Quantis Quantis
Open Quantis
Features Download API
← Back to legal

API privacy policy

Updated October 27, 2026

This policy applies to the Quantis API (the “API”) and Quantis Center at center.quantis.vzla.io (“Center”), where you manage your account, keys, plan and usage. The Quantis app is covered by the app privacy policy. We apply the EU General Data Protection Regulation (GDPR) to all users.

Controller

Vzlaio digital LLC (“Vzla.io”) is the controller of the data described below. Legal entity, address and contact details are published in the imprint. Privacy contact: privacy@vzla.io.

The API returns exchange rates; requests to it should not contain personal data. If they do, you are the controller of that data and we process it only to answer the request.

Data we process

  • Your Center account: email address, sign-in data (a code sent by email or a password, stored only as a hash) and when your account was last active.
  • Plan and billing: your plan, trial and paid periods, their dates and status, and internal notes about payments you make. Payment details stay with the payment method you use.
  • Keys: for each key, its name, identifier, a hash of the key (never the key itself), when it was created and when it was revoked.
  • Usage: request counts per endpoint and hour, used to apply your quota and rate limit and to show your usage in Center.
  • Request log: for each request, your account (user and email), time, method, endpoint, response status, IP address, user agent, referrer and response time. Copies of this log are stored in Google Cloud Storage.
  • Messages you send to support, and the address you send them from.
  • Providing the API and Center, authenticating requests and applying your plan’s quota and rate limit: performance of a contract (Art. 6(1)(b) GDPR).
  • Managing trials, paid periods and lapses: performance of a contract (Art. 6(1)(b) GDPR).
  • Securing the API, preventing abuse and key sharing, and keeping it reliable: our legitimate interest in operating a secure and available service (Art. 6(1)(f) GDPR).
  • Keeping billing records for paid plans: legal obligation (Art. 6(1)(c) GDPR).

Recipients

Data is disclosed to processors acting on our instructions under data-processing agreements: hosting and database providers, Google Cloud Storage (copies of the request log), error monitoring (Sentry), performance monitoring (New Relic) and email delivery. Data may be disclosed to public authorities where required by law.

International transfers

Data is processed in the United States and in other countries where our processors operate. Transfers of personal data from the European Economic Area or the United Kingdom are based on the European Commission’s Standard Contractual Clauses or another transfer mechanism recognised under the GDPR.

Retention

  • Account, plan and key records (including revoked keys), usage counts and the request log: kept while the service runs, erased on request.
  • Billing records: for the period required by tax and accounting law.

Your rights

You have the right to access, rectify and erase your data, to restrict its processing, to data portability, and to object to processing based on legitimate interests (Art. 15–21 GDPR). To exercise your rights or close your account, contact privacy@vzla.io. We respond within one month. You have the right to lodge a complaint with a data protection supervisory authority.

Required data and automated decisions

A Center account and a key are required to use the API. Requests over your plan’s limits are throttled automatically; this applies the plan’s limits and is not a decision about you as a person. No profiling is carried out.

Changes

Changes are published on this page with a new date. Material changes are notified by email.

Contact

Privacy: privacy@vzla.io. Support: support@vzla.io.