Privacy Policy

On this page

Controller and contact

APIbase is operated by its operator, an individual independent open-source developer (the "Operator"), identified by the domain apibase.pro, the public repository github.com/whiteknightonhorse/APIbase and the address support@apibase.pro. There is no registered company. "APIbase" in these documents means the Operator. The Operator may transfer this role to a company or a successor operator of apibase.pro with 30 days' notice at /legal. The Operator is the controller for platform data (agent identities, API keys, ledger, logs, receipts, contact form). For order data the merchant is the controller and APIbase is the processor (DPA). Contact: support@apibase.pro.

1. Service Description

APIbase.pro ("Service") is an API hub for AI agents. The Service provides programmatic access to third-party APIs via MCP (Model Context Protocol) and REST endpoints, paid via x402 (USDC on Base), MPP (USDC.e on Tempo), or a refund credit balance (no top-up).

2. Data We Collect

• Agent credentials: API keys (stored as SHA-256 hashes, never in plaintext), agent identifiers.
• Request logs: Request IDs, tool IDs, timestamps, response status codes. Used for billing, debugging, and abuse prevention.
• Payment data: USDC wallet addresses, transaction hashes, escrow records. Stored in an append-only ledger for financial compliance.
• Usage metrics: Aggregated, anonymized request counts and latency data for system monitoring.

Public receipts. Every call billed on-chain gets an immutable public receipt at https://apibase.pro/r/<id>.json containing the payer and payee wallet addresses, the payment transaction hash, the amount and a hash of the response. Receipts are append-only and cannot be deleted; they contain no request or response content.

Messages sent through the contact form are stored with the name, e-mail address, message text and IP address you submit, and kept for 12 months, then deleted. We use them to answer your message and to prevent abuse.

3. Data We Do NOT Collect

• Account data for platform tool calls: there are no human accounts, so no personal names, email addresses, or phone numbers are collected for them. Merchant orders are different: the delivery address, passport data where a product requires it, and payer contact are processed as described in section 11 and the DPA.
• Full request payloads are not stored. Provider responses are cached for the tool's TTL (1 second to 30 days, section 6) and are not linked to you beyond the cache key.
• IP addresses in application logs (only in Nginx access logs, retained 15 days).
• Cookies or tracking pixels on API and MCP endpoints. Human-facing web pages use Google Analytics 4 (first-party cookies, section 3a).

3a. Analytics

We use Google Analytics 4 on our human-facing web pages to measure visits and ad campaign performance; it sets first-party cookies. API, MCP and agent endpoints are not tracked.

4. How We Use Data

• Authenticate and authorize API requests.
• Process x402 and MPP micropayments, debit refund credit balances, and maintain the financial ledger.
• Enforce rate limits and prevent abuse.
• Monitor system health and performance.

4a. Legal bases

• Contract performance: calls, orders and receipts.
• Legitimate interest: security logs, abuse prevention and moderation.
• Legal obligation: sanctions screening and financial records.
• Consent: analytics cookies on human-facing pages, where required.

5. Data Sharing and Recipients

We forward request parameters to third-party API providers (e.g., Foursquare, Amadeus) solely to fulfill tool invocations. We do not sell, rent, or share data with advertisers or data brokers. Recipients:

• Hetzner Online GmbH: hosting, United States (see the DPA).
• Resend, Inc.: transactional e-mail, United States.
• Google LLC: Analytics 4 on human-facing pages, United States (section 3a).
• NameSilo: domain tools, United States.
• The destination you choose when you call an action tool (Telegram, Twilio, Telnyx, Resend): what you send to them is governed by their terms.

6. Data Retention

7. Security

API keys are hashed with SHA-256 before storage. All connections use TLS 1.2+. Containers run as non-root with read-only filesystems and dropped capabilities. PostgreSQL is the sole source of truth for financial data.

8. Third-Party Services

The Service integrates with third-party API providers. Each provider has its own privacy policy. By using a tool powered by a third-party provider, the agent's request parameters are forwarded to that provider.

9. Changes

Changes take effect 30 days after they are posted at /legal with a new version and effective date, except changes required by law, changes that only add tools or lower prices, and corrections of errors, which take effect on posting. Continued use after the effective date is acceptance.

9a. Your rights

You may ask for access to, and correction of, data we hold about you. We delete data on request where technically possible; on-chain records and public receipts cannot be deleted and contain no name, e-mail or IP address. You may object to processing based on legitimate interest and, in the European Economic Area or the United Kingdom, complain to your supervisory authority. Send requests to support@apibase.pro; we answer within 30 days. Rights over order data go through the merchant (section 11).

10. Contact

For privacy-related inquiries: support@apibase.pro

11. Integrator: merchant orders

APIbase is a technology intermediary; buyer funds do not pass through APIbase; the fee is charged to the merchant.

• Role. For personal data in merchant orders (delivery address, passport data, payer contact) the merchant is the controller and APIbase is the processor. See DPA.
• Ciphertext. Such fields are encrypted by the buyer's agent under the merchant's key; APIbase stores only the ciphertext and its sha256.
• Retention. Delivery address: until the order is closed plus 30 days. Passport data: deleted at the earliest of 7 days after delivery to the merchant, delivery, or cancellation/refund; at most 30 days. Logs carry no envelopes or field hashes.
• Your rights. Requests to access, correct or delete order data go through the merchant.
• Merchant contact. The merchant's contact details are disclosed only to the payer of the order.

These documents were prepared without a lawyer and are not legal advice; a professional review is planned.