Privacy Policy

Effective date: 2026-08-05 Last updated: 2026-08-05

AllAPI ("we", "us", "our") is operated by Legal Eye Yazılım A.Ş., a company established in the Republic of Türkiye (Trade Registry No. 1020744; VKN 6081733803), with registered office at Sultan Selim Mah. Yamaç Sk. No:6 İç Kapı No:3, Kağıthane / İstanbul, Türkiye, trading as "AllAPI". We operate the HTTP API at api.allapi.io, the developer dashboard at app.allapi.io, the documentation at docs.allapi.io, the Model Context Protocol (MCP) tools, and related subdomains (collectively, the "Service").

This Privacy Policy explains what personal data we collect, why we collect it, on what legal basis, how we use and share it, how long we keep it, how we protect it, how we handle personal data of third parties that may appear inside data the Service returns, and the rights you and other data subjects have.

This Policy applies together with our Terms of Service and our Acceptable Use Policy. By using the Service you confirm that you have read and understood this Policy. Capitalized terms not defined here have the meanings given in the Terms of Service.

0. Our role and the two data-protection regimes that apply

We are the data controller (KVKK: veri sorumlusu; GDPR: controller) for the personal data described in this Policy, meaning we determine the purposes and means of processing.

Two data-protection regimes apply at the same time, and where they differ we apply the stricter standard:

• Türkiye — KVKK (Law No. 6698 on the Protection of Personal Data, Kişisel Verilerin Korunması Kanunu), because the controller (Legal Eye Yazılım A.Ş.) is established in Türkiye.
• EU / UK — GDPR / UK-GDPR (Regulation (EU) 2016/679 and the UK equivalent), because our infrastructure is hosted in the European Union / EEA and we offer the Service to users in the EU/UK.

Data controller identity, VERBİS and representatives:

• Controller: Legal Eye Yazılım A.Ş., address as above. Contact: [email protected].
• KVKK / VERBİS: Where registration with the Turkish Data Controllers' Registry (VERBİS) is required, we register and keep our entry current.
• EU / UK representative (GDPR Art. 27): Counsel to confirm whether an Article 27 representative in the EU (and/or a UK representative) is required for a Türkiye-established controller offering the Service to EU/UK residents, and to appoint one where required. The appointed representative's contact details will be inserted here.
• Data protection contact point: [email protected].

1. Scope — the two kinds of data we handle

This Policy covers two distinct categories of data, and it is important not to confuse them:

1. Customer personal data (§§2–13). Personal data about you — the account holder, dashboard user, or person contacting support. Here we are the controller and the ordinary rules below apply.

1. Third-party public data returned by the Service (§14). The Service is a unified gateway that retrieves only publicly available data, using anonymous, unauthenticated requests (no login, no acceptance of any upstream's account terms), and returns it in a normalized JSON envelope. Some of that returned data may itself contain personal data of third parties (for example, a public profile name that appears in a public search result). Our role, legal basis, and — importantly — the removal / objection mechanism for individuals whose public data appears in Service responses are addressed separately in §14.

2. Data we collect (customer personal data)

2.1 Account data (you provide)

• Email address — for login, verification and password-reset email, support, security notices, and billing correspondence.
• Password — stored only as a salted, one-way hash using a modern password-hashing algorithm. We never store your plaintext password.
• API keys — stored as a one-way hash in our database. The full key is shown to you once at creation; only a short prefix is retrievable afterward.
• Account profile / organization details — any name, company name, country, or tax identifier you choose to provide, and (for entity accounts) the fact that you act on behalf of your organization.
• Billing details for paid tiers — collected and processed by our Merchant of Record (Creem / Armitage Labs OÜ). We do not store card numbers. We retain invoice records (issue date, amount, tier, country, tax ID if applicable) received from the Merchant of Record.

2.2 Operational data (collected automatically)

For each API request we retain the following metadata:

• Timestamp
• Platform slug and route (which Upstream Source / endpoint was called)
• HTTP status code (including honest-refusal codes such as 502 upstream_walled, 503 upstream_unreachable, 429 rate_limited)
• Response size (bytes)
• Latency (milliseconds)
• Client IP address and user-agent
• X-Request-Id
• Whether the request was rate-limited, blocked, or flagged for abuse

For each account we retain aggregated per-tier counters used for quota enforcement, billing, and abuse detection.

2.3 Support and communications data

When you contact us (e.g. [email protected] or a support channel) we retain the content of your message, your email address, and any X-Request-Id or account identifier you include, so we can investigate and respond.

2.4 What we do not collect

• We do not log the JSON body you send with a request.
• We do not log the full response payload returned from Upstream Sources.
• We do not run behavioral analytics scripts or advertising trackers on your API traffic.
• We do not collect biometric, precise-geolocation, or health data about you.
• We do not ask for or store special-category / sensitive personal data (KVKK Art. 6 / GDPR Art. 9) about our customers as part of account provisioning.

