Privacy Notice
The short version. We collect what is needed to run your account and your API access. We do not sell personal data, we do not run advertising trackers, and we never store your password, your API key or card details in readable form.
1. Who we are
TASI API is an independent developer data service that provides Saudi market data endpoints and a simulated Paper Trading environment. In this notice, “we” means the operator of the TASI API service, and “you” means the person or team using it. For any privacy question or request, write to [email protected].
2. What we collect
- Account data: your email address, a password stored only as an Argon2id hash, your email-verification and account status, and the dates of account events.
- Session data: a random session token kept in your browser's local storage. Our servers store only its hash, together with an expiry date (30 days) and the last time it was used.
- API credentials: for each key we store a one-way hash and a short prefix so you can recognise it. The full key is shown to you once and is never stored in readable form.
- Usage data: per-day counters of API requests, the number of symbols requested and, for Paper Trading, portfolio and order activity. We use these for limits, support and billing.
- Paper Trading data: portfolio names, opening balances, simulated orders, fills, positions and the cash ledger you create.
- Payment data: for USDC payments, the transaction hash, amount and wallet address; for bank transfers recorded by our billing team, the payment reference, amount and period. We do not receive or store card numbers, because card payments are not offered.
- Support messages: anything you send us by email.
3. What we do not collect
- No advertising, profiling or third-party analytics trackers.
- No marketing cookies. The site uses only strictly necessary browser storage (see section 4).
- No card details, no national identifiers, no location data, no contacts.
4. Cookies and local storage
We do not set cookies for advertising or measurement. Two local-storage entries are used on your device:
tasi_session— the session token that keeps you signed in to the Developer Portal. Clearing it signs you out.tasi_theme— your light or dark preference for this site.
Both are strictly necessary for the service to work as expected, which is why there is no consent banner. Clearing your browser storage removes them at any time.
5. Why we use the data
- Create and secure your account, verify your email and run your trial.
- Authenticate API requests, apply symbol limits and record usage.
- Operate Paper Trading portfolios and produce your reports.
- Confirm subscription payments and keep billing records.
- Answer support requests, investigate abuse and keep the service reliable.
6. Who processes data for us
We use a small number of service providers, and only for the purpose of running the platform:
- hosting and container infrastructure for the API, portal and database;
- DNS and reverse-proxy delivery for the websites;
- an email provider that delivers verification messages;
- a public Base network RPC endpoint used to read payment receipts.
We do not sell personal data and we do not share it for advertising. Payments made on the Base network are public by nature: a wallet address and transaction are visible on-chain to anyone.
7. How long we keep it
- Account: while your account is active, then for a short period to meet accounting and legal obligations.
- Sessions: 30 days, or until you sign out or change your password.
- Usage counters: retained as daily rows so we can show your 30-day history and support billing questions.
- Paper Trading history: a deleted portfolio is removed from your active list, but its ledger entries and fills remain as part of the integrity of your records.
- Server logs: kept briefly for security and troubleshooting, then discarded.
8. Security
Traffic is encrypted in transit. Passwords are hashed with Argon2id, session and API keys are stored only as hashes, and access to production systems is restricted. No system is perfectly secure, so keep your API key on your server, rotate it if you suspect exposure, and tell us promptly.
9. Your choices
Write to [email protected] to request a copy of your account data, correct it, or ask for the account to be closed. Closing the account ends API access and revokes your key. Some records — for example payment records and ledger history — may be kept where the law or accounting practice requires it, and we will tell you which ones apply.
10. Children
The service is intended for developers and is not directed to anyone under 18. We do not knowingly create accounts for children.
11. Changes to this notice
If this notice changes materially, we update the date at the top of this page. Continuing to use the service after an update means you accept the revised notice.
12. Contact
Privacy questions and requests: [email protected].