Privacy policy

2. What data we process

We process personal data only to the extent necessary to provide our service and to operate your account. In particular:

• Account data: the email address used for sign-in, your plan and credit balance, and account metadata.

• API usage data: the endpoints you call, timestamps, request counts and credit consumption, associated with your API keys.

• Payment data: the data required to process payments, handled directly by our payment provider Stripe; full card details are not stored on our systems.

• Communication data: the content and metadata of your support requests.

• Server log data: technical access data such as IP address, time of access, requested resource and browser/OS information.

3. Purposes and legal bases

• To perform the contract and provide the API (Art. 6(1)(b) GDPR).

• To comply with legal obligations, e.g. retention under commercial and tax law (Art. 6(1)(c) GDPR).

• To safeguard our legitimate interests in secure, stable and abuse-free operation (Art. 6(1)(f) GDPR).

• On the basis of your consent where given (Art. 6(1)(a) GDPR).

4. Authentication (Auth0)

Sign-in is handled via Auth0 (Okta, Inc.). When you log in, your email address and authentication metadata are processed to establish and secure your session. The legal basis is performance of the contract and our legitimate interest in secure authentication (Art. 6(1)(b) and (f) GDPR).

5. Hosting (AWS)

Our services are operated on Amazon Web Services (AWS). Technically necessary data is processed in server log files to ensure delivery, stability and security. The legal basis is our legitimate interest in a secure and functional service (Art. 6(1)(f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place.

6. Payment processing (Stripe)

Payments are processed via Stripe (Stripe Payments Europe, Ltd. and affiliates). The required data, in particular name, email and payment/billing details, is transmitted to Stripe and processed under its own responsibility. Legal basis: performance of the contract and our legitimate interest in secure, fraud-free payment (Art. 6(1)(b) and (f) GDPR).

7. Email delivery (Amazon SES / Resend)

To send transactional emails (account, purchase confirmations, notifications) we use an email delivery provider (Amazon SES or Resend). Your email address and the associated message data are processed. Legal basis: performance of the contract and our legitimate interest in reliable communication (Art. 6(1)(b) and (f) GDPR).

8. Web analytics (Google Analytics)

With your consent we use Google Analytics 4, a web analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It uses cookies (for example _ga, _ga_TWB068MPCG and _gid) to analyse how visitors use the website on an aggregated, pseudonymous basis; IP addresses are shortened within the EU beforehand. The service loads only after you accept the analytics category in our cookie banner, and no analytics cookie is set before that. Legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time with effect for the future via the cookie settings link in the footer. Data may be transferred to Google LLC in the USA; see the section on transfers to third countries.

9. Spam protection on the contact form (Google reCAPTCHA)

Our contact form is protected by Google reCAPTCHA v3, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC. When you use the form, reCAPTCHA processes your IP address as well as interaction and device data (for example mouse movements, timing and browser characteristics) to score whether the request originates from a human, and thereby to prevent spam and automated abuse. This runs in the background and does not require a puzzle. Legal basis is our legitimate interest in protecting the form against abuse (Art. 6(1)(f) GDPR). The Google Privacy Policy and the Google Terms of Service apply, and data may be transferred to Google LLC in the USA; see the section on transfers to third countries.

10. Fraud prevention at registration (IPQualityScore)

When a new account is created, we check the IP address used for sign-up against the IP reputation and fraud-detection service of IPQualityScore LLC (USA). This check runs as part of an Auth0 pre-registration action and serves to block fraud, VPN/proxy abuse and automated bot sign-ups. Processed data is your IP address and the risk signals derived from it; we do not use the service to profile you beyond this security purpose. Legal basis is our legitimate interest in preventing fraud and abuse and in the security of our service (Art. 6(1)(f) GDPR). Data may be transferred to the USA; see the section on transfers to third countries.

11. Recipients and processors

Your data is only transmitted where necessary to perform the contract, where legally required, or with your consent. Processors include: the hosting provider (AWS), the authentication provider (Auth0), the payment provider (Stripe), the email provider (Amazon SES or Resend), Google reCAPTCHA on the contact form to prevent spam and abuse (Google processes usage and device data such as the IP address for this; legal basis our legitimate interest under Art. 6(1)(f) GDPR, and the Google Privacy Policy and Terms of Service apply), IPQualityScore for fraud and abuse prevention at registration (processing the IP address on the basis of our legitimate interest under Art. 6(1)(f) GDPR) and, subject to your consent, the web analytics provider (Google). We conclude agreements pursuant to Art. 28 GDPR.

12. Transfers to third countries

The controller (B A Media Group FZE LLC) is based in the United Arab Emirates (a third country). Some providers may process data in third countries, in particular the USA. Any transfer takes place only under Art. 44 et seq. GDPR, e.g. on the basis of an adequacy decision, standard contractual clauses, or your consent.

13. Retention period

We store personal data only for as long as necessary for the stated purposes. Account and billing data is retained for the duration of the relationship and, beyond that, within statutory retention periods (generally up to 10 years). Server log data is stored only briefly and then deleted or anonymised.

14. Your rights

Under the GDPR you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7(3)).

To exercise your rights, an informal message to the contact details above is sufficient.

15. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe the processing of your data infringes the GDPR (Art. 77 GDPR).