Privacy policy

• We do not sell your personal information. Our analytics tools may count as sharing under California law, so you can turn them off in one click and we honour Global Privacy Control automatically.
• We use Google Analytics and Microsoft Clarity on our public pages only. Nothing third-party runs once you sign in: your dashboard, your usage and your API keys are never sent to an analytics vendor.
• Our usage records note which route or tool you called, not the securities or dates you asked about.
• We do not train models on your queries, and we do not sell them.

Safe Rate Markets is a product of Safe Rate Inc., a Delaware C corporation with its office in Chicago, IL. Safe Rate Inc. is the data controller for everything described here.

It applies to saferate.markets, to the API and MCP server at api.saferate.markets, and to the email we send you. It does not apply to other Safe Rate products, which publish their own policies.

Every category corresponds to tables in our database, which are named so this page can be checked against the schema rather than taken on trust.

Card details are entered on our payment processor's page and never reach us. We hold only the identifiers above.

Two strictly necessary cookies: the session token that keeps you signed in, and one that remembers if you turned analytics off. Neither does anything else.

On our public pages we also use the tools below. Refusing them changes nothing about the service you receive. Your privacy choices shows what is running for your browser and turns it off.

If your browser sends a Global Privacy Control signal, we treat that as turning them off and you do not have to tell us again.

We do not sell your personal information. The vendors below process data on our behalf. The analytics vendors are the exception to "only on our behalf": their terms let them use what they collect for their own purposes, which is why section 9 treats them as sharing and why they are confined to public pages and can be turned off.

Beyond those, we disclose personal information only when the law requires it, or to establish or defend a legal claim. If we are compelled to hand over your data we will tell you, unless we are legally prohibited from doing so. If Safe Rate Inc. is acquired or merged, your data would transfer with the business under this policy or one at least as protective.

Retention is stated per category in section 3. Our payment processor keeps billing records under its own obligations, including the tax and accounting rules that apply to it. Session replays expire on the vendor's own schedule, which Microsoft states as 30 days for most recordings.

API keys are never stored. We keep a SHA-256 hash and a short non-secret prefix, which is enough to authenticate a request and to let you recognise your keys. A key is displayed in full exactly once, when you create it. If you lose it, rotate it: we cannot recover it for you, and that is the point.

Everything travels over TLS, and access to production data is limited to the people who need it. No system is perfectly secure, and we would rather say that plainly. If we discover a breach affecting your personal information we will notify you and the relevant regulators as the law requires.

Email team@saferate.com. We respond within 30 days, we will not charge you for a request, and we will not treat you differently for making one. You can ask for access to what we hold, correction, deletion of your account (within 30 days), a machine-readable copy, or to object to or restrict processing based on our legitimate interests. You may also complain to your supervisory authority or state Attorney General; we would rather you told us first, but that is your choice.

One limit on deletion we would rather state than bury: the session-replay provider offers no way to delete one person's recordings, only an entire project. They expire on their own; if you want them gone sooner, ask and we will delete the whole project.

If you are a California resident, the CCPA as amended by the CPRA gives you the rights to know, delete, correct, and to opt out of sale or sharing, plus the right to limit the use of sensitive personal information.

We do not sell personal information. Our analytics tools set cookies their vendors may use for their own purposes, which California treats as sharing; we treat it as though it is. You can turn them off from your privacy choices, and we honour Global Privacy Control automatically, without asking where you live. We collect no sensitive personal information as the law defines it. You may use an authorised agent to exercise these rights.

We sell in U.S. dollars and do not market in the EEA, the UK or Switzerland. So we do not treat the GDPR or the UK GDPR as applying to us, which is why analytics are opt-out rather than behind a consent banner. If we begin selling there, analytics move to prior opt-in.

That is no reason to hold your data differently, so we do not: the lawful basis for each category is in section 3, and the rights in section 8 are open to you wherever you live. Processing takes place in the United States. If you need a data processing agreement or European data residency, say so before you subscribe; today the honest answer is that we are not set up for it.

This is a business product, not directed at children, and you must be at least 18 to hold an account. If we learn we have collected personal information from anyone younger, we delete it.

When we change this policy we update the effective date at the top. If a change materially reduces your rights or expands what we collect, we will email account holders before it takes effect. A new vendor in section 5 is a change we announce, not one you discover.