Privacy policy

Who is responsible

GraphOps Limited is the data controller, at 11/1 St Dominic Street, Valletta, VLT 1604, Malta. Contact ops@graphops.xyz about this policy or your data.

Our paid services are offered for business and professional use. This policy protects the personal data of individuals who visit our website, hold accounts or represent customers, regardless of whether they purchase in a professional capacity.

What we use and why

We use your contact and account details, Google or GitHub sign-in information, service usage, business and billing details, and correspondence to provide services, take payment and support you. This includes information you submit with cancellation, withdrawal or privacy requests. The legal basis is performing our contract with you or taking steps you request before a contract. For business customers’ representatives, we rely on our legitimate interest in administering that business relationship.

We process IP addresses and request logs to diagnose problems, secure our services and prevent abuse, relying on our legitimate interests in reliable and secure operation. We retain billing and accounting records to meet legal obligations, and retain relevant records for our legitimate interest in establishing or defending legal claims. We also rely on legitimate interests to administer our business-only purchasing conditions and keep evidence of contract formation. Relevant records may include your contracting organisation or professional capacity, the professional-use confirmation made through purchase, the accepted terms version, order details, timestamps, usage and refund calculations. Required account and billing information is necessary to provide paid services.

Our data services process public blockchain records, which may include wallet addresses and transactions that relate to individuals. These come from public networks and are made available to service users for our legitimate interest in providing blockchain data infrastructure.

We use cookie-free Umami Cloud analytics in its EU region to measure pageviews, referrals, device and browser characteristics, interactions and performance. We send marketing emails with your consent, or about our similar services where the existing-customer exception applies and you were offered an opt-out when your email was collected. Marketing consent is optional and separate from agreement to the Terms. Signup alone is not consent. You can unsubscribe at any time, free of charge, using the email link or by writing to us. This does not stop necessary account, billing or security messages.

Who receives data

We use Cloudflare for infrastructure, Stripe for payments, Google and GitHub for optional sign-in, Umami for analytics, Chatwoot for live chat and contact form messages, Slack for product feedback notifications, and Google and Amazon Web Services for email. Fonts are served with the website. Providers receive the data needed for their functions. We may disclose records to professional advisers or authorities where necessary for legal obligations or claims.

Providers may process data outside the European Economic Area. Such transfers require an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses. Email us for information about the safeguards applicable to your data and how to obtain a copy.

How long we keep it

Product feedback records, including the original IP address when available, are retained indefinitely for product investigation and abuse prevention. Feedback notifications do not automatically include that captured address.

We keep diagnostic logs while needed to investigate and resolve operational or security issues. Routine logs must not be retained indefinitely simply because accounting records are required. Account records and correspondence are kept for the business relationship and afterwards where needed for outstanding billing, audits, legal recordkeeping or claims. Company accounting records are kept for ten years, measured from the last entry for unified records. Other records are retained only for the relevant legal obligation or unresolved dispute or investigation. Records no longer needed for these purposes are deleted or anonymised. We retain a minimal record of marketing objections for as long as needed to respect your choice.

Your rights

Where applicable, you may request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent without affecting earlier lawful processing. You may always object to direct marketing. Email ops@graphops.xyz. We normally respond within one month. If there is reasonable doubt about your identity, we may ask for information necessary to verify it. Where a lawful extension is needed, we will explain it within the first month. You may complain to Malta’s Information and Data Protection Commissioner(opens in a new tab) or your local supervisory authority.

See our Terms of Service for the conditions of using GraphOps.