Privacy policy.

We collect the minimum data needed to run ApyHub and bill you for what you use. We group it into three categories, defined below. We do not use any third-party trackers, analytics SDKs, or advertising pixels — everything we know about you, you gave us directly or generated by using the service.

Account data

When you create a workspace, we ask for your name, email address, and a password (or a linked identity from Google, GitHub, or Microsoft). If you invite teammates, we collect the same information for each person you invite. We don't ask for phone numbers, addresses, or demographic data at signup — and we don't have a way to accept them even if you tried.

Usage data

To bill you accurately and help you debug, we log every API call you make through ApyHub. Each log entry contains the endpoint, timestamp, response code, latency, and your workspace ID. We do not log request or response bodies — only metadata. Logs are retained for 90 days, then automatically deleted.

Payment data

Card numbers and bank details are never stored on ApyHub's servers. All payment processing is handled by Stripe, who holds the card data directly. We only see a customer ID and the last four digits of your card. If you pay by invoice (Enterprise plans), we store your company name and billing address; nothing more.

Data collected is used for exactly three purposes, in this order:

1. Running the service. Authenticating you, routing requests, enforcing rate limits, billing you accurately.
2. Operational debugging. When something breaks, our on-call engineers look at recent logs to find the cause. Logs are redacted before any human sees them — no emails, no keys.
3. Communication you explicitly opted in to. Product updates, security bulletins, receipts. Nothing else. Marketing emails are opt-in and separate — the default is off.

We do not use your data to train models, build shadow profiles, serve ads, or sell insights to third parties. Our revenue comes from your subscription, full stop.

We share data with a small, named list of subprocessors — vendors who operate parts of ApyHub on our behalf. Every subprocessor has signed a Data Processing Agreement with us. We publicly list them, and we give 30 days' notice before adding or changing one.

We also disclose data if we receive a legally binding request (subpoena, court order). In that case, we notify you first unless prohibited by law, and we push back on overly broad requests. We publish a transparency report twice a year showing every request we received and how we responded.

Your primary data is stored on AWS servers in eu-central-1 (Frankfurt, Germany). Backups are replicated to eu-west-1 (Dublin, Ireland) for disaster recovery. Some edge caching happens globally through Cloudflare — cached data is short-lived (seconds to minutes) and never contains personal information.

If you sign up from the United States, your data is still stored in the EU by default. We offer US residency as an option on Enterprise plans, which keeps data within US regions. The default is EU because GDPR gives everyone strong protections regardless of where they sign up from.

Different categories of data have different retention periods:

• Account data — kept while your workspace is active. Deleted within 30 days of workspace deletion.
• Usage logs — 90 days, then auto-purged. Aggregate statistics (monthly totals per workspace) are kept longer for billing records.
• Invoices & receipts — kept for 7 years to comply with tax law. This is the only category we can't delete on request.
• Support tickets — kept for 2 years after close, then anonymized.
• Backups — 30-day rolling window. A deletion on primary data takes up to 30 days to fully propagate through backups.

Under GDPR, you have seven rights over your data. We support all of them, and we've built them directly into the product so you don't need to email a lawyer.

1. Access — download a JSON export of everything we have about you at Settings → Privacy → Export data.
2. Rectification — update your name, email, and workspace details in Settings → Profile at any time.
3. Erasure — delete your workspace in Settings → Danger zone. Propagates to backups within 30 days.
4. Restriction — pause data processing (e.g., during a dispute) by contacting [email protected].
5. Portability — the JSON export is in a standard format, parseable by any tool.
6. Objection — opt out of any non-essential processing (currently: product update emails) in Settings → Notifications.
7. Complaint — lodge a complaint with your national Data Protection Authority. For EU users, the lead supervisory authority for ApyHub is the Dutch DPA (Autoriteit Persoonsgegevens).

ApyHub.com uses two strictly necessary cookies:

• apyhub_session — your authentication session. Expires 30 days after last use, or immediately on sign-out.
• apyhub_csrf — a CSRF token to prevent request forgery attacks. Session-lifetime only.

These aren't optional — the cookie banner shown on first visit doesn't cover them, since the site can't function without them.

With your consent (via the cookie banner), we also load Google Tag Manager and Google Analytics, which set analytics cookies to measure site usage. Declining, or not responding to the banner, keeps these off — no analytics cookies are set until you accept. You can change your choice at any time by clearing your browser's site data for apyhub.com and reloading.

We also use Plausible Analytics for aggregate traffic and event reporting. Plausible is cookieless — it doesn't use cookies, local storage, or any persistent identifier, and doesn't collect personal data — so it isn't gated by the cookie banner and runs for all visitors. Further information about Google's privacy practices is available at policies.google.com/privacy.

ApyHub is a professional developer tool and is not intended for anyone under the age of 16. We do not knowingly collect data from children. If you believe a child has created an account, contact [email protected] and we'll delete the account and associated data within 7 days.

We version this document and publish every change. Material changes are announced at least 30 days before they take effect — by email to all workspace owners and via an in-product banner.

Questions, concerns, or a data request? We try to respond within 2 business days. Serious privacy matters (rights requests, breach reports) are routed directly to our DPO.