Privacy Policy

Last updated: July 24, 2026

This Privacy Policy describes how ExchangeCR, a product of Xtelius, handles information in connection with the site and the API (the "Service").

1. Information we handle

• API usage: the API key, IP address, and request metadata (endpoint, date and time), for authentication, enforcing limits and quotas, security, and abuse prevention. • Contact details: the email address and information you provide when requesting access, a plan, or support. • Technical preferences: your theme preference (light/dark) is stored locally in your browser.

We do not require an account to browse the site, and we do not collect sensitive categories of data.

2. How we use information

We use the information to operate and protect the Service, enforce usage limits and quotas, communicate with you about your access, plan, or support, and comply with legal obligations.

3. Purpose and legal basis

We process data to provide the requested Service, based on our legitimate interest in its security and proper operation, and with your consent where applicable.

4. Providers and third parties

We rely on providers acting as processors: database hosting (Supabase), hosting infrastructure, and an AI provider (Google Gemini) to which only exchange-rate data is sent to generate analysis — not personal data.

We do not sell or rent your personal information.

5. Cookies and local storage

We use browser local storage to remember your theme preference. We do not use advertising or cross-site tracking cookies.

6. Retention

We retain usage metadata for as long as needed for security and billing purposes, and contact details for as long as our relationship lasts or until you request deletion.

7. Security

We apply reasonable measures: sensitive keys are kept server-side only, and communication travels encrypted over HTTPS. No system is completely infallible.

8. Your rights

You may request access, correction, or deletion of your data, or object to or withdraw your consent, by writing to info@xtelius.com.

9. International transfers

Some of our providers may process data outside Costa Rica, applying appropriate safeguards for its protection.

10. Children

The Service is not directed to minors and does not knowingly collect their information.

11. Changes to this Policy

We may update this Policy. We will post the current version with its update date.

12. Contact

To exercise your rights or for privacy inquiries, contact us at info@xtelius.com.

A product of Xtelius.com