Privacy policy

Scope

This policy covers the Fiat Agent website, the rate desk available to account holders, and the Fiat Agent API. It explains the information we hold, why we hold it, and the choices you have. It does not cover services we do not control, such as a payment provider's own pages.

Information you give us

• Account details: the name and email address you register with, and the password you set. Passwords are handled by our authentication provider and are never stored by us in readable form.
• API keys you create: a label, the visible prefix, and a one-way hash of the secret. The full key is shown to you once and is never retrievable afterwards.
• Purchase details: the pack you bought, the amount, the currency, and the payment provider's order and capture identifiers.
• Anything you send us in a support conversation.

Information created by using the API

Each request is counted so that published limits can be enforced. To keep those counters without building a log of who called what, requests are attributed with a one-way digest of the calling address rather than the address itself.

• A one-way hash of the calling address, used only to group requests for rate limiting.
• Per-window counters (second, hour, day) for unkeyed calls, and a running request count against your account.
• The timestamp of a key's last successful use and a lifetime request count per key.
• The endpoint, query parameters, status code and response time of a request while it is processed — held only long enough to serve the response.

Payments

Top-ups are processed by PayPal. Card details, billing addresses and PayPal account credentials are entered on PayPal's own pages and are never transmitted to or stored by Fiat Agent. We receive confirmation that an order was approved, together with the order and capture identifiers needed to credit your account.

Cookies and local storage

Signing in stores a session token in your browser's local storage so the rate desk can recognise you. Clearing it signs you out; it is never shared with anyone else.

The public site also loads third-party measurement tools, which set their own cookies and record how pages are used: the pages viewed, the page that referred you, an approximate location derived from your IP address, your device, browser and screen size, and how a page is scrolled or clicked. They tell us which pages are read and where people get stuck, so the documentation can be improved. They are not used for advertising, we do not advertise, and none of this information is sold or shared for advertising.

You can block or clear these cookies in your browser at any time. The site, the rate desk and the API keep working if you do.

Why we use it

• To create and secure your account and sign you in.
• To meter requests, apply the published rate limits to unkeyed calls, and keep your remaining balance accurate.
• To credit top-up purchases and keep a record of what was bought.
• To answer support questions and to detect abuse or attempts to bypass limits.
• To meet legal, tax and accounting obligations that apply to paid services.

Who we share it with

We do not sell personal information, and we do not share it for advertising. It is disclosed only to the service providers that make the product run, and only as far as each one needs it:

• Our hosting and authentication provider, which runs the application and stores the account database.
• PayPal, to create the order, take the payment and process refunds.
• A currency data provider, which receives no personal information — requests are made by us, not on your behalf.
• Authorities, where a valid legal request requires disclosure, or where necessary to protect the service or its users.

How long we keep it

Account and API key records are kept for as long as the account exists. Rate-limit counters are short-lived and are discarded once every window they cover has rolled over. Purchase records are kept for the period accounting rules require. When you close your account, the account, its keys and its counters are deleted; purchase records may be retained in a minimal form where the law requires it.

Your choices and rights

You can revoke any API key at any time, which stops it working immediately. Depending on where you live, you may also have the right to see the personal information we hold about you, to have it corrected, to have it deleted, to object to certain processing, or to receive a copy in a portable format.

To exercise any of these, write to us from the email address registered to your account. We answer within 30 days and never charge for a first request.

Keeping it safe

Traffic is encrypted in transit. API key secrets exist only as one-way SHA-256 digests, so a copy of our database cannot be used to call the API. Access to production data is restricted to those who need it to operate the service. The security page sets out the measures in more detail.

Children

Fiat Agent is a developer service and is not directed at children. Accounts are not knowingly created for anyone under 16, and such an account will be closed if we learn of it.

How to reach us

Questions about this policy, and any request to see, correct, delete or receive a copy of your information, go to duplexinterface@outlook.com. Write from the address registered to your account so we can identify you without asking for anything further.

Fiat Agent is created and operated solely by Gurutva Murdia, who is the person responsible for the information described on this page.

Changes to this policy

If this policy changes in a way that affects what we collect or how we use it, the revised version is published here with a new date and account holders are told by email before it takes effect. Continuing to use the service after that date means the revised policy applies.