World Price Index (worldpriceindex.org) is run by Vexon Group Ltd, a company registered in England and Wales (company number 16879644), at 15 Seaside Road, Eastbourne, BN21 3PP, United Kingdom (“we”, “us”). We are the controller of the personal data described here.
Contact for anything in this policy: [email protected].
- You can read every public page without an account, and without analytics cookies unless you accept them.
- If you create an account, we keep your email address, your API keys (stored so we can't read them back), how many API requests you make, and your plan and billing status.
- Card details go to Stripe, never to us.
- We don't sell personal data and we don't use it for advertising.
If you just browse
- Technical logs. Our servers record requests to the site: IP address, browser and device type, the page requested, the referring page, time and error details. We use them to keep the site secure and working.
- Your market choice. If you pick a country with “Compare with”, your browser remembers it on your device (local storage, key
wpi.market). It isn't sent to us except as part of the page address (?country=). - Analytics, only with your consent. See section 7.
If you create an account
- Account details: your email address. If you sign in with Google, also the name and profile picture Google shares, and your Google account identifier. We don't receive your Google password.
- Sign-in records: sign-in links (they expire after 15 minutes and work once) and session records that keep you signed in.
- API keys: each key's name, its first characters (for example
wpi_live_ab12), when it was created, last used and revoked. We store the rest of the key only as a one-way hash, so we can't show it to you again. - API usage: for each key, the number of requests per endpoint per day. We use this to apply your plan's limits, bill overage and show you your usage.
- Plan and billing status: your plan, whether payment is up to date, and the identifiers Stripe gives us for your customer record and subscription.
- Emails we send you: sign-in links, welcome, API key, plan and payment emails. We keep a copy of each email and whether it was delivered, so we can resend it and answer questions about it.
If you pay
Payments are handled by Stripe. Stripe collects your card details, billing address and tax information; we receive the subscription and invoice status and the identifiers above, not your card number.
If you contact us
The contact form and email give us your name (if you give it), your email address, your message and anything you include, such as a page address. The form uses Cloudflare Turnstile to block spam (section 5).
- Purpose
- Running your account, API keys and plan
- Data
- account, keys, usage, plan
- Lawful basis
- Contract
- Purpose
- Billing, invoices and tax records
- Data
- billing status, Stripe identifiers, usage for overage
- Lawful basis
- Contract; legal obligation (tax records)
- Purpose
- Sending sign-in links and service emails
- Data
- email address, email copies
- Lawful basis
- Contract
- Purpose
- Keeping the site and API secure, preventing abuse
- Data
- technical logs, usage, Turnstile check
- Lawful basis
- Legitimate interests
- Purpose
- Answering your messages
- Data
- contact details, message
- Lawful basis
- Legitimate interests
- Purpose
- Understanding how the site is used
- Data
- analytics data
- Lawful basis
- Consent
We don't make decisions about you based solely on automated processing.
Some providers (Amazon Web Services, Stripe, Google, Cloudflare) are based in, or may process data in, the United States. Where data leaves the UK, we rely on the UK's adequacy regulations (including the UK–US data bridge where the provider is certified) or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.
- Data
- Account, API keys and usage
- Kept for
- while your account is open, then deleted within 30 days of closing it, except as below
- Data
- Billing and invoice records
- Kept for
- 6 years after the end of the financial year they relate to (UK tax law)
- Data
- Copies of emails we send
- Kept for
- 12 months
- Data
- Sign-in links
- Kept for
- deleted when used; unused links expire after 15 minutes and are deleted within a day
- Data
- Server logs
- Kept for
- as long as we need them to keep the service secure and working
- Data
- Analytics data
- Kept for
- 14 months (Google Analytics retention setting)
Under UK data protection law you can ask us to:
- give you a copy of your personal data
- correct it
- delete it (account deletion is currently done on request: email us)
- restrict or object to how we use it
- give it to you, or another provider, in a portable format
- withdraw consent (for analytics, use Cookie settings)
Email [email protected]. We'll reply within one month. You can also complain to the Information Commissioner's Office (ico.org.uk), though we'd like the chance to help first.
Connections to the site and API are encrypted (HTTPS). API keys are stored only as hashes, sign-in links expire after 15 minutes and work once, and access to our systems is limited to the people who run the service. No system is perfectly secure; if a breach affects you, we'll tell you as the law requires.
World Price Index isn't aimed at children, and we don't knowingly create accounts for anyone under 16.
If we change this policy, we'll update the date at the top. If a change materially affects how we use your data, we'll tell account holders by email before it takes effect.
Questions? Email [email protected]