Public beta policy
Privacy policy
Effective October 13, 2026.
This policy explains how API Many (“API Many”, “we”, or “us”) handles personal data when you visit API Many, create an account, purchase a balance, or use the public-beta API.
Where Clarity is enabled, with your analytics consent we associate signed-in visits on approved public pages with a site-prefixed internal account ID to understand visits across devices. Clarity hashes this identifier before transmission. We do not supply your email or name through this feature. Signing out or switching accounts ends the current recording and clears Clarity cookies. Private pages remain excluded. You can withdraw analytics consent in Cookie preferences.
1. Information we process
Account information. When you sign in, the identity provider may give us an account identifier, email address, name, and profile image. We store the information needed to operate and secure your account.
API credentials. A new API key is displayed once. We retain a one-way hash, a limited prefix and suffix for identification, its name, creation and revocation records, and last-use time. Do not send an API key to support.
API requests and responses. Request content is sent to the provider route selected for the requested model. The gateway ledger is designed to retain a one-way request fingerprint, model and route metadata, token usage, timestamps, request status, charge information, and error details rather than raw request messages. We may retain a provider response payload when needed to return an idempotent result, provide account history, investigate a disputed result, or reconcile an uncertain upstream outcome.
Billing information. Stripe processes card and payment details. Cryptocurrency payments are processed by NOWPayments, which sends us invoice and transaction identifiers, amounts and payment status. We receive identifiers and records such as customer, checkout, charge, refund, dispute, payment status, country, tax, and receipt information, but not a full card number.
Technical and support information. We may process IP address, user agent, request identifiers, rate-limit and security events, error logs, and messages or files you choose to send to support. Optional analytics, if enabled and consented to, may process device and interaction data.
2. Why we use this information
We use information to authenticate users, issue and revoke keys, route and meter requests, maintain balances, prevent duplicate submissions, investigate uncertain provider outcomes, process payments and refunds, detect abuse, troubleshoot the public beta, communicate service or security information, provide support, and comply with legal, tax, and accounting requirements.
Where applicable, the legal basis is performance of our contract, our legitimate interests in operating and securing the service, consent for optional analytics, or compliance with law.
3. Providers and other processors
To fulfill an API request, we disclose its content and necessary settings to an eligible upstream provider. Because provider routing can change between compatible eligible routes, do not submit regulated, confidential, or sensitive personal data unless we have agreed in writing to the required route restrictions and data terms. Upstream providers process data under their own applicable terms and privacy commitments.
We also use service providers needed for identity, payment processing, hosting, databases, email, security, and optional analytics. They may process data in countries other than yours under their terms and applicable transfer safeguards.
API Many does not currently train its own model on customer API content, and we do not sell submitted API content for advertising. This statement does not replace the separate terms of an eligible upstream provider.
4. Retention
We keep account and API-key records while an account is active and for a limited period afterward when needed for security, disputes, or legal obligations. Request receipts and response records are kept only as long as reasonably needed for idempotency, billing, reconciliation, support, and abuse prevention. Billing and tax records may be retained for legally required periods. We delete or anonymize data when it is no longer needed, subject to backups, fraud prevention, disputes, and mandatory retention.
5. Security and your choices
We use measures described on our security page, but no online system is completely secure. Keep keys in a server-side secrets manager, rotate a key after suspected exposure, and do not put credentials in prompts or support email.
Depending on your location, you may request access, correction, deletion, portability, restriction, or objection, and may withdraw optional analytics consent. We may need to verify your identity. Some payment, security, and dispute records cannot be deleted immediately.
Change optional analytics consent at any time in Cookie preferences.
6. Children
The service is not directed to children under 13. You must also be old enough to enter a binding contract where you live.
7. Public-beta changes
API Many is in public beta. Data flows, eligible providers, and retention practices may change as the service is tested. Material changes will be posted here with a new effective date before they apply where required.
8. Contact
Data controller: API Many. Send privacy questions or rights requests to [email protected]. You may also complain to the data-protection authority available in your jurisdiction.
Welcome-balance abuse prevention
To prevent repeated welcome-balance claims, an essential first-party browser cookie lasts up to one year. Our server stores a hashed random browser identifier to limit the welcome offer to once per browser per site. This does not use Google Analytics, track you across sites, or change existing balances or daily check-in rewards. Shared-browser users can still register and use their accounts; contact support if you believe an offer was withheld in error.
Abuse prevention and account security
When you sign up, sign in or recharge, we may record a keyed hash of the network you connect from (your IPv4 address, or the /64 block of an IPv6 address), together with your country and browser type. We never store the raw address. We use these records to prevent fraud, chargeback abuse and repeated use of promotional balances; authorized administrators can see which accounts used the same network. Our legal basis is our legitimate interest in preventing abuse and fraud.