Privacy Policy

This Privacy Policy explains what information CardAPI (“we,” “us,” or “our”) collects when you use the website at cardapi.dev, the developer portal and the CardAPI REST API, why we collect it, who processes it for us, how long we keep it, and how you can get a copy of it or have it deleted. The card data the API serves is public product information about credit cards; it contains no personal information.

Information we collect

• Account details. You can create an account with an email address and a password (on the homepage or in the developer portal), with a sign-in link we email you (when you register through the API), or sign in with Google (including Google One Tap) or GitHub. We store your email address. If you use a password, it is stored only as a hash by our authentication provider, Supabase; we never see it. If you sign in with Google or GitHub, we receive the basic profile the provider shares, such as your name, email address and profile picture URL. When you sign up with an email address and a password, or buy or change a plan in the developer portal, we record which version of our Terms of Service you agreed to and when. We also record on your account how you signed up (password, Google, GitHub or One Tap) and, if you picked a paid plan before signing up, that plan, its billing period and when you picked it, so the portal can offer to continue to checkout. We stop offering it after 7 days and remove it when you go to checkout or dismiss the offer.
• API keys. We store a SHA-256 hash of each key, its first few characters (so you can tell your keys apart), its name, plan and limits, and when it was created and last used. We never store the full key, so we can't show it to you again: if you lose it, create a new one in the portal.
• API usage logs. For each API call we record which key made it, the endpoint path, the page size and position you asked for (the limit and offset parameters), the response status code, the response time and the time of the call. For calls refused because a rate limit was reached we keep only a count per account and day. We use these for rate limits, quotas, the usage charts in your portal and abuse prevention, including spotting bulk copying of the data. Usage logs don't include your IP address or the rest of your requests (other parameters, headers or body).
• Billing details. If you buy a paid plan (Starter, Pro or Enterprise), payment is handled by Stripe. We store your Stripe customer and subscription IDs, your plan and its billing status. Your card number and other payment details go directly to Stripe; we never see or store them.
• Webhooks. If you set up webhooks (Enterprise), we store the endpoint URL, the events you chose, the signing secret, and a log of each delivery attempt: the payload we sent, the time, how long it took, your endpoint's response status and response body, and any error.
• Messages you send us. When you use the contact form we store your name (if given), email address, subject and message, and email them to us so we can reply. When you submit a feature request we store its title, description and category, and your email address if you choose to give one so we can follow up. When you submit or vote on a feature request we store your IP address, so each visitor counts once.
• Website analytics. We use Vercel Web Analytics to count page views and Vercel Speed Insights to measure how quickly pages load and respond. Neither uses cookies; they tell us which pages are viewed, the referring site (as your browser reports it), load times, which part of a page was slow to respond or moved while loading, and the visitor's country, operating system, browser, device type and connection speed, in aggregate. Before the address of the cardapi.dev page you are on is sent to either, we remove everything after a “#” and every query parameter except campaign tags (utm_*), so the codes in sign-in and password-reset links never reach them. Web Analytics also counts a few named steps of signing up and buying a plan (for example, that the sign-up form was sent and with which method, or that a checkout was started for a plan). Those events carry only the plan, the sign-up method, an HTTP status code, the name of the page or link the step started from, the billing period (monthly or annual) and whether Checkout finished or was cancelled, never your email address, API key or anything you typed.
• Technical data. Like any website, our hosting providers receive your IP address, browser user agent and the pages or endpoints you request in order to serve and protect the service, and keep them in short-lived server logs. Supabase, our authentication provider, also records the IP address of sign-ins and sign-ups in its security log. We use your IP address to limit how many accounts can be registered from one address, and how often one address can use the keyless "Try it" demo; the API and the website hold it in memory for up to 24 hours for this.

How we use your information

• To create and secure your account and sign you in
• To issue and check API keys and enforce rate limits, quotas and plan features
• To bill paid plans and show your plan and usage in the portal
• To deliver the webhooks you set up
• To answer your messages and consider your feature requests
• To detect, investigate and prevent abuse and keep the service running
• To understand which pages of the website are used, in aggregate

We do not sell or rent your personal information, share it for advertising, or use it to build advertising profiles.

Emails we send

• Account emails: confirming your email address and resetting your password, and one reminder, about a day after a sign-up on our website that hasn't been confirmed, with a link to request a new confirmation email.
• Usage alerts: when you reach 80% and 95% of your monthly quota, and when your account reaches its daily limit (at most once a week). They say what the next plan costs and adds.
• Two one-time getting-started emails: about two days after you sign up if no API call has been made with your keys yet, and about three days after if the only call was the one in onboarding. Each is sent once and never again, and you can opt out of them by replying "unsubscribe".
• Trial notice: about two days before a Starter trial ends, saying when it ends and what is charged after it.
• Billing emails: Stripe may email you receipts and payment notices for a paid plan.

