Privacy Policy

1. Who we are

The data controller for VesselAPI (vesselapi.com and dashboard.vesselapi.com) is:

We have not appointed a data protection officer, as the law does not require one for our processing.

2. What we collect

• Account data. Your email address and, if you sign in with Google, the name Google provides. If you register with an email and password, the password is held by our sign-in provider in a form we cannot read.
• Account records. Your API keys (stored as hashes), plan, quota, settings and the notifications you set up.
• Usage data. Each API request with its time, endpoint, response status and the IP address it came from, plus access logs for the website and dashboard.
• Billing link. Your Paddle customer and subscription identifiers and the email address used at checkout. Card and payment details are collected by Paddle, not by us.
• Correspondence. What you send to our support address or through the contact form: your name, email address, subject and message.
• Email delivery records. Whether the emails we send you were delivered, bounced, opened or clicked.
• Website analytics. Only if you accept cookies. See section 8.

3. Why we use it and on what legal basis

• Running the service. Creating your account, issuing API keys, metering your quota, sending the notifications you set up and emailing you about your account, such as quota warnings, key expiry and changes to the service. Basis: performance of our contract with you (GDPR Article 6(1)(b)).
• Security and abuse prevention. Rate limiting, detecting and blocking abusive traffic and accounts, and investigating faults. Basis: our legitimate interest in protecting the service and its users (Article 6(1)(f)).
• Improving the service. Analysing usage in aggregate to decide what to fix and build. Basis: legitimate interest (Article 6(1)(f)).
• News about VesselAPI. Occasional emails to existing users about our own service. Basis: legitimate interest (Article 6(1)(f)). You can opt out at any time by writing to support@vesselapi.com.
• Answering you. Replying to support requests and contact form messages. Basis: legitimate interest, or steps you asked for before entering a contract (Article 6(1)(f) and (b)).
• Website analytics and advertising measurement. Google Analytics and Google Ads conversion measurement. Basis: your consent (Article 6(1)(a)), which you can withdraw at any time.
• Legal obligations. Keeping records the law requires and answering lawful requests from authorities. Basis: legal obligation (Article 6(1)(c)).

4. Automated blocking

Our systems automatically limit or block IP addresses and accounts whose traffic matches abuse patterns, such as repeated failed requests or repeated free-tier sign-ups. If a block affects you, you can ask for a person to review it by writing to support@vesselapi.com.

5. Who receives your data

Service providers that process data on our instructions:

• Amazon Web Services: hosting, databases, sign-in (Amazon Cognito), email delivery (Amazon SES) and logs.
• Google: Google Analytics and Google Ads, only if you accept cookies.
• Proton: our support mailbox.

Companies that act as independent controllers under their own privacy notices:

• Paddle (Paddle.com Market Limited, or Paddle.com Inc. for buyers in the United States), which sells our subscriptions as merchant of record and processes payments. See Paddle's privacy notice.
• Google, when you choose to sign in with Google.

We do not sell personal data. We disclose it to authorities only where the law requires us to.

6. Where your data is stored

Our systems run on Amazon Web Services in the United States. Transfers to Amazon Web Services and Google rely on the EU-US Data Privacy Framework and on the European Commission's standard contractual clauses in their data processing terms. Paddle (United Kingdom) and Proton (Switzerland) are in countries the European Commission recognises as providing adequate protection.

7. How long we keep it

• Account data, account records and the billing link: while your account exists. We delete them within one month of a deletion request.
• API request logs with IP addresses: 60 days in application logs and 90 days in load balancer logs.
• Records of blocked IP addresses: until the block expires.
• Correspondence and email delivery records: up to 3 years after our last exchange.
• Website analytics: up to 14 months, the maximum Google Analytics allows.
• Payment records held by Paddle: as set out in Paddle's privacy notice.

8. Cookies

• vesselapi_cookie_consent. Stores your cookie choice for 365 days. Necessary.
• Dashboard sign-in cookies. Keep you signed in for the length of your session. Necessary.
• Google Analytics (_ga, _ga_*) and Google Ads (_gcl_au). Set only after you click Accept. IP anonymisation is enabled in Google Analytics.
• Paddle. Paddle sets its own cookies during checkout.

If you click Decline, no analytics or advertising cookies are set. To change your choice, you can delete the vesselapi_cookie_consent cookie in your browser and the banner will ask again.

9. Your rights

Under the GDPR you can ask us to:

• give you a copy of your personal data
• correct inaccurate data
• delete your data
• restrict how we process it
• send your data to you or another provider in a machine-readable format

You can also object to processing based on our legitimate interest, including emails about VesselAPI, and withdraw your consent to cookies at any time. To use any of these rights, please write to support@vesselapi.com. We reply within one month.

You can complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9-11, postal address 1363 Budapest, Pf. 9, ugyfelszolgalat@naih.hu, naih.hu, or to the supervisory authority in the EU country where you live or work.

10. California residents

We do not sell personal information. California residents can use the rights in section 9 to ask what we hold, and to have it deleted, in the same way.

11. Children

VesselAPI is a business service and is not intended for anyone under 16. If we learn that we hold data about a child under 16, we delete it.

12. Changes to this policy

Each version of this policy shows its date at the top and a summary of what changed. If we make a material change, such as a new purpose, a new controller or a change in how you can use your rights, we will tell you by email before it takes effect.