Privacy policy

This policy explains how APICash collects and processes personal data when you use apicash.ai. We keep the data we collect narrow, and we do not sell it.

1. Data we collect

• Account data: email address, display name, country, sign-in method, and the invitation code recorded at signup.
• Authentication data: one-time code hashes, session tokens (stored as hashes), device user agent, and a truncated hash of your IP address.
• Credential data: provider, label, masked hint, non-secret provider metadata (region, endpoint, deployment), a keyed fingerprint, and the encrypted credential itself. We never store a plaintext credential.
• Settlement data: consumption statements, usage records, earnings ledger entries, and balance snapshots.
• Payout data: payout method, PayPal email or USDT address, withdrawal requests, and status history.
• Verification data: where required by tier, legal name, date of birth, country, identity document type and reference, liveness result, and proof of source. Documents are stored in private object storage with signed access only.
• Technical data: server logs, error traces, and first-party analytics events recorded only after consent.

2. Why we process it

• To perform the contract: creating your account, verifying credentials, calculating settlement, and paying withdrawals.
• Legitimate interests: preventing fraud and abuse, securing the service, maintaining audit trails, and improving reliability.
• Legal obligations: sanctions screening, anti-money-laundering checks, tax reporting, and responding to lawful requests.
• Consent: marketing email and non-essential analytics. You can withdraw consent at any time without affecting the service.

3. Credential handling

Each credential is sealed with its own AES-256-GCM data key, and that data key is wrapped by a key-encryption key held outside the database. Plaintext exists only in memory during verification and settlement operations. Access to decryption is restricted, logged, and reviewed.

We do not display a remaining provider balance, and we do not query provider billing APIs to estimate one. The only consumption figures shown in your dashboard are those returned by our settlement system.

4. Who we share data with

• Payment processors and payout partners, to send the funds you request.
• Identity verification providers, where a tier requires it.
• Email delivery providers, to send transactional and security messages.
• Cloud hosting and database providers that operate the service under contract.
• Professional advisers and authorities, where required by law or to enforce our terms.

We do not sell personal data, and we do not share credential material with advertisers or data brokers.

5. Retention

• Account and settlement records: for the life of the account plus the period required for tax and accounting.
• Credential ciphertext: until you delete the credential or close the account, then destroyed.
• Verification records: for the period required by applicable AML rules.
• Authentication logs and security events: 12 months, unless needed for an open investigation.
• Analytics events: 14 months, and only where consent was given.

6. Security

We use TLS in transit, envelope encryption at rest, least-privilege database access, rate limiting, and append-only audit logging for sensitive operations. No system is perfectly secure; if a breach affects your data we will notify you and the relevant authority as required.

7. Your rights

Depending on where you live, you may request access, correction, deletion, restriction, portability, or object to certain processing. Send requests to privacy@apicash.ai. We respond within the period required by applicable law and may need to verify your identity first. You may also complain to your local data protection authority.

8. Cookies and analytics

We use strictly necessary cookies for sign-in sessions and security. Advertising and analytics tags load only after you accept them, and are not required to use the service.

Analytics is first-party and off by default: before you choose, no analytics cookie is set and no page view is recorded. If you allow analytics, we store an anonymous visitor id, the page you viewed, the referring site, campaign parameters (UTM and click ids), an approximate country from your network, and your device class. We never put your email, name, or IP address in analytics records — the IP is reduced to a truncated hash. Browser Do-Not-Track and Global Privacy Control signals are always treated as a refusal. You can change your choice at any time by clearing the apicash_consent cookie, which makes the prompt appear again, and analytics events are deleted after 14 months.

9. International transfers

Our infrastructure may process data in countries other than yours. Where required, transfers rely on standard contractual clauses or an equivalent safeguard.

10. Children

The service is not directed to anyone under 18, and we do not knowingly collect data from children.

11. Changes

We may update this policy. Material changes are announced by email or in-product before they take effect.

12. Contact

Privacy questions: privacy@apicash.ai. General support: support@apicash.ai.