Privacy Notice

Rascador is a product of Torvion Labs, a business registered in Malawi under the Business Registration Act (No. 12 of 2012), based in Lilongwe. Torvion Labs is the controller of the personal data described here.

We are based in Malawi. Where we offer the Service to people in the UK or EEA, we apply the standards set out in this notice to their data regardless of where it is processed.

Account data. Your name, email address and profile image, and the organisation you belong to. Authentication is handled by a specialist identity provider; if you sign in with a third-party account such as Google, we receive the profile fields it returns and never see your password.

Usage data.A log of the API requests made with your keys: the time, endpoint, source marketplace, response status, latency, quota units consumed, and the IP address the request came from. This is what powers your dashboard’s request log and analytics, and it is how quota is enforced.

Billing data. Your plan, subscription status and billing period. We never see or store your card details — those go directly to Paddle.

Enquiries. Anything you send us through the contact form or by email.

• To provide the Service: authenticate you, issue keys, meter quota, enforce limits.
• To show you your own usage, and to investigate errors and abuse — both of which need request logs tied to a key.
• To take payment and send you the receipts and notices that go with it.
• To reply when you contact us.
• To meet legal obligations, such as keeping tax records.

Where the GDPR applies, our lawful bases are performance of a contract (providing the Service and billing you), legitimate interests (security, abuse prevention, improving the Service) and legal obligation (tax and accounting records).

We use a small number of processors, each for a specific purpose. They are listed here by category; we will name any of them on request.

• An identity provider — authentication, accounts and organisations. Your password, if you use one, is held by them and never by us.
• Paddle— our merchant of record, named here because it is their name on your statement and their receipt in your inbox. Paddle is a controller in its own right for payment data and applies its own privacy notice.
• Cloud infrastructure providers — hosting and managed databases for the dashboard and the API.

We do not sell personal data and we do not share it for advertising. Some of these providers operate outside your country; where data leaves the UK or EEA it is transferred under the safeguards those providers offer, such as standard contractual clauses.

• Request logs: 90 days, then deleted automatically. Aggregated usage counters, which carry no request detail, are kept for billing history.
• Account data: for as long as your account exists, and a short period afterwards.
• Billing records: as long as tax law requires, typically six to seven years.

The product, category and search data the API returns is collected from public marketplace listings. We do not set out to collect personal data about individuals through it, and these terms prohibit you from using the Service to identify or profile sellers, reviewers or other people. If personal data appears incidentally in a listing, you are the controller of it once you receive it.

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, and receive it in a portable form. You can exercise most of these yourself: your profile is editable in the dashboard, and deleting your organisation removes its keys and data.

For anything else, write to privacy@rascador.store. If you are in the UK or EEA and are unhappy with our response, you can complain to your local data protection authority.

We use cookies that are necessary to run the Service: a session cookie set by our identity provider to keep you signed in, and a preference cookie remembering whether your sidebar is open. We do not use advertising or cross-site tracking cookies.

If we change this notice materially we will tell you before the change takes effect. Questions: privacy@rascador.store or the contact form.