Privacy Policy
What we collect, why, and how to have it deleted. Short, because we collect little.
1. Who we are
prizepicksapi.com is operated by PP API Inc., which decides how the personal data described here is used. We keep that data to the minimum the Service needs: an account, API keys, usage counts and billing.
2. What we collect
- Account details: your name and email address, and your password stored only as a salted hash. We never see or store it in plain text.
- Sign-in sessions: a session record with the IP address and browser user agent it was created from, so we can keep you signed in and spot misuse.
- API usage: for each API request, the key used, the endpoint path and the time, plus monthly and per-minute request counters. Our hosting provider also keeps short-lived request logs that include IP addresses.
- Billing: your Stripe customer id, subscription id, plan and billing status. Card details go straight to Stripe and never reach our servers.
- Messages: what you send us when you email support@prizepicksapi.com.
- Site analytics: page views and performance metrics without cookies and without identifying you (see Cookies).
We do not collect sensitive data, we do not buy data about you, and we do not sell or rent personal data to anyone.
3. How we use it
- To run your account, issue and check API keys, enforce plan limits and show you your usage.
- To take payment and manage subscriptions.
- To send service email: sign-in codes, billing notices, security notices and material changes to our terms. We do not send marketing email without your consent.
- To keep the Service secure, prevent abuse and fix problems.
- To meet legal, tax and accounting duties.
Where a law such as the GDPR applies, our legal bases are performing our contract with you, our legitimate interest in running a secure and reliable service, and complying with legal obligations.
4. Who processes it for us
We share personal data only with providers that run parts of the Service for us, under their data processing terms:
- Stripe: payments, subscriptions, invoices and the billing portal.
- Vercel: website and API hosting, request logs, privacy-friendly analytics.
- Google Cloud: the servers that host our database and backups (United States).
- Resend: delivery of service email and receipt of mail sent to our support address.
We may also disclose data when the law requires it, to protect our rights or users’ safety, or to a buyer of the Service, who would remain bound by this policy. Our providers may process data in the United States and other countries, with the safeguards their terms provide.
5. How long we keep it
- Account details and API keys: while your account exists.
- Per-request API logs: 35 days. Monthly usage counters: while your account exists. Per-minute counters: 2 days.
- Sign-in sessions: until they expire or you sign out.
- Billing records: as long as tax and accounting law requires, usually up to 7 years, mostly held by Stripe.
- Database backups: rolling, up to 14 days, then overwritten.
- Support email: as long as needed to handle your request.
6. Access, correction and deletion
Email support@prizepicksapi.com from the address on your account to get a copy of your data, correct it, or delete your account. We act on requests within 30 days. Deleting an account removes its profile, keys, sessions, usage records and logs from the live database; backups age out within 14 days, and billing records we must keep by law stay with Stripe. Cancel any paid plan first from Billing in your workspace.
Depending on where you live you may have further rights, such as to object to or restrict processing, to data portability, or to complain to a data protection authority. We will not treat you differently for using them.
7. Cookies
We set one kind of cookie: a session cookie that keeps you signed in, plus the short-lived security cookies sign-in needs. Our analytics are cookieless and do not track you across sites; workspace and API pages are excluded from them. We use no advertising cookies and no third-party trackers. Stripe sets its own cookies on its checkout and billing pages for payments and fraud prevention.
8. Security
Traffic is encrypted in transit, database connections require TLS, passwords and API keys are stored hashed, and access to production systems is limited. No system is perfectly secure. If we learn of a breach that affects your data, we will tell you without undue delay.
9. Children
The Service is for adults. We do not knowingly collect data from anyone under 18. If you think a minor has an account, write to support@prizepicksapi.com and we will delete it.
10. Changes
We will post any change here and update the date at the top. For material changes we will email account holders before they take effect. These rules sit alongside our Terms of Service.
11. Contact
Privacy questions or requests: support@prizepicksapi.com.