Privacy Policy

1. Introduction

API Direct ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and API services (collectively, the "Service").

We are based in the United Kingdom and operate in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Data Controller

API Direct is the data controller responsible for your personal data. If you have any questions about this Privacy Policy or our data practices, please contact us at support@apidirect.io.

3. Information We Collect

3.1 Account Information

When you create an account, we collect:

• Email address - Required for account creation and communication
• Password - Stored in hashed form; we never store plaintext passwords
• Name - If you sign up via Google OAuth, we may receive your name from Google

3.2 Payment Information

When you add a payment method, we store:

• Card details - Only the last 4 digits, card brand, and expiry date (full card details are stored by Stripe)
• Billing identifiers - Stripe customer ID and subscription ID for payment processing

3.3 Usage Data

When you use our API, we collect:

• API request logs - Endpoint called, timestamp, response latency, and whether the request succeeded or failed
• Cost data - Amount charged per request for billing purposes
• API key usage - Which API key was used for each request

We do not log the content of your API queries or the data returned in API responses.

3.4 Information We Do Not Collect

We do not collect:

• IP addresses in our application logs
• Tracking cookies or analytics data
• Behavioural or browsing data
• Location data
• Device fingerprints

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process payments and manage your account
• Send transactional emails (e.g., welcome emails, payment confirmations)
• Respond to your enquiries and provide customer support
• Monitor and analyse usage patterns to improve the Service
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

5. Legal Basis for Processing

Under UK GDPR, we process your personal data based on the following legal grounds:

• Contract performance - Processing necessary to provide our Service to you
• Legitimate interests - Processing necessary for our legitimate business interests, such as improving our Service and preventing fraud
• Legal compliance - Processing necessary to comply with our legal obligations
• Consent - Where you have given consent for specific processing activities

6. Data Sharing and Third-Party Services

We share your information with the following categories of third-party service providers who assist us in operating the Service:

We do not sell your personal data to third parties. We may disclose your information if required by law or in response to valid legal requests from public authorities.

7. International Data Transfers

Some of our third-party service providers are located outside the United Kingdom. When we transfer your personal data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO), or transfers to countries with adequate data protection laws.

8. Data Retention

We retain your personal data for as long as necessary to:

• Provide the Service to you
• Comply with our legal and regulatory obligations
• Resolve disputes and enforce our agreements

When you delete your account, we will delete your personal data immediately, including your profile, API keys, and usage records. Some data may be retained in backups for a limited period as required by law or for legitimate business purposes.

9. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access - Request a copy of your personal data
• Right to rectification - Request correction of inaccurate data
• Right to erasure - Request deletion of your personal data
• Right to restriction - Request limitation of processing
• Right to data portability - Request transfer of your data in a machine-readable format
• Right to object - Object to processing based on legitimate interests
• Right to withdraw consent - Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at support@apidirect.io. We will respond to your request within one month.

You can delete your account and all associated data at any time through your dashboard settings.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit using TLS/HTTPS
• Hashing of passwords and API keys (we never store them in plaintext)
• Access controls and authentication for our systems
• Regular security reviews and updates

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

11. Cookies

We use only essential cookies necessary for the operation of our Service, such as authentication session cookies. We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

12. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on our website prior to the changes becoming effective. We encourage you to review this policy periodically.

14. Complaints

If you have concerns about how we handle your personal data, please contact us first at support@apidirect.io. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: support@apidirect.io