Privacy policy

Who we are

Narwhal API at narwhalapi.com is operated by Nusantara Ventures, LLC, a Delaware limited liability company. We are the controller of the personal data described here. Our address is 1401 Pennsylvania Ave STE 105 #1776, Wilmington, DE 19806, United States.

This policy covers your use of our website, dashboard, API and MCP endpoint. It concerns information that identifies you or can be linked to you, rather than the market data returned by the service.

We follow the EU and UK GDPR, California Consumer Privacy Act as amended by the CPRA, and Indonesia’s Personal Data Protection Law, UU 27/2022, where applicable.

What we collect

You sign in only through Google or GitHub. We receive your account identifier and basic profile information consisting of your email address.

We process API request and WebSocket connection metadata, including IP addresses, quota usage, security events and website logs. We also process support emails, email delivery records, webhook endpoint URLs and webhook delivery records.

API keys are stored only as a one-way hash plus a short display prefix. Only our API sends error reports and request timings. They leave out your identity, IP address, request content and local variables, and credentials are removed. MCP requests use your API key and count toward the same daily and monthly usage totals as REST requests. We do not store MCP request or response content.

Stripe collects your card details. We receive billing identifiers and status, your billing address and tax ID if provided, and the payment method’s last four digits. We never receive full card numbers or security codes.

These categories include identifiers, customer and billing records, communications and internet activity. Their sources are you, your service interactions, sign-in providers and Stripe.

How we use it and our legal bases

We use account data, request metadata, quota usage, billing information and communications to provide our services. These include your account, API access, WebSocket connections, webhooks, billing and support. Our basis is performing our contract with you.

We use operational records for security, abuse prevention and service improvement. We also use them to understand how people find us. Our basis is legitimate interests, balanced against your rights.

We retain required billing records to meet tax and accounting obligations. Our basis is legal obligation.

We send service and account emails about your account, billing and quota. We also send three optional account emails:

• A reminder to make your first API call after signup.
• A monthly summary of your own usage.
• One reminder after 30 days without use.

To turn off all three types of optional email, follow the unsubscribe link in the email and confirm on the page it opens, or use one-click unsubscribe in a supported email app. Unsubscribing stops all three optional emails. Account and quota notices continue. We do not send promotional emails or emails about other products.

Required account information enables authenticated access. Without it, we cannot provide your account.

Who we share it with

Our providers are:

• Google: account identifier and email address.
• GitHub: account identifier and email address.
• Supabase: account data, API key hashes and prefixes, usage and quota records, and billing identifiers.
• Fly.io: API and WebSocket request metadata, including IP addresses.
• Cloudflare: website request metadata, including IP addresses.
• Sentry: Receives error reports and request timings for monitoring, with the request method, route and status. It does not receive your identity, IP address or request content, and credentials are removed.
• Resend: email address, message content and delivery events.
• Stripe: payment processing.

Google, GitHub and Stripe also explain their own processing in their privacy notices. We may also disclose personal data only where the law requires it, to protect our rights, users or the service, or in connection with a merger, acquisition or sale of the business.

We do not sell your personal data, share it for cross-context advertising or use it to train third-party AI models.

Cookies and analytics

We use a Supabase sign-in cookie that lasts up to 400 days and uses SameSite=Lax. The narwhal_locale cookie remembers your language for 30 days. We do not use local storage. Session storage holds only your new API key, shown once after your first sign-in, with your user id and a timestamp, and a team-invite token while you accept an invite. Both are cleared after use.

We do not use analytics, advertising or session-recording tools.

You can block or delete cookies through your browser. Blocking the sign-in cookie may prevent authenticated access. Website logs remain part of the operational processing described above.

How long we keep it

Webhook delivery records are retained for 30 days. Billing records are retained as tax and accounting law requires.

Other retention periods are:

• Account data: while your account is open and as needed for legal obligations, then deleted.
• API and WebSocket metadata and quota usage: while your account is open and as needed for legal obligations, then deleted.
• Security and website logs: Our hosting and network providers keep these for their standard log periods, then delete them automatically.
• Error records: Our error-monitoring provider keeps these for its standard retention period, then deletes them automatically.
• Email delivery records: while your account is open and as needed for legal obligations, then deleted.
• Support emails: We keep these while needed to handle your request and keep a record of it. We delete them when they are no longer needed for support, security or legal reasons.
• Webhook endpoint URLs: while your account is open and as needed for legal obligations, then deleted.
• MCP records: we do not store MCP request or response content. MCP requests appear only in the usage totals above.
• Database backups: Our database provider keeps these for its standard backup period, then overwrites them automatically.

When your account is deleted, we delete API keys, usage records, webhooks, email delivery records, team memberships and billing rows, then your sign-in record. We keep only a one-way hash of your account identifier to prevent repeat free-key sign-ups. Stripe keeps its own invoice records under its own obligations.

Your rights and choices

Your rights depend on the law that applies and its exceptions. You can contact us to request access, correction, deletion or a portable copy, restrict processing, or object to processing based on legitimate interests. You can withdraw consent without affecting earlier lawful processing.

Email the address below to exercise your rights. We may ask you to confirm your request from the email address on your account before we act. An authorised agent must show written permission to act for you. We respond within applicable legal deadlines and explain any lawful refusal.

If you are in the EU or UK, you can complain to your local data protection authority or the UK’s Information Commissioner’s Office. You also have applicable safeguards concerning significant automated decisions. See the ICO’s guide to your rights.

California residents can request details of collection, use and disclosure, access, correction and deletion. You can use an authorised agent and exercise rights without unlawful discrimination. Sale and cross-context advertising opt-out rights apply where relevant; we do neither. See California privacy rights.

Under Indonesia’s Personal Data Protection Law, you can seek information, access, correction, deletion, restriction, withdrawal of consent and portability, subject to its conditions. You can object to significant solely automated decisions and seek legal remedies and compensation for unlawful processing.

We do not collect sensitive personal data. We do not make decisions with legal or similarly significant effects solely by automated means. In the past 12 months, we collected and disclosed only the categories of personal data listed in this policy, for the purposes listed in this policy.

Processing across borders

Your data is processed in the United States and other countries where providers operate. Our day-to-day operations are in Indonesia. Privacy laws may differ between countries.

For EU transfers, we use Standard Contractual Clauses or a provider's certification. For UK transfers, we use the UK International Data Transfer Addendum or, where available, a provider's UK certification. For transfers subject to Indonesian law, we use the safeguards that law requires. Contact us for information about the applicable safeguards and a copy where available.

Security

We store API keys only as a one-way hash and a short display prefix. Database access uses row-level security and least-privilege roles. Account deletion runs only through a restricted operator process. Connections use HTTPS. We minimise error reports as described above. No system is completely secure.

We notify affected users and authorities without undue delay where required. We notify authorities within 72 hours of awareness where GDPR requires it. See GDPR breach guidance. Indonesian notices follow the 3 x 24 hour deadline where required.

Age

The service is for developers and businesses. You must be at least 18. Contact us if you believe an under-18 user has provided personal data.

Changes to this policy

We post each new version with its date and archive previous versions. Previous policies: /privacy/archive.

Contact

Email hello@narwhalapi.com for privacy questions, complaints or rights requests. You can also write to Nusantara Ventures, LLC, 1401 Pennsylvania Ave STE 105 #1776, Wilmington, DE 19806, United States.