Privacy policy

Who we are

This website is run by the operator of cxrates.com, who is the data controller for the personal data described here under UK data protection law (the UK GDPR and the Data Protection Act 2018).

For any question about this policy or your data, email: alex@alexfilatov.com

What we collect, and why

Server logs. Like every website, our server receives your IP address, browser and device details, the page you asked for, the page that linked to it and the time. We use these logs to keep the site running and secure, for example to investigate errors and abuse. Lawful basis: legitimate interests.
Page-view statistics (Umami). We count visits with Umami, which sets no cookies and stores nothing on your device. It records the page, the referring site, your browser, operating system, device type and country. It uses your IP address only to work out your country and to tell visits apart, and does not store it. Lawful basis: legitimate interests, in knowing which pages are useful.
Google Analytics, only if you accept. If you press Accept on the cookie banner, we load Google Analytics 4. It records the pages you visit, the site you came from, your approximate location (city and country), your device, browser and operating system, and interactions such as clicks and scrolls. Google Analytics 4 does not log or store IP addresses. We use it only for aggregated statistics. If you press Reject, or do nothing, it never loads. Lawful basis: consent.
Embedded rate widgets. Other websites can embed our rate widgets. When you view one, your browser asks our server for rates, so our server logs receive the request as described above, including the address of the page the widget sits on. The widget sets no cookies, uses no browser storage and loads no analytics. From each request we keep only a daily count per website domain, so we know which sites use the widgets; that count holds nothing about you. Lawful basis: legitimate interests.
Administrator accounts. Visitors cannot create accounts. The few people who run the site have accounts, and for them we store an email address, a hashed password and login records. Lawful basis: legitimate interests, in securing the site.

We do not sell your data, use it for advertising, or combine it with other data to identify you. We do not send email to visitors.

Who receives it

Hetzner Online GmbH hosts our server and database in the EU, and so processes the server logs on our behalf.
Our Umami statistics are processed on a self-hosted Umami server in the EU, at this address: stats.mavlin.com
Google (Google Ireland Limited and Google LLC) receives Google Analytics data, and only if you accept.

The exchange rates themselves come from the European Central Bank via Frankfurter, ExchangeRate-API, CoinGecko and Binance. Our server fetches them on its own schedule; none of your data is sent to them. Fonts and scripts on this site are served from our own server, apart from the analytics named above.

International transfers

Google may process Google Analytics data outside the UK and the EEA, including in the United States. Those transfers are protected by Standard Contractual Clauses and by the EU-US Data Privacy Framework, with its UK extension. Everything else stays in the EU, which the UK recognises as giving adequate protection.

How long we keep it

Server logs: only as long as needed to run and secure the site, and then deleted.
Umami statistics: kept as aggregated counts, which cannot be traced back to you.
Google Analytics: event data is kept for a limited period, using Google Analytics' default retention setting.
Widget usage: daily counts per website domain, kept indefinitely.
Administrator accounts: for as long as the account exists.

Cookies and browser storage

Name	What it does	How long	Needs consent
`_cx_rates_key`	Session cookie. Holds a security token that protects the site against forged requests, and the login of an administrator.	Until you close your browser	No, strictly necessary
`cookie_consent`	Remembers whether you accepted or rejected Google Analytics.	6 months	No, strictly necessary
`_ga`	Google Analytics: tells one visitor from another.	Up to 2 years	Yes
`_ga_<ID>`	Google Analytics: keeps track of your visit.	Up to 2 years	Yes
`_cx_rates_web_user_remember_me`	Keeps an administrator signed in. Never set for visitors.	14 days	No, strictly necessary
`phx:theme`	Browser storage, not a cookie. Remembers the light or dark theme you picked, and only if you picked one. It never leaves your device.	Until you change it	No, you asked for it

Embedded widgets on other websites set no cookies and use no browser storage. Umami sets no cookies either.

Changing your mind

You can change your answer at any time with the Cookie settings button at the bottom of every page. If you withdraw consent, we delete the Google Analytics cookies and stop loading it. You can also block cookies in your browser.

Your rights

You have the right to ask for a copy of the personal data we hold about you, and to have it corrected or deleted. You can also ask us to restrict its use, object to it, or receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Email us at the address above and we will reply within one month.

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office, the UK data protection regulator. Complain to the ICO

Changes to this policy

If what we collect changes, we will update this page and the date at the top before the change takes effect.