3. Legal bases for processing

We process customer personal data only where we have a lawful basis. The bases below map to GDPR Article 6 and to KVKK Article 5 (and Article 6 for any special categories, which we do not routinely process).

Legitimate-interest balancing. Where we rely on legitimate interests (GDPR Art. 6(1)(f) / KVKK Art. 5(2)(f)), we have assessed that our interest in operating a secure, abuse-resistant Service does not override your fundamental rights and freedoms, because the data involved is limited operational metadata, retained for short periods, and not used to build profiles of you. You may object to this processing (§9).

Consent. We currently do not use tracking cookies or advertising networks, so we do not rely on consent for those purposes. If we ever introduce processing that requires consent, we will ask for it separately and you may withdraw it at any time without affecting prior processing.

4. How we use your data (purposes)

• Provide the Service — authenticate requests, apply rate limits and monthly quotas, return normalized responses.
• Support — reproduce and diagnose issues you report by referencing your X-Request-Id.
• Security and integrity — detect abuse patterns (per-IP spikes, credential stuffing, key reuse across accounts, coordinated bursts, tier-limit circumvention), enforce the Acceptable Use Policy, and respond to incidents.
• Billing — usage- and tier-based invoicing on paid tiers, via our Merchant of Record.
• Product improvement — identify performance regressions and prioritize endpoints, using aggregated, anonymized metrics only.
• Legal and compliance — respond to lawful requests from courts or regulators, meet tax/accounting duties, and preserve records required by law.

We do not use your personal data to make solely automated decisions that produce legal or similarly significant effects on you (§12).

5. Data retention

We keep personal data only as long as necessary for the purpose for which it was collected, or for a legally mandated period.

Where local law imposes a longer or shorter mandatory retention, that law prevails.

6. Data sharing and sub-processors

We do not sell your personal data. We share personal data only:

• With the sub-processors listed in §6.1 — infrastructure, payment, and communication providers who process personal data on our documented instructions only, under written data-processing agreements that impose security, confidentiality, and (where applicable) international-transfer safeguards.
• In a business transfer — a merger, acquisition, or sale of assets, subject to notice to you and to this Policy continuing to apply.
• To comply with legal obligations — court orders, subpoenas, or lawful requests from regulators or law-enforcement authorities.
• To protect rights and safety — including enforcing our Terms and Acceptable Use Policy, and protecting our users and the security of the Service.

6.1 Sub-processors

The Merchant of Record (Creem / Armitage Labs OÜ) is named because it is the seller for paid orders. For the other categories, a current list of the specific named sub-processors is available to customers on request at [email protected]. We keep this list current; material changes are announced per §15, and you may object to a new sub-processor as described there.

Merchant of Record note. For paid tiers, Creem (Armitage Labs OÜ, Estonia) acts as the seller / Merchant of Record. Creem collects your payment details directly, issues the invoice, and collects and remits VAT / sales tax. Your purchase is therefore also subject to Creem's own checkout terms and privacy notice. We receive from Creem only the invoice and billing-record data described in §2.1.

Third-party public data returned by the Service is not our personal data to share; the original publisher's own policies apply, and your onward use of it is governed by the Terms and the Acceptable Use Policy — see §14.

7. International transfers

Our infrastructure (servers and database) is hosted in the European Union / EEA. Because the data controller, Legal Eye Yazılım A.Ş., is established in Türkiye, your account and billing data may also be accessed from and processed in Türkiye, which has its own data-protection law (KVKK). Personal data may additionally be processed by the sub-processors listed in §6.1, in the locations shown there.

GDPR / UK-GDPR transfers. Where personal data of EU / UK residents is transferred outside the EEA / UK (including to Türkiye or to a sub-processor outside the EEA), we rely on an appropriate transfer mechanism — an adequacy decision where one exists, or Standard Contractual Clauses (SCCs) (and the UK International Data Transfer Addendum where applicable), together with any supplementary measures required. A copy of the relevant transfer safeguards is available on request at [email protected].

KVKK cross-border transfers. Transfers of personal data abroad under KVKK (as amended in 2024) are made on one of the permitted bases — an adequacy decision by the Personal Data Protection Board, an appropriate safeguard such as a standard contract (standart sözleşme) or binding corporate rules / undertaking, or, where none applies, one of the exceptional grounds (including explicit consent).

8. Your rights as a data subject

Depending on where you live, you have some or all of the following rights. To exercise any of them, see §10.

