Privacy Policy

1. Who is responsible

Synergic APIs, a small software business established in Spain, is the data controller for the personal data described here. Contact for anything privacy-related: support@synergicapis.com.

2. What we collect and why

• Email address — collected when you request an API key. Legal basis: performance of a contract (issuing and managing your key, quota notices, essential service announcements). We do not send marketing email.
• API usage data — per-key request counts, timestamps, endpoints called and standard server logs (including IP address, kept briefly for security and abuse prevention). Legal basis: performance of a contract (enforcing quotas) and legitimate interest (keeping the Service secure and reliable).
• Payment data — payments are handled entirely by Stripe, acting as our payment processor. We never see or store your card number; we receive from Stripe only what we need to link a subscription to your key (email, plan, subscription status). See Stripe's privacy policy.
• Aggregated website statistics — when you browse this site we increment counters on our own server (go.synergicapis.com): the page you opened, which buttons or links were used, the hostname of the site that referred you (for example dev.to) — never the full referring URL — and, if you arrived through one of our campaign links, the short campaign tag it carries (for example devto-p3). Every one of these is reduced to a short value from a fixed list before it is stored. No cookie, no device identifier, no IP address and no user agent are stored, so these counters cannot be tied back to you or to a browsing session. Legal basis: legitimate interest (art. 6(1)(f) GDPR) in understanding, in aggregate, which pages and features are useful. You can object at any time under art. 21 GDPR by writing to us, and any browser sending Global Privacy Control or with JavaScript disabled is not counted at all.
• Audience statistics (Vercel Web Analytics) — our hosting provider, Vercel, records for each page view: the page URL and any query parameters it carries, the referring site, an approximate location derived from your connection (country, region, city), your device type, operating system and browser. It sets no cookies; visitors are counted using a hash derived from the incoming request which, per Vercel, is discarded after 24 hours and cannot be used to follow you across other websites. We deliberately do not load it on the payment confirmation page, because that page's address carries your Stripe checkout reference. Legal basis: legitimate interest (art. 6(1)(f) GDPR) in knowing, in aggregate, who reaches the site and from where; you can object at any time under art. 21 GDPR. See Vercel's Web Analytics privacy documentation.

3. Cookies and tracking

This website sets no tracking or advertising cookies and loads no third-party fonts or CDNs. We use two measurement systems and neither uses cookies nor stores any identifier on your device: our own first-party counters, and Vercel Web Analytics, whose script is served from this same domain (/_vercel/insights/) rather than from an external tracker host. We run no advertising, no cross-site tracking and no profiling. Any storage used is strictly necessary for the Service to function.

There is one thing our counters can write to your browser, and only if you switch it on yourself: an opt-out flag. Open any page with ?notrack=1 and we store a single value (synergic-notrack) so that the counters on this website stop recording this browser; ?notrack=0 deletes it. It holds no identifier, it is never sent to us, and it is one of the mechanisms we use to keep our own testing out of our statistics. We also honour Global Privacy Control: if your browser sends that signal, our own counters record nothing, with no flag to set. Vercel Web Analytics does not act on either of these — to exclude it, block the request to /_vercel/insights/.

4. Who we share data with

Only with the processors needed to run the Service: Stripe (payments) and our hosting and infrastructure providers — chiefly Vercel, which both serves this site and provides the audience statistics described above — under their respective data-processing agreements. Some providers may process data outside the EEA; where that happens, transfers rely on safeguards such as the EU Standard Contractual Clauses or an adequacy decision. We do not sell personal data.

5. Retention

Account data (email, key, plan) is kept while your account is active and for the period needed to meet legal obligations (e.g. Spanish tax records for paid subscriptions). Server logs are kept for a short rolling window. Aggregated website statistics are plain counters grouped by calendar month — we keep no chronological log of individual visits — and they expire automatically after 25 months. One related record is worth naming explicitly: when one of our short links (go.synergicapis.com) is followed, we keep it in a rolling list of the last 100 clicks holding the link name, the campaign tag, the referring hostname and a timestamp, so we can tell whether a published link still works. It carries no identifier, it is overwritten continuously, and it expires after the same 25 months. Audience statistics held by Vercel are retained for the reporting window of our plan, currently 12 months. If you ask us to delete your account, we remove your data except what we are legally required to retain.

6. Your rights (GDPR)

Under the GDPR and Spanish law (LOPDGDD) you can exercise your rights of access, rectification, erasure, restriction, portability and objection by emailing support@synergicapis.com. We answer within the legal deadline. If you believe we have mishandled your data, you can lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD).

7. Changes

If this policy changes materially, we will announce it on this page and, for registered users, by email.