for advertising, profiling, or any purpose not listed above. We do not sell or rent your personal data to any third party.

We process your personal data under the following lawful bases as defined in Article 6 of the GDPR:

• Contract (Art. 6(1)(b)) — processing your account, billing, and usage data is necessary to perform the service contract you entered into when you created your account.
• Legitimate interest (Art. 6(1)(f)) — short-term server logs for security monitoring, abuse detection, and infrastructure stability. Our interest in securing the platform does not override your privacy rights given the minimal nature of this data and the short retention period.
• Consent (Art. 6(1)(a)) — non-essential cookies, where you have provided consent via the cookie banner. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — retention of billing records for the period required by Dutch tax law.

• Account data — retained for the lifetime of your account. Deleted within 30 days of account closure, except where a longer retention period is legally required.
• Usage counters — current-month counts are reset at the start of each billing cycle. Aggregated monthly totals are retained for 12 months to support billing queries.
• Technical logs — deleted automatically after 7 days.
• Billing records — retained for 7 years as required by Dutch tax and accounting legislation.
• Support correspondence — retained for up to 2 years or until the matter is resolved, whichever is later.

We share your personal data only with the sub-processors listed in Section 07 and only to the extent necessary to operate the Service. We do not sell, rent, or broker your data to any other party.

We may disclose personal data if required to do so by law, a binding court order, or a legitimate request from a competent regulatory authority. Where legally permissible, we will notify you before complying.

We use the following sub-processors to deliver the Service. Each operates under a data processing agreement and appropriate safeguards for international transfers (Standard Contractual Clauses where applicable):

• Clerk (US) — authentication, user management, and session handling. Privacy policy →
• Stripe (US) — payment processing, billing, and invoicing. Privacy policy →
• Cloudflare (US) — infrastructure, DDoS protection, CDN, and KV storage. Privacy policy →
• Vercel (US) — web application hosting and edge delivery. Privacy policy →
• Google (US) — Google Analytics, for pseudonymous website-usage measurement. Loaded only after you accept analytics cookies. Privacy policy →

We use a minimal set of cookies. Functional and security cookies are always active; analytics cookies load only after you accept them via the banner:

• __session — set by Clerk. Required for authentication. Session-scoped; deleted when you sign out or your session expires. This cookie cannot be disabled without breaking login functionality.
• __client_uat — set by Clerk. Stores an unsigned timestamp used to detect active sessions without sending the full session token. Session-scoped.
• nf_cookie_consent — stores your cookie banner preference (accepted / declined). Expires after 365 days. Set only after you interact with the banner.
• _ga / _gid — set by Google Analytics to measure website usage under a pseudonymous identifier. Set only after you accept analytics cookies; _ga expires after 2 years, _gid after 24 hours. If you decline, these are never set.

You can remove or block cookies at any time via your browser settings. Blocking the Clerk session cookies will prevent you from logging in to the dashboard.

Under the GDPR, you have the following rights regarding your personal data. To exercise any of them, email [email protected]. We will respond within 30 calendar days.

• Right of access (Art. 15) — request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17) — request deletion of your account and associated personal data, subject to legal retention obligations.
• Right to restriction (Art. 18) — ask us to pause processing of your data in certain circumstances.
• Right to portability (Art. 20) — receive your data in a structured, machine-readable format.
• Right to object (Art. 21) — object to processing based on our legitimate interests.
• Right to lodge a complaint — file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

We implement appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, or unauthorised disclosure:

• All data in transit is encrypted using TLS 1.2 or higher.
• API keys are stored as hashed values; we cannot retrieve a key after initial display.
• Access to production systems is restricted to authorised personnel and protected by multi-factor authentication.
• We conduct periodic security reviews of our infrastructure and third-party dependencies.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by the GDPR.

We may update this Privacy Policy from time to time. For material changes we will provide at least 14 days’ advance notice by email before the revised policy takes effect.

The “Last updated” date at the top of this page always reflects the most recent revision. We encourage you to review this policy periodically.