Privacy Policy

Last updated 2026-10-25.

Controller

Vasilis Totskas, Kalama 25, 10443 Athens, Greece. Contact: vassilistotskas@msn.com.

What we process, and for how long

• Request logs: IP address, URL, request headers and errors, kept 7 days to run and secure the service. Production logs a sample of requests, not all of them.
• Free-tier rate limiting: a counter per IP address, deleted after 1 hour.
• Cache: the parameters of a cacheable request and its result, kept for the time you choose, at most 24 hours.
• Receipts and feedback: per-call payment receipts, and feedback documents you post, kept 30 days.
• Payment events: for paid calls, the route, amount, network, transaction and payer wallet address, kept 3 months to account for payments and measure reliability. On-chain payments are also public on their blockchain, permanently.
• Prepaid accounts: we keep the following for as long as the account exists, and afterwards for as long as tax law requires:
  • a random account id;
  • a one-way hash of the API key (never the key itself);
  • the balance;
  • a ledger of purchases (Stripe Checkout Session ids) and calls (request ids and amounts).
  We do not receive your card details. Link and Stripe process your name, email, card and billing address as merchant of record, under Stripe's privacy policy.
• Content you ask us to fetch: pages, queries and documents are processed only to answer your request, and cached only as described above.

We set no cookies, run no advertising, and do not sell or profile personal data. No decisions about you are made by automated means.

Legal bases

We process this data on these bases under the GDPR:

• performing our contract with you (Art. 6(1)(b));
• our legitimate interest in keeping the service secure and free of abuse (Art. 6(1)(f));
• our legal obligations, such as keeping tax records (Art. 6(1)(c)).

Who receives data

• Cloudflare: hosting, logs and storage.
• Stripe and Link: card payments.
• Coinbase (CDP) and PayAI: verifying and settling x402 payments.
• Anthropic: the page content and questions sent to AI-backed endpoints.
• Serper and SerpAPI: search queries.

Some of these providers are in the United States. Transfers rely on the safeguards they offer: the EU–US Data Privacy Framework or Standard Contractual Clauses.

Your rights

You can ask for access to your personal data, or for its correction, erasure, restriction or portability, and you can object to processing. Email vassilistotskas@msn.com. You can also complain to the Hellenic Data Protection Authority (dpa.gr) or to the authority where you live.