APIPurse — Privacy Policy
Last updated: October 10, 2026
1. Who controls your data
Yem Consult BV (VAT/company number BE1001.251.321), registered office at Zwarte Leeuwstraat 50, 2820 Bonheiden, Belgium ("we", "us", "APIPurse"), is the data controller for the personal data described in this policy.
Privacy contact: privacy@apipurse.com
This policy applies to the APIPurse website, application, and API (the "Service"), and should be read together with our Terms of Service.
2. What personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, hashed password (managed by our authentication provider, Supabase) | You, at signup |
| Billing data | Name, billing address, payment method details, tax ID (if provided) | You, collected and stored directly by Stripe and Link (the merchant of record for paid subscriptions) — we do not store full card numbers and receive only limited data such as your email, plan, and subscription/transaction status |
| Team data | Email addresses of people you invite | You (account owner) |
| Connected-provider credentials | API keys, tokens, or webhook secrets for OpenAI, Anthropic, Stripe, AWS, Twilio, or a custom API you connect | You, when you connect a provider — stored encrypted, never shown again in the UI after entry |
| Usage and cost data | Amounts, timestamps, provider/model names, and (optionally) a free-text key label you choose to attach | Pulled automatically from providers you connect, or pushed by you via the ingest API |
| Preference data | Display currency, language, theme, notification settings (including a Slack webhook URL if you configure one) | You |
| Technical data | IP address, browser/device information, request logs | Automatically, via standard web server and hosting logs (Vercel) |
| Communications | Support emails, messages you send us | You |
We do not intentionally collect the content of your API calls (e.g. prompts, model completions, your end customers' payment details) — only the cost, token-count, or amount figures needed to compute spend, as described in Section 3.
3. How and why we use your data
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Provide and operate the Service (dashboard, budgets, tracking) | Account, usage/cost, preference data | Performance of a contract with you |
| Process payments and manage your subscription | Billing data (via Stripe) | Performance of a contract |
| Send budget/anomaly alerts and transactional email | Account data, alert content, Slack webhook URL | Performance of a contract |
| Provide customer support | Account data, communications | Performance of a contract / legitimate interest |
| Maintain security, detect abuse, enforce rate limits, monitor errors and availability | Technical data, account data | Legitimate interest |
| Comply with legal obligations (e.g. tax records) | Billing data | Legal obligation |
| Improve the Service (aggregated, non-identifying analysis) | Usage patterns (aggregated) | Legitimate interest |
We do not sell personal data, and we do not use your data to train any AI model.
Providing your data. Your account data is necessary to create an account and use the Service, and billing data is necessary to purchase a paid plan; without it we cannot provide these. Other data is optional. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you, and we do not profile you.
4. Who we share data with (sub-processors)
We use the following sub-processors to operate the Service. Each is bound by a data processing agreement requiring GDPR-equivalent protection.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, encrypted storage | EU (Frankfurt region) |
| Vercel | Application hosting, request logs | Global edge network; primary application processing in the United States (Washington D.C. region). Vercel is certified under the EU-U.S. Data Privacy Framework and also relies on Standard Contractual Clauses as an additional transfer safeguard. |
| Resend | Transactional email delivery (alerts, invites) | Emails are sent from the EU (Ireland, eu-west-1). Account-level data (delivery logs, metadata) is processed in the United States regardless of sending region, covered by Standard Contractual Clauses in Resend's DPA and Resend's participation in the EU-U.S. Data Privacy Framework. |
| Sentry | Error and performance monitoring (error reports may include IP address, browser/device information and the page URL) | EU (Germany) |
| Upstash | Rate limiting of API requests (short-lived counters keyed by IP address or account identifier; no content data) | EU (Frankfurt, Germany) |
| Stripe (including Link) | Merchant of record and payment processing for your APIPurse subscription: checkout, billing, tax, receipts, refunds, fraud prevention, disputes, transaction support | Global; for paid subscriptions Stripe/Link acts as the merchant of record and as an independent data controller for billing and payment data — see Stripe's privacy policy and Link's privacy notice |
Important distinction: OpenAI, Anthropic, AWS, and Twilio are not our sub-processors. When you connect one of these providers, APIPurse calls that provider's API directly, using credentials you supply, solely to retrieve your own cost/usage totals. You have your own direct relationship and contract with that provider, governed by their own privacy policy; we do not send them any personal data of yours beyond what is inherently required to authenticate the API call with your own credentials.
