Privacy Policy

📅 Effective Date: October 22, 2026

1. Data Controller

This Service is operated as a stateless intelligence API. For any privacy queries or data protection requests, please contact: support@postcodecontext.uk.

2. What Information We Process

We believe in strict data minimisation under UK GDPR:

Query Parameters: The postcode or district requested (e.g. SW1A 1AA or BB7) to retrieve public records.
Public Wallet Addresses (Optional): If you pay via the x402 protocol, your public EVM wallet address is processed on-chain to verify the signed USDC micropayment voucher.

3. What We DO NOT Collect

No names, physical personal addresses, or phone numbers.
No account logins, passwords, or persistent client IP logs.
No credit card or banking details (payments are processed via on-chain USDC, RapidAPI Gateway, or Apify).
No tracking cookies, marketing pixels, or third-party behavioral analytics.

4. Lawful Basis for Processing (UK GDPR Article 6)

We process data under the following lawful basis:

Legal Obligation & Contractual Necessity (Article 6(1)(b) & (c) UK GDPR): Recording commercial transaction receipts (blockchain transaction hash, public payer wallet, timestamp, and USDC amount) for 6 years to comply with statutory accounting requirements under the Companies Act 2006 and HM Revenue & Customs (HMRC) tax regulations.

5. Data Retention & Automated Purging

Commercial Transaction Ledger (HMRC Compliance): For paid API requests (x402 protocol and RapidAPI Gateway calls), an immutable transaction record (date, transaction hash, payer wallet, amount USDC, and endpoint) is retained in our secure database for 6 years as required by UK tax and corporate reporting law, after which records older than 6 years are automatically purged by our daily scheduled job (running at 03:00 UTC). Client IP addresses are strictly excluded from this financial ledger to preserve user privacy and data minimisation.

6. Sub-Processors & Infrastructure

Our serverless infrastructure is hosted on:

Cloudflare, Inc.: Edge server execution, DDoS protection, and serverless SQLite database (Cloudflare Workers & D1).
Base Network (Coinbase): Decentralised public blockchain ledger for on-chain cryptographic settlement receipts (if x402 micropayments are selected).

7. Your Rights under UK GDPR

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have rights including the right to request access to or erasure of your personal data. Because we maintain no persistent user accounts and store zero client IP addresses in our database, we hold no permanent personal records.