Two things matter most and both are near the top on purpose. Personal data you send to the API is never written to disk, and everything we do store is hosted in Germany, inside the European Union. If you are assessing us as a data processor, the Data Processing Addendum and the subprocessor register carry the contractual detail, and both are free on every plan.

1. Information We Collect

1.1 Account Information

When you subscribe, we collect your email address for account management, billing, and service communications. We never require a name, phone number, or physical address. Three additions for completeness, because a register of what we hold is worth more than a short one.

If you choose to sign in with Google or GitHub rather than by email, we receive and store the display name and profile image that provider returns alongside your email address. Email sign-in stores neither.
Your subscription record keeps the IP address and user agent present when the subscription was created, together with any referral source or referring website. The first two exist to defend payment disputes and detect fraudulent signups, the rest to understand which channels reach real customers.
If you request a tax invoice, we store the business name, tax registration number, and billing address you enter, used for invoicing and statutory record keeping only.

1.2 Payment Information

We store no payment details at all. Card and wallet details are entered on a page hosted by the payment provider and never reach our servers, so there is no card number, expiry, security code, or payment token anywhere in our systems, not even a masked or truncated one. Card payments are handled by PayPal or Dodo Payments, which charge in US dollars, and by Razorpay for payments in Indian rupees. What we receive back and keep is limited to the transaction outcome, the amount and currency, which provider processed it, and the resulting subscription status. The active processor for your transaction is shown at checkout and each is named on the subprocessor page.

1.3 API Requests: What We Never Store

The content of an API request is processed in memory and is never written to any database, log, or file. That includes birth date, birth time, name, location coordinates, and any free-text question. No part of the service records request bodies.

When a request fails validation we record the error code and the names of the fields that were invalid, so you can see what to correct in your dashboard. We record the field names only, never the values you submitted.

1.4 API Requests: What We Do Store

For billing, rate limiting, and security we log one record per request containing the timestamp, the endpoint accessed, the response code, the response time, and the originating IP address and user agent. The last two are retained to defend payment disputes and investigate abuse. The record is linked to your subscription rather than to an individual key, and no part of an API key is stored in it. This metadata is kept for 120 days, sized to the card network dispute window, and then deleted automatically.

Because our calculations are deterministic, identical inputs always produce an identical result. On many calculation endpoints the computed response is therefore held in a short-lived cache so a repeated identical request does not recompute. A cache entry is addressed by a cryptographic digest of the request rather than by the request itself, carries no account, name, or email, and expires automatically within 24 hours. API responses are never cached at the content delivery network edge, so this is the only copy that exists.

You can switch that off per request. Send the standard Cache-Control: no-store header and we skip the cache entirely, reading nothing from it and writing nothing to it. The response carries X-Cache: BYPASS so you can verify it. This works on every plan and is a commitment in our Data Processing Addendum.

1.5 Cookies and Website Analytics

We run no third-party analytics, no session replay, and no advertising pixels. Traffic measurement is cookieless and handled at the network edge by our infrastructure provider, which does not collect visitor personal data.

The cookies we do set are first-party and small in number: your selected display currency so prices render correctly, a login session cookie if you sign in, a security cookie for bot protection on forms, and a referral cookie recording how you first arrived so we can tell which channels bring customers. You can clear or block cookies through your browser at any time; only the login session cookie is required for signed-in features to work.

1.6 The Website Chat Assistant

Our website has an AI chat assistant. Text you type into it is sent to a third-party language model provider, identified on the subprocessor page, in order to generate a reply. We are on a paid tier under which that provider does not use the text to train or improve its models.

Conversation transcripts are retained for 7 days so we can follow up on a support request, and birth details supplied during a conversation are retained for 2 hours so the assistant does not have to ask twice. The chat assistant is separate from the API: no API request or response is ever sent to a language model provider. If you would rather no personal data reach one, use the API and do not use the chat widget.

1.7 Abuse Prevention

Hosts that probe our site for vulnerabilities are blocked automatically, and we report the blocked IP address together with the path it probed to a community abuse database. This applies only to hosts exhibiting attack behaviour, never to customers or ordinary visitors, and it rests on our legitimate interest in network security.

1.8 Data Received Through Integrations

When the API is called from an integration such as the official WordPress plugin, a no-code automation platform, or your own application, the integrating site is the Data Controller and RoxyAPI acts as a Data Processor under GDPR Article 28. The integrating site is responsible for collecting consent and providing notice to its own visitors. Our processor obligations are set out in full in the Data Processing Addendum.

We process personal data routed through an integration only to compute and return the requested result. We do not use it for AI or machine learning training, marketing, profiling, or analytics. Birth date combined with birth time and location may qualify as special-category data under GDPR Article 9, and we apply the same in-memory-only treatment to every request body regardless of category.

For data-subject rights concerning personal data submitted through an integration, contact the integrating site or app first as the Data Controller. We hold no identifier linking a request to a named individual, so in practice we cannot locate an individual in our systems, but we will cooperate with verified requests routed through the controller.

