Privacy Policy

This policy covers the Hesapis Market Data WordPress plugin and our embeddable JavaScript widget. We do not sell or hand out general API access, so there is no separate API customer relationship to describe here. If you are simply reading hesapis.com, the policy that applies to you is our Privacy Policy (Turkish) and our KVKK notice.

1. The WordPress plugin: your visitors never reach us

The plugin runs on your server. Your visitor's browser calls admin-ajax.php on your own site; your WordPress installation then calls us, server to server. Nothing about your visitor is part of that conversation.

Each of those requests carries exactly four things:

• Your key — as an api_key query parameter and an X-API-Key header.
• Your site's domain — the host part of your WordPress home URL.
• Which dataset you asked for — gold, currency, crypto or international majors.
• A User-Agent line naming the plugin version and your WordPress version, for example Hesapis-WP-Plugin/2.4.8 (WordPress/6.8).

Requests use HTTPS with certificate verification switched on. The plugin's health check is a separate call to a public endpoint carrying no key and no parameters. On this path we keep no per-request log: your server's IP address is read once, only to recognise requests coming from our own machine, and is not stored.

2. The JavaScript widget: your visitors do reach us

The widget script runs in your visitor's browser and fetches prices from us directly. That is an ordinary web request, so their address does reach our server. What we then write to a usage record is deliberately less than what arrives:

• A shortened form of your visitor's IP address. The last part is dropped before anything is written, so what we hold identifies a network, not a person (for example 203.0.113.0 rather than 203.0.113.47).
• Which site the widget was on — the referring address reduced to its domain. The path and query string are discarded, so we never learn which page was being read.
• The first eight characters of your key, with the rest masked.
• Your site's domain and which widget was requested.
• A timestamp.

These records are kept in one file per day. Each file holds at most the newest 10,000 entries, and files older than 180 days are deleted automatically. Records written before this policy took effect were shortened in the same way, so no full address remains in them either.

If you do not want your visitors' addresses reaching us at all, use the WordPress plugin instead of the widget: on that path the request comes from your server and your visitors stay invisible to us.

3. What we ask for when you register

Getting a key from the registration page requires:

• Domain — required. The key is issued for this site.
• E-mail address — required. We use it to deliver the key and to reach you about that key, for example if a limit is raised or a key has to be disabled.
• Site name — optional, so the key is recognisable in your own records.

Alongside the key we store the domains it is valid for, whether it is enabled, its per-minute request limit, and the network address you registered from — in the same shortened form as above, with the last part dropped.

4. No cookies, no browser storage

Neither the plugin nor the widget sets a cookie, and neither writes to localStorage, sessionStorage or IndexedDB in your visitors' browsers. Neither reads your posts, users, orders or any other data on your site.

5. Sharing

We do not sell, rent or share your registration details, your key or the usage records with anyone. The market data we return is aggregated from public and licensed financial sources; that flow runs towards you and carries nothing about you or your visitors.

6. Your choices

• Keep your visitors out of it: use the WordPress plugin rather than the browser widget (see sections 1 and 2).
• Stop sending anything: remove the widget snippet or deactivate the plugin. With nothing installed there is no request.
• Delete your key and registration: write to us from the address you registered with and we will remove the key record and the e-mail address.
• Ask what we hold: write to us and we will tell you. In practice it is what sections 2 and 3 describe.

7. Changes

If what we collect changes, this page changes with it and the review date at the top moves. That date is read from the file itself, so it cannot drift away from the text.