Privacy Policy

1. Who we are

KeyVex is a data API and Model Context Protocol (MCP) server that publishes US public-record financial and government disclosures, plus licensed market data. The service is operated by KeyVex LLC. For privacy questions, contact contact@keyvex.com.

This Privacy Policy applies to:

• The website at keyvex.com (www.keyvex.com redirects there)
• The REST API at api.keyvex.com
• The MCP server at mcp.keyvex.com, including the sign-in endpoint mcp.keyvex.com/pro
• The account, billing and alert services behind them

2. Information we collect

2.1 Information you give us

• Account information: if you create an account. Accounts are handled by Firebase Authentication (a Google service). Depending on how you sign in (email and password, or Google), we receive and store your email address, display name, a Google profile photo (for Google sign-ins), the sign-in provider(s) used, a Firebase user ID, account-created and last-seen timestamps, and a record that you accepted our Terms (with timestamp and version).
• Profile details you choose to add in Settings: first and last name, company, job title, location, country, date of birth, a short bio, your trading interests, and a profile photo. An uploaded photo is stored at a public web address so the site can show it.
• API keys: we store only a SHA-256 hash of each key, never the key itself (the raw key is shown to you once, at creation), together with its last four characters, the name you give it, and when it was created and last used, so you can tell your keys apart.
• Connector sign-in: when you connect an MCP client (such as Claude) to mcp.keyvex.com/pro, we issue access tokens (valid for an hour) and refresh tokens (valid for up to 90 days) linked to your account.
• Watchlists and alerts you create, including any webhook address you give us for alert deliveries.
• Payments are handled by Stripe, our payment processor. Your card or bank details go directly to Stripe; KeyVex never sees or stores your full card number. Stripe receives your account email, your KeyVex account ID, and the billing details you enter at checkout (name, country, postal code). We keep your Stripe customer and subscription identifiers and your plan, so we can apply it.
• One free account per email address: when you sign in with a verified email address, we keep a one-way hash of it (counted so that, for example, Gmail dots and "+" tags reach the same address) with your account ID, and a one-way hash for the free-trial record. A hash cannot be turned back into your address.
• Contact information: when you email contact@keyvex.com (typically your email address and whatever else you include in the message).

Creating an account is optional: without one you can use the two keyless datasets on mcp.keyvex.com. We do not run a newsletter or marketing-list signup.

2.2 Automatic information from API usage

When you call api.keyvex.com or mcp.keyvex.com, Google Cloud automatically logs:

• Your IP address
• The request method, path, and standard HTTP headers
• Response status code and approximate timing
• The tool name invoked, if any

These logs live in Google Cloud Logging under the project capitaledge-api and are retained per Google's default retention (currently 30 days for standard logs). We use them to debug failures and monitor for abuse. Our own log lines about tool calls carry a one-way hashed label for the account, not your account ID or key, so we can see how the service is used.

Usage counts. To enforce plan limits we count, for each account, requests per minute and per day, requests running at once, data returned per month, and server time per day. For callers without an account the same counts are kept under a one-way hash of the IP address (the first 16 characters of its SHA-256), never the address itself. Daily counts are deleted after about 48 hours and monthly counts after about 35 days. The keyless endpoint's per-IP rate limit (60 requests per 60 seconds) is also held briefly in server memory, which is dropped when the container restarts.

2.3 Automatic information from the website

The website at keyvex.com is served by Firebase Hosting. We do not embed Google Analytics, Facebook Pixel, or any other advertising or analytics tracker, and we set no advertising or analytics cookies. The signed-in pages use Firebase Authentication, which stores a session token in your browser's local storage to keep you signed in, and signing in also sets a single strictly-necessary first-party cookie named __session so the homepage can route you to your dashboard. The checkout and Settings pages load Stripe's own script from Stripe, which sets Stripe's cookies to prevent payment fraud (see Stripe's privacy policy). Pages load fonts from Google Fonts and some scripts from jsDelivr, which receive your IP address as part of serving them. News stories count how many times each story is read, with no cookie and nothing about the reader kept. Firebase Hosting's edge network logs basic request data (IP, user-agent, URL) for delivery and abuse protection; we do not access or combine these with any other data.

2.4 What we do NOT collect

• We do not collect browsing history, search history, or behavioral profiles.
• We never see or store your full card number; Stripe handles it.
• We do not collect demographic information beyond the optional profile details you choose to add.
• We do not collect any data from minors and we do not intentionally serve users under 13.

3. How we use information

We use the information described above only to:

• Operate the website, the API and the MCP server, including your account, API keys and connector sign-in
• Bill paid plans through Stripe
• Enforce plan limits, the one-free-account-per-email-address and once-only trial rules, and acceptance of the Terms
• Understand how the service is used, per account under hashed labels, to run, price and improve it
• Debug failures and monitor for abuse
• Respond to email you send to contact@keyvex.com
• Send service email: Firebase sends verification and password-reset emails, and we may email you about changes to the Terms, billing, outages, or security (no marketing email)

We do not use your information for any other purpose. We do not run advertising. We do not train AI models on your usage data.

