Privacy.

Who is responsible

PentaLab SRL is the controller of the data below. Write to contact@krabydata.com to use any of your rights.

Company

PentaLab SRL

Registered office

Avenue Georges Henri 196, 1200 Woluwe-Saint-Lambert (Brussels), Belgium

Enterprise number

1037.930.979

VAT

BE1037.930.979

Contact

contact@krabydata.com

What we keep

Your account

Your email address, a hash of your password (never the password itself), when the address was confirmed, when the account was made and last logged in to, and its plan. For a paid plan, the ids Stripe gives your customer record and your subscription, the subscription's period, and when you said you buy pro for a business or a profession.

Your keys

For each key: the name you gave it, when it was made, last used and revoked, and a hash of the key. The key itself is never stored.

How much you use them

A count of requests per key and per account per UTC day, for the quota, for the usage page and for billing.

Each request

One line per request: the time, the key's prefix (its first eight characters after kd_), the path asked for, the status of the answer and how long it took. Never your IP address, and never the whole key.

When you create an account

The use you describe when you create the account is sent to our contact mailbox by email so we know who uses the API; it is not stored in the database. Your IP address is used in memory to limit how many attempts one connection can make at creating accounts, logging in and resetting passwords, and is never written anywhere.

Server logs

The web server keeps no access log, for krabydata.com, for the API, or for the old names that redirect to them. Its error log, at the level it runs at, records only requests that failed inside the server, and such a line can hold the address they came from; it is the only log that can.

Why, and on what basis

• Contract: the account, its keys, the usage counts, the session cookie and billing, which you need to use the API and we need to provide it.
• Legal obligation: the billing records Stripe keeps, for as long as tax and accounting law requires.
• Legitimate interest: limiting attempts per address, the sign-up notice that tells us who uses the API, and the request log that lets us find abuse and faults. You may object to these.

Who else sees it

• OVH SAS, France: hosts the server and the database.
• Google Workspace: relays the emails we send and holds the contact mailbox, sign-up notices included.
• Stripe: takes payments as merchant of record and keeps your payment details and invoices under its own privacy policy. Stripe processes data in the United States under its EU transfer terms. We never see your card number.
• Google: Google Workspace, as the mail relay and the contact mailbox, may process mail outside the EU under Google's EU transfer terms.

No one else. We do not sell or share your address.

How long

• The account and its keys: while the account exists. Deleting it deletes the account row at once.
• Sessions: 30 days, or until you log out.
• Confirmation and reset links: one hour.
• The request log: 90 days, with no addresses.
• Usage counts: kept after the account is deleted, without the key's owner.
• Billing records: at Stripe, for the term the law sets.
• Backups: the database is dumped every night and each dump is kept 30 days, so a deleted account can survive in a backup for up to 30 days.
• The sign-up notice: in the contact mailbox until we delete it.

The session cookie

Logging in sets one cookie, kd_session, which keeps you logged in for 30 days. It holds a random token whose hash is all we store, it cannot be read by scripts, and it is sent to krabydata.com only. It is needed for the account to work, so it needs no consent. Logging out deletes it.

What we do not do

No analytics, no advertising, no third-party scripts on this site, and no cookie but the session's.

Your rights

Under the GDPR you may ask for access to your data, its correction, its deletion, a copy in a portable form, the restriction of its use, and object to a use based on our legitimate interest. Write to contact@krabydata.com. You may also complain to the Belgian Data Protection Authority (dataprotectionauthority.be). Deleting your account, from its settings page, revokes its keys, ends its subscription and removes your address from them.