Privacy Policy

At Agnic Hub, we take your privacy seriously. This Privacy Policy explains how we collect, use, and protect your information when you use our API marketplace.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address
• Name (optional)
• Company name (optional)
• Billing and payout details (processed through our payment providers)

1.2 API Registration Data (For Publishers)

When you register an API, we collect:

• API name and description
• API endpoint URL (your server address)
• Pricing configuration (price per call or plan)
• Payout destination

1.3 Usage and Billing Metadata

When calls are made through our gateway, we collect:

• Timestamps and endpoint accessed
• Response status and latency
• Amount billed
• Consumer account identifier

1.4 What We DO NOT Collect

We explicitly do not collect or store:

• The plaintext of your upstream API keys or secrets
• API request content (query parameters, request bodies) by default
• API response content (data returned by your API) by default
• Any sensitive data that flows through our gateway
• Your end users’ personal information

1.5 Website Usage Data

We automatically collect:

• Browser type and version
• IP address (anonymized)
• Pages visited on our website
• Time and date of visits
• Device information

2. How We Use Your Information

2.1 Provide the Service

• Process API registration and management
• Meter usage and generate accurate billing and payouts
• Provide usage and revenue analytics
• Route API requests through our gateway
• Display APIs in our API Hub marketplace

2.2 Improve the Service

• Analyze usage patterns to improve features
• Monitor performance and reliability
• Detect and prevent abuse and fraud

2.3 Communication

• Send transactional emails (billing confirmations, account updates)
• Respond to support inquiries
• Send product updates (you can opt out)
• Notify of important service changes

3. Data Storage and Security

3.1 Where We Store Data

• Application data: Supabase (AWS us-east-1)
• Usage and billing metadata: Supabase (AWS us-east-1)
• Gateway cache: Cloudflare KV (global edge network)

3.2 Security Measures

• Encryption in Transit: All data transmitted using TLS 1.3
• Encryption at Rest: All stored data encrypted with AES-256
• Infrastructure: Hosted on SOC 2 Type II certified providers
• Access Control: Role-based access with principle of least privilege
• Monitoring: 24/7 security monitoring and intrusion detection

3.3 Zero-Knowledge Architecture

Our gateway operates on a zero-knowledge principle where practical:

• We do not store the plaintext of your upstream API keys
• We do not store API request or response content by default
• We only observe usage and billing metadata required to operate the Service
• Your API code stays on your infrastructure

4. Data Retention

4.1 Account Data

• Retained while your account is active
• Deleted within 30 days of account deletion

4.2 Usage and Billing Metadata

• Retained for accounting and analytics purposes
• Minimum 90 days for all users
• Up to 7 years for tax/legal compliance (where required)

4.3 API Registration Data

• Retained while your API is published
• Removed when you unpublish your API

4.4 Data Export and Deletion

You can:

• Export all usage and billing data to CSV anytime
• Request complete data deletion (via [email protected])
• Delete your account from Settings (removes all personal data)

5. Third-Party Services

We use the following third-party services:

5.1 Infrastructure Providers

• Cloudflare: Edge computing, DDoS protection, caching
• Supabase: Database and authentication
• Vercel: Web hosting

5.2 Business Services

• Stripe: Payment processing
• Resend: Transactional email delivery

These services have their own privacy policies. We only share the minimum data necessary for them to provide their services.

6. Your Rights (GDPR)

If you are in the EU/EEA, you have the following rights:

6.1 Right to Access

You can request a copy of all personal data we hold about you.

6.2 Right to Rectification

You can update your account information at any time from your dashboard.

6.3 Right to Erasure

You can request deletion of your personal data. We will comply within 30 days, subject to any legal retention obligations.

6.4 Right to Data Portability

You can export your usage and billing data in CSV format from your dashboard.

6.5 Right to Object

You can opt out of marketing emails at any time using the unsubscribe link.

6.6 Right to Lodge a Complaint

You can lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at [email protected]

7. Cookies and Tracking

7.1 Essential Cookies

We use essential cookies for:

• Authentication (keeping you logged in)
• Security (CSRF protection)
• Session management

7.2 Analytics

We use privacy-friendly analytics to understand how our service is used. We do not use Google Analytics or other tracking-heavy tools.

7.3 Cookie Control

You can disable non-essential cookies from your browser settings. Essential cookies are required for the service to work.

8. Children’s Privacy

Our service is not intended for children under 13. We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us immediately.

9. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place, including:

• Standard contractual clauses approved by the EU Commission
• Hosting data with providers certified under recognized international frameworks
• Implementing appropriate technical and organizational measures

10. Data Sharing

10.1 We Share Data With:

• Service Providers: Only as needed to operate the platform
• Legal Requirements: If required by law or subpoena
• Business Transfers: In case of merger or acquisition

10.2 We DO NOT:

• Sell your personal data to third parties
• Share your data for third-party marketing purposes
• Provide API request/response content to anyone

11. Your API Data

For API publishers:

• We do not store your API request or response content by default
• We only observe usage and billing metadata
• Your API remains on your infrastructure
• You control who can access your API via pricing and keys
• Usage data helps you track revenue and analytics

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will:

• Notify you via email of significant changes
• Update the “Last Updated” date
• Post updates on our website

The “Last Updated” date at the top will always reflect the most recent version.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your data:

• Company: Agentic Business Commerce Limited
• Privacy inquiries: [email protected]
• Data deletion requests: [email protected]