Privacy Policy.

NodeLane Ltd (company number [company number], registered office [registered office address]) is the controller of personal data processed through the NodeLane website, dashboard and RPC gateway (the "Service"). We are registered with the UK Information Commissioner's Office (ICO) under registration number [ICO registration number].

This policy explains what personal data we collect, why, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018). It should be read with our Terms of Service.

• Account data: your email address and an internal account ID, created when you sign in with a magic link.
• Billing data: your Stripe customer and subscription IDs and subscription status. Stripe collects your payment details, name and billing address directly; we never see or store your full card number.
• API keys and usage: your API keys, plan quota, billing period, and totals of NodeLane Units used per key per billing period.
• Operational request logs: for each RPC call our gateway records the time, the JSON-RPC method name (for example getBalance), whether it was served from cache, and how long it took. These logs are not linked to your account or API key.
• Emails you send us: if you email [email protected], we keep your message and contact details to reply.
• Technical data held by our providers: our hosting, network and sign-in providers (Vercel, Cloudflare and Supabase) may record IP addresses and browser information in their own security and operational logs when you visit the website, sign in or use the gateway.

Our RPC gateway is designed to keep as little as possible. We do not:

• log your IP address, API key, request parameters or response content;
• link RPC requests to your identity, beyond counting how many NU each key uses;
• store your wallet addresses or private keys, or have access to your funds;
• use analytics, advertising or tracking cookies, or sell personal data.

To speed up responses we cache the results of some read requests (such as finalized blocks and transactions). Cached results are public blockchain data. They are stored without any link to the customer who requested them and may be served to other customers who make the same request.

We do not send marketing emails. If that changes, we will ask for your consent first. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects, other than automatically suspending an API key when its subscription is not active or its quota is used up, as described in our terms.

We share personal data only with service providers who process it on our behalf under contracts that protect it:

Stripe may act as reseller or merchant of record for your payments, in which case it also processes your billing data as an independent controller under its own privacy policy.

Our upstream RPC providers (Chainstack, dRPC and Solana Vibe Station) receive only the content of your JSON-RPC requests. We do not send them your API key, IP address or account details.

We may also disclose data where required by law or to protect our rights, or to a buyer or successor if our business is sold or reorganised.

Some of our providers process data outside the UK, mainly in the United States. Where they do, we rely on UK adequacy regulations (including the UK-US data bridge for certified organisations) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with the provider's security measures. Contact us for more detail.

• Account data, API keys and usage totals: for as long as your account is active. After you close your account or your subscription ends, we delete or anonymise them within [e.g. 90 days], except where we need to keep them longer as below.
• Billing and transaction records: for 6 years after the end of the financial year they relate to, as required for UK tax and accounting purposes.
• Operational request logs: kept for up to 15 days for troubleshooting, then deleted automatically.
• Emails with us: for up to 2 years after our last contact, unless needed for a dispute.
• Our providers keep their own security logs for the periods set out in their privacy policies.

We use access controls, encrypted connections (HTTPS/TLS) and reputable infrastructure providers to protect your data. Sign-in uses single-use links that only work in the browser that requested them. Access to production systems and databases is limited to the people who need it. No system is perfectly secure: keep your email account and API keys safe, and tell us straight away if you think your account has been compromised.

We do not use cookies for analytics or advertising. When you sign in, your browser stores a session token in local storage so you stay signed in. This is strictly necessary for the dashboard to work, so it does not need your consent. Stripe sets its own cookies on its checkout and billing pages, for fraud prevention.

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, where we have no overriding reason to keep it;
• restrict or object to our processing based on legitimate interests;
• receive your data in a portable format; and
• withdraw any consent you have given.

To exercise any of these, email [email protected] from your account email address. We will respond within one month. We may need to confirm your identity first.

We may update this policy as the Service changes. We will post the new version here and, for material changes, tell you by email before they take effect.

For privacy questions or requests, email [email protected].

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.