2. How We Use Your Information

We use collected information to:

Process payments and manage subscriptions
Enforce rate limits and prevent abuse
Provide customer support and respond to inquiries
Send service notifications (downtime, updates, billing)
Improve API performance and reliability
Comply with legal obligations

We do not sell, rent, or trade personal information, and we do not use data submitted to the API to train machine learning models.

3. Third Parties and Subprocessors

Every third party that processes data on our behalf is listed, with its legal entity, purpose, location, and transfer basis, on the subprocessor page. That page is the authoritative list and records the date of its most recent change.

The short version: only two providers are ever in the path of an API request, our hosting provider in Germany and our edge network. Everything else supports the website, email, sign-in, or abuse handling and never receives an API request or response. We also disclose data where required by law, court order, or to protect our legal rights and safety.

Before adding or replacing a subprocessor that would process personal data submitted through the API, we give affected customers at least 30 days notice and an opportunity to object.

One optional feature adds one more party, and only for that feature. If you embed one of our copy-paste widgets or a hosted embed page on your site, the browser component is delivered by a public open-source content delivery network, which therefore receives your visitor's IP address and referring domain. It is never in the path of an API request and sees no birth data, result, or API key, and you can avoid it entirely by serving the component from your own domain. The operator, what it receives, and how to opt out are on the subprocessor page.

4. Data Security

All traffic is encrypted in transit with TLS. Our databases are not exposed to any public network interface. Administrative access is limited to named personnel using individual accounts with multi-factor authentication. Our hosting provider holds an ISO/IEC 27001:2022 certificate covering the data centre where your data is processed.

How your API key is held. A request is authenticated by verifying a cryptographic signature carried in the key itself, so authenticating a call never requires reading a stored key, and revocation is checked against a one-way hash. We store no retrievable copy of a secret key. For 30 minutes after you create one it can still be shown to you once, so that you can copy it; after that it is erased and no longer exists in any form we can read. Everything we keep beyond that point is a short display fragment, such as the first and last few characters, which identifies the key without being usable as one. Publishable keys, which are designed to be embedded in a web page and are restricted by the domains you allow, are retained in full for that purpose. You can revoke and reissue a key yourself at any time from your account dashboard. The corresponding technical measures are set out in Annex II of the Data Processing Addendum.

The complete list of technical and organisational measures, including where a measure is not yet in place, is published as Annex II of the Data Processing Addendum. No system is completely secure, and you are responsible for keeping your API key confidential.

5. Data Retention

API request bodies: never stored
Computed API responses: up to 24 hours in a short-lived cache on opt-in endpoints, and not at all if you send the no-store header
API usage metadata, including IP address and user agent: 120 days
Chat transcripts: 7 days. Birth details given in chat: 2 hours
Account and subscription records: while your account is active plus 2 years for legal and financial compliance

You may request account deletion by contacting us and we will delete your data within 30 days, except where we are legally required to retain records. On termination we will delete or return any personal data processed on your behalf at your choice.

6. Your Rights

You have the right to:

Access your personal information
Correct inaccurate data
Request data deletion (account closure)
Export your API usage data
Opt out of marketing emails (service emails are required)
Object to processing, and request that we restrict it

Contact us through our contact page to exercise these rights. Every submission gets a ticket reference, so you have a record of the date. We respond within 30 days.

7. Where Your Data Is Processed

Our servers, database, and cache are located in Nuremberg, Germany, inside the European Union. Data at rest does not leave the EU.

There is one third-country element and we state it plainly. Roxy Labs is established in New Delhi, India, and our engineering personnel administer that infrastructure remotely from there. Under European Data Protection Board guidance, remote access from outside the EU counts as a transfer, so we treat it as one. For that access, and for any onward transfer to a provider outside the EU, we rely on the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, Module Two. India is not the subject of an adequacy decision and we do not suggest otherwise.

Because request bodies are never persisted, there is no store of submitted personal data for an administrator to reach. Full detail, including the information you need for your own transfer impact assessment, is in section 12 of the Data Processing Addendum.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you may lodge a complaint with your local data protection authority.

8. Data Breach Notification

If a personal data breach affects data we process on your behalf, we will notify you by email within 48 hours of becoming aware of it, describing what happened, what data and how many people are affected so far as known, the likely consequences, and what we are doing about it. Where we are the controller and the breach is likely to result in a risk to individuals, we will notify the competent supervisory authority as required by law.

9. Privacy of Minors

Our Service is not intended for individuals under 18. We do not knowingly collect information from children. If we discover underage users, we will terminate their accounts immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to active subscribers 30 days before taking effect. The date at the top indicates the most recent revision.

11. Contact

Privacy questions, data requests, and data protection enquiries all reach us through our contact page. Roxy Labs is established in New Delhi, Delhi, India.