4. The data the API serves

KeyVex's tools return normalized public-record financial and government disclosures sourced from official US government repositories: SEC EDGAR, USAspending.gov, Senate eFD, House Clerk, Senate LDA, the unitedstates/congress-legislators public catalog, api.congress.gov, api.open.fec.gov, US Treasury OFAC, federalregister.gov, SEC + DOJ + CFTC + OCC + FDIC + FTC press release feeds, FDA openFDA, CMS Open Payments, USPTO, CPSC SaferProducts, CFPB Consumer Complaint Database, HHS-OIG LEIE, DOJ FARA, US Trade Consolidated Screening List, US Treasury Direct, CFTC Commitments of Traders, BLS, FRED, EIA, and GovInfo. Paid plans also include end-of-day and intraday market prices licensed from Tiingo.

This data is published by US government agencies; some records carry federal use restrictions (Terms §6A). We do not derive personal-information profiles, scoring models, or predictive analytics from it. We do not enrich the public-record data with anything sourced from our users. Records returned by the API carry attribution back to the originating government source via filing_url / report_url / primary_document_url fields.

5. Sharing

We do not sell your personal information. We do not share your personal information with third parties for advertising or marketing purposes. We share information only with:

• Google Cloud / Firebase (our hosting and authentication provider). Cloud Run functions, Cloud SQL (Postgres), Firestore, Cloud Storage, Cloud Logging, Secret Manager, Firebase Hosting, and Firebase Authentication all process data on our behalf under Google Cloud's Data Processing Addendum.
• Stripe (payment processor). Stripe processes your payment details directly; KeyVex does not store card numbers.
• Law enforcement if we receive a valid legal demand (subpoena, court order). We will notify you to the extent permitted by law.

Live data passthrough. Some tools fetch results live from the source when you call them: get_federal_contracts and get_federal_grants (api.usaspending.gov), get_fec_contributions and get_fec_disbursements (api.open.fec.gov), get_consumer_complaints (consumerfinance.gov), get_open_payments (CMS), get_drug_adverse_events (openFDA), get_corporate_patents (USPTO), and get_intraday_quote (Tiingo, a private market-data provider). When you call one of these tools, the search parameters you supply, for example a company name, ticker, recipient, candidate, state, or date range, are sent to that source to retrieve current results. We do not forward your IP address, your identity, or any account information; the source receives the request from KeyVex's servers, not from you directly. Every other tool serves data from KeyVex's own database, so those queries never leave KeyVex.

6. Security

All KeyVex endpoints serve traffic over TLS 1.2+ exclusively, with automatically managed certificates. The API endpoints read the published data with read-only database access; counting your usage is done by a separate internal service. Per-IP rate limits, per-account limits, and instance caps bound worst-case load.

Email correspondence with contact@keyvex.com is handled by our inbox provider's standard security controls (TLS in transit, provider-default at-rest encryption).

No system is perfectly secure. If we discover a breach affecting your information, we will notify you within the timeframe required by applicable law.

7. Data retention

• Account information: kept while your account exists. When you delete your account we delete your API keys, your sign-in, and your email address, name, profile details, photo, and connector tokens at once, and your watchlists and alerts within a day. We keep only what the rules below need: a record that the account was deleted and when, which version of the Terms it accepted and when, the Stripe customer ID if you ever paid (Stripe keeps your invoices), and the one-way hash of your email address, which stops a deleted address being reused for another free account for 30 days and another free trial at all. Copies in our weekly backups are deleted automatically within about 25 days.
• Account deletion while a paid plan is active: cancel the subscription first; you can delete the account once the paid period has ended.
• Usage counts: daily counts about 48 hours, monthly counts about 35 days (see 2.2).
• Connector tokens: access tokens an hour, refresh tokens up to 90 days.
• Cloud request logs (including IP): retained 30 days (Google Cloud default).
• Per-IP rate-limit state in server memory: dropped at container restart or after the 60-second sliding window expires, whichever comes first.
• Email correspondence: retained per the inbox-hosting provider's default policy. Earlier deletion on request.

8. Your rights

Wherever applicable law gives you these rights (including residents of the EEA, UK, Switzerland, California, and other states with privacy laws), you have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your information (subject to legal retention obligations)
• Object to or restrict certain processing
• Receive a portable copy of your information
• Withdraw consent (where processing is based on consent)
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email contact@keyvex.com. We respond within 30 days.

California residents (CCPA / CPRA): You have the right to know what personal information we collect, the right to delete it, the right to correct inaccurate information, and the right not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising.

9. International data transfers

KeyVex's infrastructure is hosted in Google Cloud's us-central1 region (Iowa, USA). If you access KeyVex from outside the United States, your information will be transferred to and processed in the United States. We rely on Google Cloud's contractual safeguards (including Standard Contractual Clauses where applicable) for any cross-border transfer of personal information.

10. Children

KeyVex is a developer-focused API service intended for adults building software professionally. We do not intentionally collect personal information from children under 13. If we learn we have collected information from a child under 13, we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective" and "Last updated" dates at the top of this page. Continued use of the service after a change indicates acceptance.

12. Contact

For privacy questions or to exercise any rights described above:

contact@keyvex.com

KeyVex is a data publisher. Nothing on this site or in API responses is investment, legal, tax, or compliance advice. The disclosure records served by the API originate from official US government sources; some carry use restrictions under federal law (Terms §6A).