We don't send newsletters or sell access to our mailing list. Replies to our emails go to support@cardapi.dev.

Cookies and browser storage

We don't use advertising or cross-site tracking cookies. What cardapi.dev does store in your browser:

• Your portal session. When you sign in, Supabase keeps your session in your browser's local storage so you stay signed in. It is removed when you sign out.
• Google One Tap. Our pages load Google Identity Services (accounts.google.com) so that, when you aren't signed in to the portal, we can offer one-tap sign-in with Google. Loading it sends Google your IP address and browser details, and when the prompt is shown it sets a g_state cookie on cardapi.dev that remembers whether you closed it. If you are signed in to Google, Google may recognize you under its own privacy policy. Google shares nothing with us unless you choose to sign in.
• How you signed up and the plan you picked. When you start signing up, we keep the sign-up method (password, Google, GitHub or One Tap) in local storage until the new account is set up, then remove it. If you pick a paid plan before signing up, we keep that plan and billing period in local storage for up to 24 hours, or until you go to checkout or dismiss the offer, so the portal can offer it after you sign in.
• Feature-request votes. The feature requests page keeps the list of requests you voted for in local storage, so the buttons show your votes.
• API keys you paste into the docs. A key you paste into a “Try it” panel stays in that browser tab's memory and is sent only to the CardAPI API. It isn't saved.

Vercel Web Analytics and Speed Insights set no cookies. Our fonts are served from cardapi.dev itself, not from a third party.

Service providers

These companies process personal information on our behalf, only to provide their service to us:

• Supabase — database and authentication. Your account, API key hashes, usage logs, webhooks, messages and feature requests are stored there, and it sends account confirmation and password-reset emails, either itself or through Resend.
• Vercel — hosts the cardapi.dev website and developer portal, and provides Vercel Web Analytics and Speed Insights.
• Railway — hosts the CardAPI API and our scheduled jobs.
• Stripe — payment processing and billing for the Starter, Pro and Enterprise plans.
• Resend — delivers our emails: usage alerts, the getting-started emails, the trial notice, contact form messages to us, and the account confirmation and password-reset emails Supabase sends through it.
• Google — sign-in with Google and Google One Tap.
• GitHub — sign-in with GitHub, and our nightly database backup. The backup runs on GitHub Actions: it copies the whole CardAPI database and encrypts it on GitHub's servers, and GitHub stores the encrypted backup files for 30 days, then deletes them.

Each provider handles data under its own privacy policy and security terms. We may also disclose information when the law requires it, to protect the service or its users from fraud or abuse, or to a buyer if CardAPI is ever sold, in which case this policy continues to apply to your information.

How long we keep it

• API usage logs and the daily counts of refused calls are deleted automatically after 90 days.
• Account details, API keys, webhooks and their delivery logs are kept while your account exists and deleted when the account is deleted.
• Contact messages and feature requests are kept until they are no longer needed or you ask us to delete them.
• Billing records are kept by Stripe, and by us, for as long as tax and accounting law requires, even after an account is deleted.
• Server logs at our hosting providers are kept for a short period under their own retention settings.
• Backups: deleted data can remain in our encrypted database backups for up to 30 days before they expire.

Your choices, and deleting your account

• You can create and revoke API keys at any time in the developer portal.
• You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account. Email privacy@cardapi.dev from the address on your account (so we know the request is yours). We reply within 30 days.
• Deleting your account removes your sign-in, API keys (which stop working), usage logs, webhooks and their delivery logs. If you have a paid plan, we cancel it so you aren't billed again; billing records are kept as described above. Copies in our encrypted database backups are deleted when those backups expire, within 30 days.

Security

All traffic to cardapi.dev and the API is encrypted with TLS. API keys are stored only as hashes, passwords only as hashes held by Supabase, and database access is limited by row-level security. No system is perfectly secure; if you find a vulnerability, please report it to support@cardapi.dev.

Where your information is processed

CardAPI and its service providers store and process information in the United States. If you use CardAPI from outside the United States, your information is transferred there.

Children

CardAPI is a service for developers and businesses. It isn't directed to children under 16, and we don't knowingly collect their information.

Changes to this policy

When we change this policy we update the “Last updated” date at the top of this page. If a change materially affects how we use information we already hold, we will tell account holders by email before it takes effect.

Contact

Privacy questions and requests: privacy@cardapi.dev. Everything else: support@cardapi.dev.