Privacy
Last updated 20 October 2026
This notice explains what 3L Group Consulting (PTY) LTD collects when you use usaref or any of its six sister services, why, and for how long. It describes what our systems actually record; if that changes, this page and its date change with it.
Request logs
For every request we record the time, host, method, path, HTTP status, an outcome label (for example free, paid, refused or unpaid), the response time, the first 256 characters of the user agent and, when your client sends one, the host name only of the referring site (never its path or query string).
We do not store your IP address. It is replaced, before anything is written, by a short salted SHA-256 hash: enough to count distinct callers and to apply rate limits and abuse blocks, not enough to recover the address. The one exception is a request to our payment webhook from an address that is not our payment provider’s, which is logged in full as a security event.
We never log request or response bodies, API keys, or payment headers and signatures. Request logs are kept in our server journal, which is trimmed by size rather than by date; at present it reaches back about nine weeks. A copy in the system log is kept for about five weeks.
Visitor statistics
Our web pages count visits without cookies. A small first-party script sends our own server the page and its title, the referring page (without its query string), your browser language and screen size; the server adds the time, an approximate location (country, region and city, looked up from your IP address, which is not stored), the browser, operating system and device type, and a visitor code: a hash of your IP address and browser made with a salt that changes every day and is deleted at midnight (SAST), so visits cannot be linked across days. Clicks on the free-key button and free-key sign-ups are counted the same way. Bots and automated browsers are left out.
Full records are kept for 90 days. After that only daily totals are kept (page, country, referring site, device type and counts); the visitor code, city, region, language, browser, operating system, screen size and the full referring address are deleted.
Payments
- x402 (USDC on Base). The payment you sign is passed to our payment facilitator (Coinbase Developer Platform) to settle. The settlement is public on the Base blockchain and outside our control. We record the paying wallet address, amount, transaction hash and time in a payment ledger, and our operators are notified of each sale with that wallet address. We keep this for accounting.
- Card. Paddle handles card payments as merchant of record. We never see or store card details. Paddle sends us the purchase email address, order reference, amount and number of calls so we can issue your API key; the key itself is held only until you collect it, then deleted. These purchase records are kept for as long as tax and accounting law requires.
- API keys are stored only as a SHA-256 hash, never in clear text, with a label, the remaining balance and a call count.
Change alerts, enquiries and security reports
- Alerts. If you register a webhook we store its URL, the series or documents it watches, the signing secret and delivery state, until you remove it or it is deactivated.
- Free API key. If you request a free key we store your email address, a normalised form of it used to allow one key per mailbox, a hash of the key, a hash of the single-use verification link, and counters that limit how often a link can be sent. We email only the verification link you asked for; we add nobody to a list. The address is kept while the key exists; ask us to delete it and the key is deactivated.
- Enquiry form. We store your message, the email address if you choose to give one, the hashed caller identifier and the user agent, and forward the message to our operators’ private alert channel. We reply only if you left an address; we add nobody to a list.
- Browser security reports. Content-Security-Policy violation reports are reduced to the page path, the directive and the blocked origin, and counted. No caller identifier is kept.
Who else processes data
- Cloudflare sits in front of all seven services for delivery and protection, and therefore sees each connection, including your IP address, under its own terms.
- Paddle (card payments), Coinbase Developer Platform (x402 settlement) and the Base blockchain, as described above.
- Telegram, which carries our internal operator alerts (sales with the paying wallet address, enquiries, faults).
- Microsoft SharePoint, where encrypted offsite backups of our database and server files are stored.
What we do not do
We set no cookies of our own and run no advertising or third-party analytics trackers. We do not sell or rent data and do not build profiles of callers. The pricing page loads Paddle’s checkout script, which is governed by Paddle’s own privacy policy when you open checkout.
Your rights
You may ask for access to, correction of, or deletion of personal data we hold about you, or object to its processing. Email [email protected] and we will respond within two business days. Deleting purchase data will deactivate any API key tied to it; records we must keep for tax purposes, and anything already public on a blockchain, cannot be erased. 3L Group Consulting (PTY) LTD is a South African company and processes personal information under the Protection of Personal Information Act; you may also complain to the Information Regulator of South Africa.