Privacy Notice

Effective: 2026-05-20 · Last updated: 2026-09-11

        Short version: We never store or cache your Binance API secret at all — it is used transiently for each request and then discarded. We do not use cookies, analytics, or trackers. We collect only the minimum technical data needed to operate the conversion service.
    

1. Who is the controller?

The data controller is ESA DEVELOPMENT s.r.o., Company ID (IČO): 23008393, registered office: Čelakovského 1074/18, 430 01 Chomutov, Czech Republic (Commercial Register: Regional Court in Ústí nad Labem, file no. C 53630). For privacy enquiries, contact info@bnfcrconvert.com.

2. What data we collect

Category	Field	Stored?	Retention
API credentials	Binance API key	SHA-256 hash, first 16 hex chars only	Indefinite (used to bind invoices to user)
API credentials	Binance API secret	Not stored — used transiently per request, never cached or written to disk	None (discarded after each request)
Invoice	invoice_id, conversion_amount, fee_amount, fee_address, fee_chain, asset, chain, status, timestamps, txid	SQLite database; the issued invoice document is also archived as a text file	Indefinite (tax evidence)
Invoice e-mail (optional)	E-mail address, only if you enter one when creating the invoice	SQLite database, as part of the invoice record; passed to our e-mail provider (Resend) for each message sent to you	Same as the invoice record
Conversion result	BNFCR spent, BNB received, error	SQLite database	Indefinite (tax evidence)
Server logs	IP address, request line, user-agent, status code	System logs	90 days
E-mail correspondence	Your e-mail address and message, if you write to support@ or info@	Operator inbox (there is no contact form on the site)	Per operator inbox policy

3. What data we do NOT collect

Your real name, postal address, phone number, date of birth, or national ID
Your Binance account balance beyond what is needed for the conversion itself
Your bank account details, card details, or fiat payment data
Cookies, browser fingerprints, or analytics events. The site uses no tracking technologies.
Cross-site tracking. There is no integration with Google Analytics, Facebook Pixel, or similar.

4. Why we collect it (legal basis)

API key hash + invoice records: contract performance (GDPR Art. 6(1)(b)) — required to execute the conversion you requested.
Fee ledger + conversion ledger + tax fields: legal obligation (GDPR Art. 6(1)(c)) — Czech accounting and tax law requires us to retain records of fees received.
Optional invoice e-mail: contract performance (GDPR Art. 6(1)(b)) — used only to send you the payment request, the invoice once your fee payment is received, and the conversion receipt. Leave the field empty and no e-mail is sent or stored.
Server logs: legitimate interest (GDPR Art. 6(1)(f)) — security, abuse prevention, and incident response.
E-mail correspondence: legitimate interest (GDPR Art. 6(1)(f)) — responding to your enquiry.

5. Third parties

We share data with the following third parties strictly as needed to operate the Service:

Binance — your API key and secret are sent directly from your browser session through our server to Binance to execute the swap on your account. We act only as a relay; the operation occurs on your own Binance account.
Bybit — we query Bybit's deposit-history API to verify your fee payment. We send no personal data; only the deposit address, asset, chain, and timestamp window. Bybit returns deposits to our deposit address, not yours.
BscScan — for fee payments on BSC we look up the transaction by its hash to confirm it on-chain. The hash is public blockchain data; no personal data is sent.
Resend (Resend, Inc., USA) — transactional e-mail provider. Only if you entered an e-mail address, it receives that address and the message content (payment request, invoice, conversion receipt: invoice ID, amounts, fee address, transaction ID). Messages are sent through Resend's EU region (eu-west-1, Ireland).
DigitalOcean — infrastructure provider for the server. They have access to encrypted-at-rest disk and inbound traffic logs.
Forpsi — registrar of bnfcrconvert.com and provider of the incoming mailboxes for support@ and info@. They process e-mail you send to us.
Let's Encrypt — TLS certificate issuance for HTTPS. No personal data shared.

We do not sell data. We do not share data for advertising. Beyond what is intrinsic to the public Binance / Bybit / blockchain APIs you interact with, the only transfer outside the EEA we initiate is the optional e-mail delivery through Resend: we use its EU sending region, but Resend, Inc. is a US company and may access the e-mail address and message content from the United States under its own data processing terms.

6. Your rights (GDPR)

Right of access (Art. 15): you can request a copy of all data we hold about you
Right to rectification (Art. 16): correction of inaccurate data
Right to erasure (Art. 17): deletion, subject to overriding legal obligations (tax records must be retained for the period required by Czech accounting law)
Right to restriction (Art. 18)
Right to data portability (Art. 20): export in a structured machine-readable format
Right to object (Art. 21): especially for processing based on legitimate interest
Right to lodge a complaint with the Czech supervisory authority (Úřad pro ochranu osobních údajů, uoou.cz)

To exercise any of these rights, contact info@bnfcrconvert.com. We will respond within 30 days.

7. Data security

HTTPS (TLS 1.2+) on all traffic via Let's Encrypt
API secrets are never stored or cached — they are used transiently for each request and discarded, never written to disk
API keys hashed before persistence (SHA-256 truncated to 16 hex chars)
Server access restricted to operator personnel via SSH key authentication
No cookies, no localStorage, no third-party scripts

No method of transmission or storage is 100% secure. You assume the risk of any breach.

8. Children

The Service is not directed at and not available to anyone under 18 years of age. We do not knowingly collect data from anyone under 18.

9. Changes

This notice may be updated by publishing a new version at this URL. The "Last updated" date will reflect the change. Material changes will be highlighted on the homepage for at least 14 days.

10. Contact

Privacy enquiries and GDPR rights requests: info@bnfcrconvert.com

Other support: support@bnfcrconvert.com

← Back to converter