Privacy Policy

This Privacy Policy explains how Mango Labs LTDA (“Mango Labs”, “we”, “us”, or “our”), which operates the Xchanger website, API, and dashboard (collectively, the “Service”), collects, uses, and shares information when you use the Service. By using the Service, you agree to the practices described here.

Information we collect

• Account information. When you create an account we receive your name, email address, and authentication details through our identity provider (Clerk).
• API keys and usage. We store a hashed version of each API key you create, along with logs of the requests made with it — including the endpoint, request parameters, response status, and timing — so we can provide usage analytics and enforce rate and quota limits.
• Billing information. Paid subscriptions are sold by Paddle.com, our Merchant of Record, which collects your payment details, billing address, and tax information directly as an independent controller under its own privacy notice. We never receive or store your payment card details; from Paddle we receive only your Paddle customer and subscription identifiers, your plan and subscription status, and the billing period.
• Technical data. We may collect IP addresses and standard request metadata for security, abuse prevention, and rate limiting.

How we use information

• To provide, operate, and maintain the Service.
• To authenticate requests, enforce usage limits, and display your usage analytics.
• To process subscriptions and manage your plan.
• To detect, prevent, and address security issues, fraud, and abuse.
• To communicate with you about your account, changes to the Service, and support requests.

Legal bases for processing

We are the controller for the personal data we collect about users of the Service. Under the Brazilian General Data Protection Law (LGPD) and, where applicable, the GDPR, we rely on:

• Performance of a contract — to create your account, provide the API and dashboard, issue API keys, enforce your plan’s limits, and manage your subscription.
• Legitimate interests — to keep the Service secure and available (rate limiting, abuse and fraud prevention, error monitoring) and to understand and improve how the Service is used.
• Legal obligation — to keep records we are required to keep and to respond to lawful requests from authorities.

How we share information

We do not sell your personal information. We share it only with:

• Paddle.com, our Merchant of Record — for the sale of paid plans, subscription management and payments, and tax compliance and invoicing.
• Service providers that help us operate the Service — our identity provider (Clerk), hosting and database providers, and error monitoring (Sentry) — only as needed for them to perform those services.
• Professional advisers such as lawyers, accountants, and auditors, under confidentiality.
• Authorities, when required by law or to protect our rights and the safety of our users.

International transfers

We are based in Brazil, and some of our service providers (including Paddle, Clerk, our hosting providers, and Sentry) process data in other countries, such as the United States and the United Kingdom. When your data is transferred outside Brazil or, for users in the EEA or UK, outside those regions, we rely on the safeguards permitted by applicable law, such as standard contractual clauses or adequacy decisions.

Data retention

We retain account and usage data for as long as your account is active and as needed to provide the Service. Request logs are kept to power usage analytics and billing. When data is no longer needed for these purposes or to meet legal obligations, we delete or anonymize it. You may request deletion of your account and associated data at any time. Paddle retains billing and tax records for the periods required of it as Merchant of Record.

Security

We take appropriate technical and organizational measures to protect your information, including encryption in transit (HTTPS/TLS), access controls that limit who can reach production data, and hashing API keys before storing them. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your rights

Depending on your location, you may have the right to confirm whether we process your data and to access, correct, port, anonymize, or delete it; to object to or restrict processing; to be informed about the parties we share it with; and to withdraw any consent you have given. To exercise these rights, contact us using the details below; we respond within the timeframes required by law (for example, 15 days under the LGPD or one month under the GDPR). You may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD) or, in the EEA or UK, with your local data protection authority.

Cookies

We use only cookies and similar browser storage that are essential for the Service to work: sign-in and session cookies set by our identity provider (Clerk), and preferences such as your theme and sidebar state. On pricing and checkout pages, Paddle’s checkout script may set its own cookies to process payments and prevent fraud. We do not use advertising or third-party analytics cookies. You can block or delete cookies in your browser settings, but signing in to the dashboard requires them.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Contact us

The data controller responsible for your personal information is Mango Labs LTDA, enrolled under CNPJ 39.718.566/0001-99, with its registered office at R. São João Evangelista, 656, Belo Horizonte – MG, 30330-140, Brazil.

If you have questions about this Privacy Policy, contact us at hello@xchangerapi.com.