Privacy Policy
This explains what personal data TransCAPI holds, why, who else handles it, how long we keep it, and your rights. We keep it to what the service needs: there are no advertising or analytics trackers on this site.
Who is responsible
TC Data Consultants, Suite 1A, 121 Giles Street, Edinburgh, EH6 6BZ, is the controller of the personal data described here. Contact us about privacy at hello@transcapi.com.
What we hold, why, and for how long
| Data | Why | Lawful basis | Kept for |
|---|---|---|---|
| Account: email address, password (stored only as a secure hash), sign-up and confirmation dates, plan | To run your account and send the emails it needs: confirmation, password resets, plan changes, security notices | Contract | While your account is open; deleted within 30 days of closing it |
| API keys, and per-key request counters | To authenticate requests and apply your plan's limits | Contract | Keys while your account is open; counters 3 days |
| API request logs: which key, endpoint and parameters (which can include coordinates, stops or places you look up), response code and time | To show your usage in the dashboard, investigate problems and abuse, and improve the service | Legitimate interests | 90 days, then deleted automatically |
| Web server logs: IP address, browser, page requested, time | Security, and keeping the service running | Legitimate interests | 14 days |
| Billing: your Stripe customer reference, subscription and renewal date. We never see or store card details | To apply the plan you've paid for | Contract | While your account is open, and as long afterwards as tax and accounting law requires |
| Emails you send us | To reply and help you | Legitimate interests | As long as needed to deal with your request, and no more than 2 years |
We only send emails about your account and the service. We won't send you marketing unless you've asked for it, and you can stop it at any time.
Who else handles your data
| Who | What for | Where |
|---|---|---|
| Contabo GmbH | Hosting: the servers the website, API and database run on | Germany |
| Brevo (Sendinblue SAS) | Sending account emails | EU (France) |
| Stripe | Payments. Stripe is the merchant of record for paid plans and handles your payment and tax details as its own controller, under Stripe's privacy policy | EU and US |
| jsDelivr | Delivers the code for the interactive API reference at api.transcapi.com/docs, so viewing that page shares your IP address with it | Global |
They act on our instructions under contracts that protect your data, except Stripe for payment data as noted. Where data goes outside the UK, it is to countries the UK recognises as adequate, such as EU countries, or under the UK's approved safeguards for transfers, such as the International Data Transfer Agreement or the UK Extension to the EU–US Data Privacy Framework. We don't sell personal data, and we only share it with anyone else where the law requires it.
Cookies
We use one essential cookie, which keeps you logged in and protects forms against cross-site request forgery. There are no analytics, advertising or third-party cookies, so there is nothing to consent to. Fonts are served from our own servers.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or give it to you in a portable form. Email hello@transcapi.com and we'll respond within one month. You can change your email and password yourself from Settings in your dashboard. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk; we'd appreciate the chance to put things right first.
Security
Passwords are stored as salted hashes, all traffic is encrypted over HTTPS, and email links for confirming addresses and resetting passwords expire and are single-purpose.
Children
TransCAPI is a service for developers and businesses and isn't aimed at children under 16.
Changes
If we change this policy in a way that matters, we'll email account holders before it takes effect.