8.1 Türkiye residents (KVKK Article 11)

You have the right to:

• Learn whether your personal data is being processed;
• Request information about the processing if it has taken place;
• Learn the purpose of processing and whether the data is used in accordance with that purpose;
• Know the third parties to whom your data is transferred, in Türkiye or abroad;
• Request correction of incomplete or inaccurate data, and request that this correction be notified to third parties to whom the data was transferred;
• Request deletion or destruction of your data where the reasons for processing no longer exist, and request that this be notified to third parties;
• Object to a result that arises against you from the analysis of your data solely by automated means;
• Claim compensation for damage arising from unlawful processing.

8.2 EU / UK residents (GDPR / UK-GDPR)

You have the right to:

• Access — obtain a copy of the personal data we hold about you;
• Rectification — correct inaccurate or incomplete data;
• Erasure ("right to be forgotten") — delete your account and associated personal data, subject to legally mandated retention (e.g. invoices for 7 years);
• Restriction — restrict processing in certain circumstances;
• Portability — export your data in a structured, machine-readable format (JSON);
• Objection — object to processing based on legitimate interests, including any profiling;
• Withdraw consent — where processing is based on consent;
• Complain — lodge a complaint with a supervisory authority (see §10.3).

8.3 California residents (CCPA / CPRA)

You have the right to:

• Know what personal information we collect, use, disclose, and sell (we do not sell);
• Delete personal information we hold about you;
• Correct inaccurate personal information;
• Limit the use of sensitive personal information (we do not use sensitive PI);
• Opt out of sharing for cross-context behavioral advertising (we do not share);
• Non-discrimination — you will not receive discriminatory treatment for exercising a right.

8.4 Other jurisdictions

If your local law grants you additional rights, we will honor them to the extent legally required.

9. Objection and withdrawal

Where we process your data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation; we will stop unless we demonstrate compelling legitimate grounds that override your interests or the processing is needed to establish, exercise, or defend legal claims. Where we process on the basis of consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal. Where we introduce a new sub-processor (§6.1) you may object as described in §15.

10. How to exercise a right — and how to file a removal request

10.1 Customer rights requests

Email [email protected] with the subject line "Privacy request" and describe the right you want to exercise. We respond within 30 days (or the local statutory deadline, if shorter — including the KVKK 30-day period). We may ask you to verify your identity before releasing or acting on data, to protect your account.

10.2 Removal of your personal data that appears inside Service responses

If you are an individual (not necessarily a customer) whose personal data appears in data the Service returns, you may request suppression/removal at [email protected] with the subject line "Removal request". See §14 for how this works, what we can and cannot do, and what information to include. You may also use [email protected] to report misuse.

10.3 Complaints to a supervisory authority

• Türkiye: you must first apply to us as the controller; if unsatisfied, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu — KVKK Board).
• EU: your national data-protection authority — find yours via edpb.europa.eu.
• UK: the Information Commissioner's Office — ico.org.uk.

11. Cookies and similar technologies

• api.allapi.io — the API sets no cookies. Authentication uses the X-AllAPI-Key header.
• app.allapi.io (the dashboard) sets a single first-party session cookie (HMAC-signed, Secure, HttpOnly, SameSite=Lax) to keep you logged in. No third-party analytics cookies, no advertising cookies.
• docs.allapi.io sets no cookies (documentation is fully static).

You can block or delete cookies in your browser, but doing so may prevent you from staying logged in to the dashboard.

12. Automated decision-making and profiling

We do not use your personal data for solely automated decisions that produce legal or similarly significant effects on you (GDPR Art. 22; KVKK Art. 11). Rate limiting and abuse detection are technical safeguards, applied to protect the Service, and are not profiling of you as an individual.

13. Security

• Passwords are hashed with a salted, modern password-hashing algorithm. Plaintext is never stored.
• API keys are hashed at rest; only a short prefix is retrievable after creation.
• Data in transit uses TLS 1.2 or higher (TLS 1.3 preferred).
• Data at rest is stored on encrypted disk volumes.
• Access control — access to production systems is restricted to authorized personnel with hardware-key 2FA.
• Least privilege — the production database uses role-separated credentials with the narrowest privileges necessary.
• Backups are 30-day rolling, encrypted, with restricted access.
• Incident response and breach notification. In the event of a personal-data breach:
• GDPR (Art. 33/34): we notify the competent supervisory authority within 72 hours of becoming aware, where the breach is likely to result in a risk to individuals, and notify affected individuals without undue delay where the risk is high.
• KVKK: we notify the Personal Data Protection Board and affected data subjects as soon as reasonably possible (en kısa sürede) in line with the Board's decisions on breach notification.

No system is perfectly secure. If you discover a vulnerability, please report it to [email protected] — we appreciate responsible disclosure.

14. Third-party personal data returned by the Service (removal & objection)

This is the section that addresses individuals whose personal data appears inside data the Service returns, rather than our own customers. It is the core of our data-subject-protection posture.

