Privacy policy
Privacy, in plain language
Effective: 2026-09-11, revised 2026-09-19. Data controller: apifare is operated by its founder as a sole operator pending Hong Kong incorporation; on incorporation the HK company becomes the controller and this line names it. Questions or requests: POST /v1/support or GitHub issues.
What we collect
Your email address (the account identifier), call metadata — route, price, latency, status — and the append-only ledger and signed audit chain your account generates. We log request IPs for rate-limiting and abuse prevention. When a catalog search finds nothing, we store the search text as a demand signal (llms.txt says the same to agents). We never log the request or response bodies of your API calls — they pass through memory and are not persisted anywhere.
What we deliberately never see
Card numbers (Stripe processes payments; we store only Stripe's references). Vaulted keys in the clear: keys you vault are encrypted per-tenant at rest, decrypted only in memory at call time, never logged, and no endpoint returns them.
Transactional email (receipts, account notices) is sent because you use the service. Marketing email is sent only if you ticked the opt-in box at signup — it is unchecked by default — and every message carries an unsubscribe that works.
Who processes data for us
Fly.io (hosting), Supabase (database), Stripe (payments), Resend (email delivery), and the upstream API providers — which receive exactly the request your agent sends through them, nothing else. We do not sell data, run ads, or use one account's data for another account.
Retention and deletion — per component
Request/response bodies: never stored, so there is nothing to retain — the only component with a zero-retention guarantee by construction. Call metadata, ledger, audit chain: kept for the life of the account; append-only by design. Rate-limit counters (IPs): expire automatically within 24 hours. Search-miss text: kept as a product demand signal; ask via support and yours is removed. Vaulted keys: encrypted ciphertext kept until you delete the key or the account. One-time links (vault, recovery): single-use and expire within minutes.
Ask us to delete your account via POST /v1/support: personal identifiers are removed; ledger and audit rows are retained as required financial records, de-linked from you. The audit chain for your own account is exportable by you at any time.
Written to comply with the HK PDPO; the formal legal review lands with the HK cutover. See also the terms of service.