How we collect, use, and protect your data.
Last updated: February 23, 2026
APICrate ("we", "our", "us") is operated by Apicrate sp. Z.o.o, Warszawa, ul. Grojecka 104. Poland (data controller). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our API services and website at apicrate.io and api.apicrate.io.
Please read this policy carefully. Where we rely on your consent as a legal basis for processing, we will ask for it separately. For all other processing, the legal bases are described in Section 10 below.
When you register for an API key or create an account, we may collect:
If you subscribe to a paid plan, we collect:
We automatically collect certain information when you use our APIs:
When you call our API endpoints, the data you submit (e.g. user-agent strings, hashes, postal codes) is processed in memory to generate a response and is not stored, logged, or persisted beyond the immediate request. We do not use API request payloads for analytics, model training, or any secondary purpose.
Our website uses cookies for essential site functionality and self-hosted analytics. We use Matomo (self-hosted) to understand how our website is used. Matomo data is not shared with any third party.
We use the information we collect for the purposes and legal bases listed below:
We do not sell, rent, or trade your personal information.
We may share your information only in the following circumstances:
We do not share data with any other third parties. An up-to-date list of sub-processors is available upon request at privacy@apicrate.io.
We implement appropriate technical and organizational measures to protect your data, including:
While we strive to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.
In the event of a personal data breach that poses a risk to your rights, we will notify the relevant supervisory authority within 72 hours and inform affected users without undue delay, in accordance with GDPR Articles 33 and 34.
Depending on your location, you may have the right to:
To exercise any of these rights, please contact us at privacy@apicrate.io. We will respond to your request within 30 days.
Our services may contain links to or integrations with third-party websites and services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies independently.
Our servers are located in the European Union (Hetzner, Germany). Your personal data is stored and processed within the EU.
Certain sub-processors (e.g. Stripe for payment processing) may process data outside the EU. Where this occurs, we ensure appropriate safeguards are in place, such as EU Standard Contractual Clauses (SCCs) or an adequacy decision by the European Commission.
If you are located in the European Economic Area, United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR).
Where we rely on legitimate interest, we have assessed that our interests do not override your rights and freedoms.
You have the right to lodge a complaint with your local data protection authority. Our lead supervisory authority is the [YOUR COUNTRY'S DATA PROTECTION AUTHORITY, e.g. Bundesbeauftragte für den Datenschutz (BfDI)].
Given the scale of our operations, we are not required to appoint a Data Protection Officer under Article 37 of the GDPR. For any privacy-related inquiries, please contact us at privacy@apicrate.io.
We use automated systems to enforce API rate limits and usage quotas. When your quota is exceeded, API requests are automatically rejected (HTTP 429). This processing is necessary for the performance of our contract with you and does not produce legal effects or similarly significant effects beyond temporary service restriction.
We do not use automated profiling to make decisions that produce legal effects concerning you.
Our services are not directed to children under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of our services after any changes constitutes acceptance of the updated policy.
If you have any questions or concerns about this Privacy Policy, please contact us at privacy@apicrate.io.