Privacy policy

Who processes the data

The APIUniCon service on apiunicon.online and apiunicon.ru is provided by Zabsoft LLC (შპს ზაბსოფტ), registration number 445868605, address: 4e Giorgi Leonidze St., building 2, floor 6, apt. 75, Batumi, Georgia ("we"). Write to support@apiunicon.online about your data.

What we store

Account: your email address, a hash of your password (we never store the password itself), your plan and usage, dates of registration, email confirmation and password change, and the start time of active sign-in sessions.

Connections: their names, API addresses, the services' documentation, request descriptions (adapters), a call log (time, duration, operation, response status, error category), adapter test results, and notes about the API's behavior that your assistant records. We do not keep response content or request arguments in the log; the assistant is instructed not to put them into notes.

Claude connection: the permission granted to the Claude app (it ties the app to your account) and its tokens. The access token lasts 1 hour, the refresh token 30 days, the permission up to a year; everything is erased on expiry, when access is revoked and when the account is deleted.

The keys to your services are stored only encrypted and are decrypted at the moment your request runs. We show them neither to your AI assistant nor on our pages.

We do not keep the content of your services' responses in our logs: it goes to your AI assistant at your request.

Technical data: the IP address, the email address typed into the sign-in, sign-up or password-reset form (even if no such account exists), the time of these attempts and of attempts to connect Claude, and the time of password checks on the account page (password change, account deletion), to protect sign-in from password guessing and the service from abuse. Kept for up to 2 days.

Why

To provide the service: run requests to the APIs you connect, count plan limits, send emails about your account (email confirmation, password reset), and protect the service. We do not sell data, show ads, or train models on your data.

Legal basis

Performing our contract with you (the terms of use) and our legitimate interest in keeping the service secure.

Where the data is stored

On servers in Poland (European Union) rented from Hostkey. Each account's connections, keys, adapters and call log are kept in its own separate database; the account data itself (email, password hash, plan, usage, sessions) is in the service's shared database.

Who receives the data

Hostkey: server hosting.

Resend (a US company; mail from our domains is sent from its servers in Ireland): sending emails; it receives your email address and the text of the email.

Your AI assistant (for example, Claude by Anthropic) receives the data you request from your services, at your request and under its provider's terms.

The services you connect receive your requests together with your keys, just as if you called them directly.

Public authorities: only on a lawful demand.

How long the data is kept

As long as your account exists. An address entered at sign-up but never confirmed is deleted after about 7 days. Deleting the account on the Account page at once erases the account data, sessions, plan and usage, revokes Claude's access, and erases its database with connections, keys and call log. If that database file cannot be erased at once, the service tries again every 10 minutes until it is gone. Usage records are kept for up to 400 days, technical records of attempts to sign in, sign up, reset a password or connect Claude and of password checks on the account page for up to 2 days. Backups are kept for up to 12 months; deleted data leaves them when that period ends.

The administrator action log (blocking, unblocking, plan assignment: email address, action, date) is kept for up to 12 months, including after the account is deleted.

Cookies

Only the necessary ones. Long-lived: the sign-in session apiunicon_session (30 days) and form protection apiunicon_form (30 days; set when you first open any page of the site). Short-lived: the administrator's second-factor step apiunicon_pending (10 minutes) and the one-time links to the key-entry and connection-deletion confirmation pages, apiunicon_connect and apiunicon_confirm (30 minutes). When you connect Claude to your account, the service cookies _session (up to 30 days), _interaction and _interaction_resume (1 hour) and their signature cookies (.sig) are set. No analytics or advertising cookies.

Your rights

You may learn what data about you we hold, correct it, delete your account (on the Account page), or object to processing. Write to support@apiunicon.online; we answer within 30 days. You may also complain to the data protection authority of your country.

Security

Connections use HTTPS, keys are encrypted, each account's connections are kept in a separate database, and administrator sign-in requires a second factor.

Changes

We announce material changes by email in advance. The current version is always on this page.