Where a sub-processor is located outside the European Economic Area, transfers are made under the European Commission's Standard Contractual Clauses, the EU-U.S. Data Privacy Framework, or an equivalent adequacy mechanism. You may request a copy of the relevant safeguards at privacy@apipurse.com.
We will update this list if we add or remove a sub-processor, and — where required by our agreement with you — provide advance notice so you may object.
5. How long we keep your data
- Account data: for as long as your account is active, and for 30 days after deletion to allow account recovery, then deleted or anonymized, except where retention is required by law.
- Usage/cost records: kept in full detail for 90 days, after which older records are automatically rolled up into daily summary totals per provider (to keep the database efficient) — the underlying totals are preserved, but per-call granularity is condensed. Your plan's history window (30 days on Free, 365 days on Pro, unlimited on Team) controls what is *displayed*, not what is *stored*; rolled-up historical totals are retained until you delete your account.
- Billing records: retained for the period required by applicable tax and accounting law (typically 7 years in Belgium).
- Backups: our database provider keeps daily backups for a limited period; deleted data is overwritten in the ordinary backup cycle, within approximately 30 days.
- Support communications: retained for 1 year or as needed to resolve your query and for quality/legal purposes.
6. How we protect your data
- Connected-provider API keys and webhook secrets are encrypted at rest before being written to the database and are never displayed again in the interface after entry.
- All traffic to the Service is encrypted in transit (HTTPS/TLS).
- Access to customer data within our database is restricted using row-level security, so each account can only read its own data (or, for Team accounts, data shared within that team).
- We apply security response headers (including HSTS, a restrictive Content-Security-Policy, and clickjacking protection) and rate-limit token-authenticated endpoints.
- We periodically review the Service for security issues and remediate findings.
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
7. Data breach notification
If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required by Article 33 GDPR, and will notify you without undue delay where the breach is likely to result in a high risk to you, as required by Article 34 GDPR.
8. Your rights
If you are located in the EU/EEA, UK, or another jurisdiction with equivalent protections, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate data;
- Erase your data ("right to be forgotten"), subject to our legal retention obligations;
- Restrict or object to certain processing;
- Port your data to another provider in a structured, machine-readable format;
- Withdraw consent at any time, where processing is based on consent;
- Lodge a complaint with your local data protection supervisory authority — in Belgium, the Belgian Data Protection Authority.
To exercise any of these rights, contact us at privacy@apipurse.com. We will respond within one month, as required by GDPR. For billing and payment data held by Stripe/Link as merchant of record, you can also make requests (including deletion of your purchase data and Link account) directly with Stripe/Link; a deletion request there also cancels subscriptions sold through Managed Payments.
If you are located in California or another US state with a comprehensive privacy law (e.g. CCPA/CPRA), you have broadly similar rights to know, delete, correct, and opt out of the sale or "sharing" of personal data. We do not sell or share personal data as those terms are defined under such laws. To exercise these rights, use the same contact above.
Wherever you are located, you may contact us at any time to ask what data we hold about you or to request deletion, and we will make reasonable efforts to honor that request in line with applicable law.
9. Cookies
We use only strictly necessary/functional cookies:
- An authentication/session cookie (to keep you logged in) — set by Supabase Auth.
- A language preference cookie.
- A theme (light/dark mode) preference cookie.
We do not currently use advertising, analytics, or cross-site tracking cookies. If this changes, we will update this policy and, where required by law, request your consent via a cookie banner before setting non-essential cookies.
10. Children's privacy
The Service is not directed at, and we do not knowingly collect personal data from, individuals under 16 years of age. If you believe a child has provided us with personal data, contact us and we will delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice via email or in-app notice before the change takes effect.
12. Contact us
Yem Consult BV (VAT/company number BE1001.251.321) Zwarte Leeuwstraat 50, 2820 Bonheiden, Belgium privacy@apipurse.com
For EU/EEA data subjects: you also have the right to lodge a complaint with your local supervisory authority at any time.