Privacy Policy

This Privacy Policy explains how Nusantara Ventures LLC ("we", "us", "our"), a Delaware limited liability company with registered office at 1401 Pennsylvania Avenue STE 105 1776, Wilmington, DE 19806, USA, collects, uses, and protects personal data in connection with the exchangerate.dev service (the "Service"). It concerns information about you, our users — not the exchange-rate data the Service returns.

Although Nusantara Ventures LLC is a Delaware company, day-to-day operations are conducted from Indonesia. Where applicable, we process personal data in compliance with Indonesia's Personal Data Protection Law (UU 27/2022), the EU/UK GDPR, and the California Consumer Privacy Act (CCPA/CPRA).

1. Information we collect

• Account information — your email address, and any name you provide.
• API credentials — we store a one-way hash of your API key (never the raw key) plus a short display prefix.
• Usage metadata — request counts, timestamps, endpoints called, and the IP address of requests, used for billing, rate-limiting, security, and abuse prevention.
• Payment information — handled by our third-party payment processor. We do not store your full card details; we receive only limited billing metadata (for example, subscription status and the last four digits of the payment method).
• Support communications — messages you send us.

We do not intentionally collect special-category personal data, and the Service is not directed to children.

2. How we use information

We use this information to: provide and operate the Service; authenticate requests and enforce quotas; bill paid plans and prevent fraud; secure the Service and investigate abuse; respond to support requests; and comply with legal obligations. Our lawful bases include performance of our contract with you, our legitimate interests in operating and securing the Service, and compliance with law. We do not sell personal data, and we do not use it to train third-party AI models.

3. How we share information

We do not sell personal data. We share it only with:

• Service providers (subprocessors) who process data on our behalf — our payment processor, hosting, database, cache, transactional email, content delivery, and error-monitoring providers — under contractual data-protection terms. The current list is maintained at /privacy/subprocessors.
• Legal and safety — where required by law, or to protect our rights, users, or the Service.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

4. Retention

We retain account and usage data for as long as your account is active and as needed to provide the Service, comply with legal and tax obligations, resolve disputes, and enforce agreements. Aggregated or anonymized data that no longer identifies you may be retained longer.

5. Your rights

Depending on your location (including under the EU/UK GDPR, the CCPA/CPRA, and Indonesia's UU 27/2022), you may have rights to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us at support@exchangerate.dev. You may also have the right to lodge a complaint with your local data-protection authority.

6. International transfers

We may process and store data in countries other than yours. Where required, we use appropriate safeguards (such as standard contractual clauses) for international transfers.

7. Security

We use reasonable technical and organizational measures to protect personal data, including hashing of API keys, encryption in transit, and access controls. No method of transmission or storage is completely secure.

In the event of a personal-data breach affecting you, we will notify you and the applicable supervisory authorities without undue delay and, where required, within 72 hours of becoming aware (EU/UK GDPR) or within the timeframe mandated by Indonesia's Personal Data Protection Law (3 × 24 hours).

8. Cookies

The marketing site and dashboard use only strictly necessary cookies (for example, to keep you signed in). We do not use advertising cookies, retargeting pixels, or cross-site tracking.

9. Changes

We may update this Policy. Material changes will be posted with an updated effective date.

10. Contact

Questions or requests regarding this Policy: