invy.fi

Legal

Privacy Policy

Last updated:

This Privacy Policy describes how Prodscape Inc. ("we," "us," or "our") handles information when you use the invy.fi API and website, including accounts, the dashboard and the API at its former address, invy.bot (together, the "Service").

1. Information We Collect

When you use the Service, we may process:

  • IP addresses — received as part of standard HTTP requests.
  • Wallet addresses — the public blockchain addresses you submit in API requests.
  • Request metadata — timestamps, endpoints accessed, and response codes.
  • Payment data — paying wallet address and transaction hash from x402 payments. On-chain payment data is public and permanent.
  • Email address — if you create an account, the address you sign in with. We use it to send sign-in links and notices about your account.
  • Account and API key records — your account's creation date and spend cap, and for each API key its name, creation and last-used times, and its first and last few characters so you can tell keys apart. API keys are stored only as one-way hashes, so we cannot recover a key after showing it to you once. Sign-in links, sign-in cookies, and session tokens are stored the same way.
  • Usage records — for each account, the time, action (including add-ons such as gain/loss), and credits of requests made with your API keys, kept for up to 400 days for billing and the dashboard.
  • Billing data — card payments are handled by Stripe. We store your Stripe customer ID and the ID and status of your card billing in Stripe. Card numbers are entered with Stripe; we never receive or store them.
  • Sign-in cookies — a short-lived cookie that ties a sign-in link to the browser that requested it, and a cookie that keeps you signed in to the dashboard (see Section 2).

Apart from the cached results described in Section 4, we do not log the content of API responses after delivery.

2. Cookies and Tracking

We do not sell your information. We do not use advertising or tracking cookies, and we do not use browser tracking or third-party analytics.

We set only two cookies, both strictly necessary. invy_login is set when you request a sign-in link, so the link can recognize the browser that asked for it; it is sent only to our sign-in endpoints and expires after 15 minutes or when you sign in. invy_session keeps you signed in; it is set when you sign in, is sent only to our account endpoints, and expires after 30 days or when you sign out. API requests for wallet data do not use cookies. Stripe Checkout and the Stripe billing portal are hosted by Stripe, which uses its own cookies under its own policies.

3. How We Use Information

Information processed during API requests is used to fulfill those requests, maintain service reliability, and prevent abuse. If you have an account, we also use your information to:

  • authenticate you with sign-in links, sessions, and API keys;
  • send sign-in emails;
  • meter your usage and bill you through Stripe;
  • enforce your monthly spend cap;
  • show your usage and billing status in the dashboard; and
  • send service notices about your account, billing, and changes to our terms or prices.

4. Data Retention

To serve cached results (the cached-okay action) and reduce queries to upstream providers, we cache the results we build for each wallet address you query, including its tokens, balances, and values. Cached results can be kept for years and may be returned to anyone who queries the same address with cached-okay. We also keep a record of when each queried address was last fetched.

When you request gain/loss, we also cache each coin's transfer history for that wallet address and a snapshot of the gain/loss results, and reuse them for later requests about the same address, including requests by others. Transfer histories can be kept for years, like cached results.

  • Account data — your email address, account and API key records, and Stripe IDs are kept until you ask us to delete your account.
  • Usage records — kept for up to 400 days, for billing and the dashboard.
  • Transaction history pages — we cache the pages we build so a repeated request returns the same page. A cached page is kept for up to 24 hours (60 seconds for a first page). Large pages are not cached.
  • Pagination cursors — stored with the wallet address and filters they belong to, and expire after 7 days.
  • x402 payment records — to stop a payment from being used twice, we keep a one-way hash identifying each x402 payment for 1 day.
  • Sign-in links — expire 15 minutes after we send them and work only once. A link signs you in directly in the browser that requested it; opened anywhere else, the page asks you to confirm your email address before signing you in.
  • Sessions — expire 30 days after you sign in, or when you sign out.

Account deletion. To delete your account, email hello@invy.fi from the address you sign in with.

5. Third-Party Providers

To fulfill requests, we query third-party data providers including CoinGecko, Alchemy, Moralis, and Helius. Wallet addresses you query are transmitted to these providers. Each provider has its own privacy practices.

We also rely on these service providers to run the Service:

  • Stripe — processes card payments and runs metered card billing. It receives your payment details and the usage we report for billing.
  • Amazon Web Services, including Amazon SES — hosts the Service and its data, and sends our emails, including sign-in links.
  • Coinbase — verifies and settles x402 payments through the Coinbase Developer Platform facilitator. It receives the payment you sign for each x402 request.
  • Slack — receives an internal operations notice for each successful API request, including the queried address and action, and alerts about account billing problems.

6. Wallet Addresses

Blockchain wallet addresses are pseudonymous and publicly visible on-chain. In certain jurisdictions, they may be considered personal data when combined with other information. We treat wallet addresses with the same care as other request data described in this policy.

7. Data Sharing

We do not sell, rent, or share your information with third parties for marketing or advertising. We share information with the service providers described in Section 5 only as needed for them to run the Service on our behalf, such as processing and verifying payments, hosting, sending email, and internal operations notices. Information may also be disclosed if required by law or to comply with legal process.

8. Security

We use reasonable measures to protect data processed through the Service. No method of transmission or storage is completely secure.

9. Changes

We may update this Privacy Policy at any time. Changes are effective when posted. Continued use constitutes acceptance.

10. Contact

Questions: hello@invy.fi