Privacy Policy

Last updated: January 1, 2025

1. Data We Collect

We collect information you provide when creating an account (email address), API usage logs associated with your API key (endpoint, timestamp, tier), and anonymous city search queries. Payment card data is processed by Stripe — we never store raw card numbers.

2. How We Use Your Data

We use collected data to authenticate your account and enforce rate limits; track monthly API usage and tier quotas; improve the platform through aggregate anonymized analytics; and comply with legal obligations. We do not sell or rent your personal data to third parties.

3. Data Retention

API usage logs are retained for 90 days. Account data is retained for the duration of your account and deleted within 30 days of a confirmed deletion request. Aggregate anonymized analytics may be retained indefinitely.

4. Third-Party Processors

We use: Amazon Web Services (AWS) for database and storage; Vercel for frontend hosting; DataCite for DOI registration; Stripe for payment processing. Each processor is bound by a data processing agreement.

5. Your Rights

You have the right to access, correct, delete, and export the personal data we hold. Email privacy@universalqli.com to exercise any of these rights. We respond within 30 days.

6. Security

We use TLS 1.3 in transit, AES-256 at rest, and SHA-256 hashed API keys. Security incidents are disclosed within 72 hours as required by applicable law. Security headers (HSTS, CSP, X-Frame-Options) are enforced on all responses.

7. Contact

Privacy questions: privacy@universalqli.com