Privacy Policy
This explains what personal data TransCAPI holds, why, who else handles it, how long we keep it, and your rights. We keep it to what the service needs: there are no advertising or analytics trackers on this site.
Who is responsible
TransCAPI, Edinburgh, is the controller of the personal data described here. Contact us about privacy at hello@transcapi.com.
What we hold, why, and for how long
| Data | Why | Lawful basis | Kept for |
|---|---|---|---|
| Account: email address, password (stored only as a secure hash), sign-up and confirmation dates, plan | To run your account and send the emails it needs: confirmation, password resets, plan changes, security notices | Contract | While your account is open; deleted within 30 days of closing it |
| API keys, and per-key request counters | To authenticate requests and apply your plan's limits | Contract | Keys while your account is open; counters 3 days |
| API request logs: which key, endpoint and parameters (which can include coordinates, stops or places you look up), response code and time | To show your usage in the dashboard, investigate problems and abuse, and improve the service | Legitimate interests | 90 days, then deleted automatically |
| Web server logs: IP address, browser, page requested, time | Security, and keeping the service running | Legitimate interests | 14 days |
| Billing: your Stripe customer reference, subscription and renewal date. We never see or store card details | To apply the plan you've paid for | Contract | While your account is open, and as long afterwards as tax and accounting law requires |
| News email list: your email address, where you signed up, and when you confirmed or left | To send the occasional news email you asked for | Consent | Until you unsubscribe (one click in any news email); then we keep only the address and date you left, so we don't email you again |
| Questionnaire answers, if you answer our sign-up questions | To understand what customers need and decide what to build | Legitimate interests | While your account is open; deleted within 30 days of closing it |
| Chats: your name, what you and we write in the chat on this site, the page you started it on, and your email address if you give it (or your account, if you're logged in) | To answer your questions, and to email you the reply if you've left the page | Legitimate interests | As long as needed to deal with your request, and no more than 2 years |
| Emails you send us | To reply and help you | Legitimate interests | As long as needed to deal with your request, and no more than 2 years |
We only send emails about your account and the service. News emails go only to people who have asked for them and confirmed their address, and every one has a one-click unsubscribe link.
Who else handles your data
| Who | What for | Where |
|---|---|---|
| Contabo GmbH | Hosting: the servers the website, API and database run on | Germany |
| Brevo (Sendinblue SAS) | Sending account emails | EU (France) |
| Telegram (Telegram Messenger Inc.) | Passing chat messages from this site to the phones of the people who answer them, and their replies back | Global |
| Stripe | Payments. Stripe is the merchant of record for paid plans and handles your payment and tax details as its own controller, under Stripe's privacy policy | EU and US |
| jsDelivr | Delivers the code for the interactive API reference at api.transcapi.com/docs, so viewing that page shares your IP address with it | Global |
They act on our instructions under contracts that protect your data, except Stripe for payment data as noted. Where data goes outside the UK, it is to countries the UK recognises as adequate, such as EU countries, or under the UK's approved safeguards for transfers, such as the International Data Transfer Agreement or the UK Extension to the EU–US Data Privacy Framework. We don't sell personal data, and we only share it with anyone else where the law requires it.
Cookies
We use one essential cookie, which keeps you logged in and protects forms against cross-site request forgery. There are no analytics, advertising or third-party cookies, so there is nothing to consent to. If you use the chat, your browser keeps a code for your chat in its local storage, so the chat carries on from page to page; it's only used for that. Fonts are served from our own servers. We count visits to our pages on our own server, without cookies and without storing your IP address: each visit records the page, the site that linked to it, and whether it was on a phone. To count how many different people visit in a day, we keep a short code made from your IP address, your browser and a random value that we delete at the end of each day, after which the code can't be traced back to you or linked to another day's visits. Nothing is shared with anyone else. The live map on the home page loads its map tiles from OpenFreeMap, so your browser sends your IP address to OpenFreeMap's servers when you view it, as it would to any site it fetches from. We send OpenFreeMap nothing about you.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or give it to you in a portable form. Email hello@transcapi.com and we'll respond within one month. You can change your email and password, or delete your account and everything tied to it, yourself from Settings in your dashboard. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk; we'd appreciate the chance to put things right first.
Security
Passwords are stored as salted hashes, all traffic is encrypted over HTTPS, and email links for confirming addresses and resetting passwords expire and are single-purpose.
Children
TransCAPI is a service for developers and businesses and isn't aimed at children under 16.
Changes
If we change this policy in a way that matters, we'll email account holders before it takes effect.