14.1 What the Service does

The Service is a unified read-only gateway. For each request, it retrieves only publicly available data from an Upstream Source using an anonymous, unauthenticated request — we do not log in, do not accept any upstream's account-holder terms, do not resell authenticated-API or credential access, and do not bypass authentication, DRM, paywalls, or captchas. The retrieved data is returned to the customer in a normalized JSON envelope. We do not store the response payloads (see §2.4).

Some of that publicly available data may itself contain personal data of third parties — for example, a name, a public handle, or other identifiers that the individual or a publisher has already made public on the open web.

14.2 Our role and legal basis for this data

For personal data that transits the Service inside upstream responses, we act as a conduit / controller for the limited act of retrieval and normalized delivery. We rely on:

• Legitimate interests (GDPR Art. 6(1)(f) / KVKK Art. 5(2)(f)) in operating a lawful public-data gateway, balanced against the rights of the individuals concerned; and
• for any data that is special-category and genuinely present, the narrow "manifestly made public by the data subject" condition (GDPR Art. 9(2)(e); the corresponding KVKK basis for data made public by the data subject), which we treat as narrow and not a general licence.

Important limits on what "public" means. Public availability defeats claims based purely on breach of a platform's account terms or unauthorized-access theories (because we operate logged-out and accept no account terms). It does not by itself extinguish copyright, database, trademark, or personal-data rights. Accordingly:

• We do not warrant that a customer has a lawful basis to further process, retain, publish, or resell any personal data returned by the Service.
• The customer is solely responsible for determining its own lawful ground, providing any required notices, honoring data-subject rights, and complying with KVKK, GDPR, and all other applicable law in its downstream use. This obligation is set out in the Terms of Service and the Acceptable Use Policy (including the prohibitions on re-identification, mass personal-data harvesting without a lawful basis, and building profiling/surveillance tooling).
• We are not the source of the data; the original publisher's own privacy practices continue to apply.

14.3 Removal / suppression right for affected individuals

If your personal data appears in data returned by the Service and you want it suppressed, you may ask us to act. This right is available to any affected individual, whether or not you are a customer.

How to request removal. Email [email protected] with the subject line "Removal request", and include:

1. Your identity and enough detail to verify you are the individual concerned (we will request only what is necessary to verify, and use it only to process the request);
2. The specific personal data at issue and, where possible, the Upstream Source, endpoint/platform slug, or query through which it appears (an example X-Request-Id helps greatly);
3. Confirmation that you are the data subject or an authorized representative.

What we can do. On a valid request, we will suppress the identified personal data at our layer — for example by blocking the relevant query path or filtering the identified data from responses our Service returns — and confirm back to you. We keep a minimal record of the request so the data does not re-appear (§5).

What we cannot do. We cannot delete data at the Upstream Source — that data lives on a third-party site we do not control. To have it removed at source, you must contact the original publisher. Suppression at our layer stops the Service from returning it, but does not remove it from the open web.

Objection. Independently of removal, you may object to our processing of your personal data through the Service on grounds relating to your particular situation, using the same channel; we will assess the objection under §9.

Timing. We handle removal and objection requests within 30 days (or the shorter statutory deadline that applies), and may extend for complex requests with notice to you.

14.4 Abuse reporting and cooperation

Suspected misuse of the Service involving personal data (e.g. scraping-for-doxxing, re-identification, or building surveillance tooling — all prohibited by the Acceptable Use Policy) can be reported to [email protected]. We investigate, may suspend or terminate offending accounts, preserve evidence, and cooperate with law-enforcement and supervisory authorities where lawfully required.

15. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes — those that materially expand our use of your personal data, add a new sub-processor, or reduce your rights — will be announced at least 14 days in advance via email to the address on your account and on the dashboard, giving you the opportunity to object to a new sub-processor or to close your account before the change takes effect. Non-material clarifications may be published without advance notice; the "Last updated" date at the top always reflects the latest revision.

16. Children

The Service is not directed to individuals under the age of 18 and we do not knowingly collect personal data from children as customers. If you believe a child has provided us data, contact [email protected] and we will delete it promptly.

17. Contact

Data controller: Legal Eye Yazılım A.Ş. (Türkiye; Trade Registry No. 1020744, VKN 6081733803), registered office Sultan Selim Mah. Yamaç Sk. No:6 İç Kapı No:3, Kağıthane / İstanbul, Türkiye, trading as "AllAPI".

• Privacy, rights requests, and removal requests: [email protected]
• Abuse reports: [email protected]
• General / support: [email protected]
• EU / UK representative (GDPR Art. 27): to be appointed and inserted by counsel where required.
• Supervisory authorities: KVKK Board (Türkiye); your national DPA in the EU (edpb.europa.eu); the ICO in the UK (ico.org.uk).

If your inquiry concerns a specific request or a removal, include the X-Request-Id from any Service response — it lets us locate the operational record in seconds.