Legal
Privacy Policy
Last updated 4 August 2026
A working draft prepared for launch. Have it reviewed by a lawyer before relying on it, particularly if you serve customers in the EU or UK.
The short version: we store your email, your API keys and a log of the API calls you make. We do not sell any of it, and we do not build profiles of the people whose public data passes through the API.
01 What we collect about you
Account: your email address, an optional name, and a hashed password. We never store your password itself.
Billing: handled by Polar Software Inc. as merchant of record. We receive a customer reference and subscription status. We never see or store your card details.
Usage: for each API call we record the endpoint, timestamp, HTTP status, response time, credits consumed, your IP address and user agent. This is what lets you see your own usage and lets us enforce quotas and investigate abuse.
02 Data that passes through the API
When you call an endpoint we fetch publicly available information from the relevant platform and return it to you. We cache successful responses briefly to reduce load on the upstream source and to speed up repeated requests.
We do not build profiles of the individuals whose public data is returned, and we do not retain that data beyond the short-lived cache.
You are the controller of any personal data you choose to retain from API responses, and you are responsible for having a lawful basis to process it.
03 Why we are allowed to hold it
To provide the service you asked for (performance of a contract).
To bill accurately and prevent abuse (legitimate interests).
To meet accounting and tax obligations (legal obligation).
04 How long we keep it
Account records: for as long as your account exists, then deleted.
Usage logs: retained on a rolling basis for operational and billing purposes, then removed.
Cached API responses: minutes, per endpoint. Nothing is retained long-term.
Billing records: kept as long as tax law requires, by Polar and by us.
05 Who else sees it
Polar Software Inc. — payments and invoicing.
Cloudflare, Inc. — network delivery in front of the API.
Our email provider — transactional email only, such as sign-in codes and password resets.
We do not sell personal data, and we do not share it for advertising.
06 Where it is processed
The service runs on infrastructure operated by us, with network delivery through Cloudflare. Some processors are located outside your country; where required we rely on standard contractual clauses.
07 Your rights
You can access, correct or delete your account data from the dashboard, or by writing to us. Deleting your account removes your keys and usage history.
You can ask for a copy of your data, ask us to restrict processing, or object to it. If you are in the EU or UK you may also complain to your local supervisory authority.
08 Security
Traffic is encrypted in transit. Passwords are hashed. API keys are shown once at creation and are masked everywhere afterwards. Access to production is limited to the operator of the service.
If a breach affects your data we will tell you without undue delay.
09 Cookies
We set a session cookie so you stay signed in to the dashboard, and a CSRF cookie to protect forms. We do not use advertising or tracking cookies.
10 Contact
Privacy questions or requests: [email protected]
REALITECH COMPANY LIMITED