Dataville: one API for SEC filings, Wikipedia and more

1. Introduction

Dataville ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Dataville API platform and related services ("Service"). Please read this policy carefully. If you disagree with its terms, please discontinue use of the Service.

2. Information We Collect

2.1 Information You Provide

Account registration details (name, email address, password)
Billing and payment information (processed by our payment provider)
Communications you send to our support team

2.2 Information Collected Automatically

API request logs (endpoint, timestamp, response code, latency)
IP addresses and approximate geographic location
Browser and device information when accessing the dashboard
Cookies and similar tracking technologies (see Section 6)

3. How We Use Your Information

We process your personal information for the following purposes. Where we rely on legitimate interests, we have balanced those interests against your rights and determined they are not overridden. You may contact us to obtain more information about this balancing assessment.

Provide, operate, and maintain the Service — Lawful basis: performance of a contract (Art. 6(1)(b) GDPR)
Process transactions and send billing-related communications — Lawful basis: performance of a contract (Art. 6(1)(b) GDPR); legal obligation for tax/accounting records (Art. 6(1)(c) GDPR)
Monitor and analyze usage patterns to improve performance and features — Lawful basis: legitimate interests (Art. 6(1)(f) GDPR) — improving platform reliability and user experience
Detect and prevent fraud, abuse, and security incidents — Lawful basis: legitimate interests (Art. 6(1)(f) GDPR) — protecting the security and integrity of the Service
Send transactional emails (e.g., account confirmations, API key alerts) — Lawful basis: performance of a contract (Art. 6(1)(b) GDPR)
Respond to your support requests — Lawful basis: legitimate interests (Art. 6(1)(f) GDPR) — providing customer service
Comply with legal obligations — Lawful basis: legal obligation (Art. 6(1)(c) GDPR)

We do not sell your personal information to third parties.

4. How We Share Your Information

We may share your information with:

Service providers — trusted third parties that assist us in operating the Service (e.g., cloud hosting, payment processing, error monitoring), subject to confidentiality obligations.
Legal authorities — when required by law, subpoena, or court order, or to protect the rights and safety of Dataville, our users, or the public.
Business transfers — in connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Data Retention

We retain your account information for as long as your account is active or as needed to provide the Service. API request logs are retained for up to 90 days for operational and debugging purposes. You may request deletion of your account and associated data at any time by contacting [email protected].

6. Cookies

We use the following categories of cookies when you access the Service:

Strictly necessary cookies: Required to operate the Service, including maintaining your authenticated session and storing security tokens. These cookies cannot be disabled without breaking core functionality. No consent is required for strictly necessary cookies under the ePrivacy Directive.
Analytics cookies: Used to understand how users interact with the dashboard, measure feature adoption, and improve the Service. These are non-essential cookies. Where required by law (including for users in the EU, UK, and similar jurisdictions), we will obtain your prior consent before placing analytics cookies. You may withdraw consent at any time through the cookie preference centre accessible from the footer of the dashboard.

You can also control cookie settings through your browser. Please note that disabling strictly necessary cookies will impair Service functionality. For more information about the specific cookies we use, please see our Cookie Notice at dataville.com/cookies.

7. Security

We implement industry-standard technical and organizational measures to protect your information against unauthorized access, loss, or misuse. These measures include encryption in transit (TLS), encrypted storage, and access controls. However, no system is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on your location, you have specific rights regarding your personal data as described below. We will respond to all verified requests within 30 days. If we need more time, we will notify you of the extension and the reason for the delay.

8A. Rights for EU/UK Users (GDPR / UK GDPR)

Right of access (Art. 15): Obtain a copy of the personal data we hold about you and information about how we process it.
Right to rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
Right to erasure (Art. 17): Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other lawful basis applies.
Right to object / restrict processing (Arts. 18–21): Object to processing based on legitimate interests, request restriction of processing in certain circumstances, or withdraw consent where processing is consent-based.
Right to data portability (Art. 20): Receive a copy of your personal data in a structured, commonly used, machine-readable format, and transmit it to another controller where technically feasible.
Right to lodge a complaint (Art. 77 — mandatory disclosure): You have the right to lodge a complaint with your local data protection supervisory authority at any time. A list of EU supervisory authorities is available at edpb.europa.eu. The UK supervisory authority is the Information Commissioner's Office (ico.org.uk).

8B. Rights for California Users (CCPA / CPRA)

Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collecting it, and the categories of third parties with whom we share it.
Right to delete: Request deletion of personal information we have collected, subject to certain exceptions.
Right to opt out of sale or sharing: We do not sell or share your personal information for cross-context behavioural advertising. If this changes, we will provide a "Do Not Sell or Share My Personal Information" link and honour opt-out requests.
Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise any of the rights described above, please submit a request to [email protected]. We may need to verify your identity before processing your request. We will not charge a fee for reasonable requests but may charge a reasonable fee or decline requests that are manifestly unfounded or excessive.

9. Children's Privacy

The Service is not directed to individuals under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

10. Third-Party Links

The Service may contain links to third-party websites or data sources. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Service or by sending an email to the address associated with your account. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at [email protected].