Legal

Privacy Policy

Last updated: July 2026

1. Who We Are

OpenTraid ("we", "us") operates the commerce API and website at opentraid.com. We are based in Berlin, Germany. This policy explains how we collect, use, and protect your personal data in accordance with the EU General Data Protection Regulation (GDPR).

2. Data We Collect

When you join the waitlist:

  • Email address
  • Self-selected role (e.g. "OpenClaw user", "Agent developer")

When you use the API:

  • API key (hashed, not stored in plaintext)
  • Search queries sent to the API
  • Request metadata (IP address, timestamps, user agent)
  • Usage metrics (request counts, endpoints called)

When you visit the website:

  • Anonymous, cookie-free reach measurement (page views, visitor counts) via PostHog — see "Analytics & Reach Measurement" below
  • Extended, cookie-based analytics only after you accept the cookie banner
  • A single first-party cookie (opentraid_consent) that remembers your analytics choice
  • Basic server logs may record IP addresses for security purposes

3. Analytics & Reach Measurement

We use PostHog (EU-hosted in Frankfurt; eu.i.posthog.com) in a two-tier model:

  • (1) Basic reach measurement — an anonymous, cookie-free count of page views and visitors runs without consent. Nothing is stored on, or read from, your device, so § 25 TTDSG does not apply; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in privacy-minimising reach measurement).
  • (2) Extended analysis — persistent cookies for cross-session insights and session replay run only after your explicit consent via the banner ("Accept"); the legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TTDSG. "Decline" disables all analytics.

A data-processing agreement and EU hosting are in place; inputs to password fields are masked in session replay. You can change your choice at any time by clearing the opentraid_consent cookie.

Cookies we use:

  • opentraid_consent — necessary; stores your analytics consent decision (1 year). Set for everyone once you choose.
  • PostHog analytics cookies (e.g. ph_*) — set only after you accept the banner; not used for the basic cookie-free tier.

4. How We Use Your Data

  • To provide and maintain the Service
  • To issue and authenticate API keys
  • To send you your API key and onboarding information
  • To monitor usage and enforce rate limits
  • To improve search quality and relevance
  • To communicate service updates or changes

We do not sell your personal data. We do not use your search queries for advertising.

5. Legal Basis (GDPR)

  • Contract performance: Processing necessary to provide the API service you signed up for
  • Legitimate interest: Security monitoring, abuse prevention, service improvement
  • Consent: Waitlist signup and optional communications

6. Data Sharing

We share data only with:

  • Infrastructure providers: Hosting (Hetzner, Germany), DNS, and CDN services necessary to operate the Service
  • Analytics processor: PostHog (EU-hosted, Frankfurt), under a data-processing agreement, for the reach measurement and analytics described in Section 3
  • Affiliate networks: When you click a purchase link, the affiliate network may receive a click identifier. No personal data is shared by us.

We do not share your data with advertisers, data brokers, or other third parties for their own purposes.

7. Data Storage & Security

Your data is stored on servers in Germany (Hetzner). API keys are stored as hashed values — we cannot retrieve your original key. We use encryption in transit (TLS) and follow industry-standard security practices.

8. Data Retention

  • Account data: Retained while your account is active, deleted within 30 days of account deletion
  • API logs: Retained for 90 days for debugging and abuse prevention, then deleted
  • Waitlist data: Retained until you are onboarded or request deletion

9. Your Rights (GDPR)

You have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate data
  • Erase your data ("right to be forgotten")
  • Restrict processing of your data
  • Port your data to another service
  • Object to processing based on legitimate interest
  • Withdraw consent at any time

To exercise any of these rights, email [email protected]. We will respond within 30 days.

10. International Transfers

Your data is processed and stored within the EU (Germany). We do not transfer personal data outside the European Economic Area unless required by a sub-processor with appropriate safeguards (Standard Contractual Clauses).

11. Changes to This Policy

We may update this policy from time to time. We will notify registered users of material changes via email. The "Last updated" date at the top reflects the most recent revision.

Contact

Questions about your privacy? Email us at [email protected].