openapi.city
Sign in

Privacy Policy

Last updated: April 2026

1. Controller

The data controller responsible for this website and service is:

Tobias Philipp Feistmantl
openapi.city
6060 Hall in Tirol, Austria
Email: hello@tfm.agency

2. What Data We Collect

We collect the following categories of personal data:

  • Account data: Email address and name you provide during registration.
  • API usage data: For each API call, we log the endpoint requested, HTTP response status code, timestamp, and originating IP address.
  • Payment data: Payment processing is handled by Stripe, Inc. (San Francisco, USA). Stripe collects and processes your credit card or payment method details. We receive only a Stripe customer ID and subscription status. Stripe's processing is governed by Stripe's Privacy Policy.
  • Session data: Cookies used for authentication and session management (see Section 6).

3. How We Collect Your Data

We collect data directly from you when you:

  • Register an account on openapi.city
  • Create or manage API keys through the dashboard
  • Make API calls to our REST API or MCP server
  • Subscribe to a paid plan via Stripe Checkout
  • Contact us via email

We do not collect personal data from third-party sources.

4. Purpose and Legal Basis for Processing

We process your personal data for the following purposes, each with its legal basis under GDPR Article 6:

  • Provide the Service (Art. 6(1)(b) — performance of contract): Account management, API authentication, usage metering, and billing.
  • Enforce usage limits (Art. 6(1)(b)): Track API call counts per key to enforce plan limits and calculate overage billing.
  • Service communications (Art. 6(1)(b)): Transactional emails — account confirmation, password reset, usage alerts, and billing notifications.
  • Service security and abuse prevention (Art. 6(1)(f) — legitimate interest): IP-based rate limiting, fraudulent activity detection, and security incident investigation.
  • Service reliability monitoring (Art. 6(1)(f) — legitimate interest): Error tracking via Sentry to identify and fix bugs. Sentry receives anonymized error data where possible.

5. Data Recipients

We share your personal data with the following processors, each under a data processing agreement:

  • Hetzner Online GmbH (Gunzenhausen, Germany): Infrastructure hosting. Processes data as our cloud infrastructure provider. Hetzner Privacy Policy.
  • Stripe, Inc. (San Francisco, USA): Payment processing. Receives payment method details and billing information. Data transfers to the US are covered by an EU-US Data Privacy Framework. Stripe Privacy Policy.
  • Mailgun by Sinch (Stockholm, Sweden): Transactional email delivery. Receives email addresses and email content for delivery purposes. Mailgun Privacy Policy.
  • Functional Software, Inc. (Sentry) (San Francisco, USA): Error monitoring. Receives error reports and performance data. Data transfers covered by EU-US Data Privacy Framework. Sentry Privacy Policy.

We do not sell, rent, or share your personal data with any other third parties.

6. Cookies

We use the following cookies:

  • Session cookie (_openapi_city_session): Required for user authentication and CSRF protection. Deleted when you close your browser.
  • Remember me cookie: If you select "Remember me" during sign in, a persistent cookie keeps you logged in. Expires after a configurable period.

We do not use third-party tracking cookies, advertising cookies, or analytics cookies (e.g., Google Analytics).

7. Data Retention

  • API call logs: Retained for 90 days, then automatically deleted in batches. Logs older than 90 days are purged daily.
  • Account data: Retained for the lifetime of your account. Upon account deletion, personal data is removed within 30 days.
  • Billing records: Retained as required by Austrian tax law (generally 7 years) for invoice and tax compliance purposes.
  • Email delivery records: Retained by Mailgun for up to 30 days for delivery tracking.

8. Your Data Protection Rights

Under GDPR Articles 15–22, you have the following rights:

  • Right of access (Art. 15): You can request a copy of the personal data we hold about you, including the purposes of processing, categories of data, recipients, and retention period.
  • Right to rectification (Art. 16): You can request correction of inaccurate or incomplete personal data.
  • Right to erasure (Art. 17): You can request deletion of your personal data. We will comply unless retention is required by law (e.g., tax records) or for the establishment, exercise, or defense of legal claims.
  • Right to restrict processing (Art. 18): You can request that we limit how we process your data, for example if you contest its accuracy.
  • Right to data portability (Art. 20): You can request your personal data in a structured, commonly used, machine-readable format (e.g., JSON), and have it transmitted to another controller where technically feasible.
  • Right to object (Art. 21): You can object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds.
  • Right to withdraw consent (Art. 7): Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, contact us at hello@tfm.agency. We will respond within one month. This period may be extended by two months for complex requests.

9. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

The competent supervisory authority in Austria is:

Österreichische Datenschutzbehörde (DSB)
Barichgasse 40-42, 1030 Wien, Austria
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

10. Data Security

We implement the following technical and organizational measures to protect your personal data:

  • TLS encryption (HTTPS) for all data in transit
  • API keys stored as bcrypt hashes — the full key is never stored and cannot be recovered
  • PostgreSQL database with encrypted connections
  • Access controls and authentication on all administrative interfaces
  • Infrastructure hosted within the EU (Hetzner, Germany)

11. Data Transfers Outside the EEA

Your data is primarily processed within the European Economic Area (EEA). The following processors operate outside the EEA:

  • Stripe (USA): Payment processing. Transfers are covered by Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.
  • Sentry (USA): Error monitoring. Transfers are covered by the EU-US Data Privacy Framework. We configure Sentry to minimize the personal data sent in error reports.

12. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

13. Provision of Personal Data

Providing your personal data (email, name) is required to use the Service. If you do not provide this data, you cannot register an account or use the API. API usage data (endpoints, IP addresses) is collected automatically as a necessary part of providing the Service.

14. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or a prominent notice on our website. Your continued use of the Service after such changes constitutes acceptance of the updated policy. This policy was last updated in April 2026.

15. Contact

For any questions about this Privacy Policy or to exercise your data protection rights:

Tobias Philipp Feistmantl
Email: hello@tfm.agency
Address: 6060 Hall in Tirol, Austria