Data Processing Addendum

This Data Processing Addendum (the "Addendum") forms part of the Terms of Service between you ("Customer") and AnyAPI Labs, Inc. ("AnyAPI"). It applies automatically, with no signature required, whenever Customer Data you send to or retrieve through the Service contains personal data. You do not need to request it or negotiate it to be covered by it.

If your organization needs a countersigned copy for its own records, write to support@getanyapi.com and we will sign this document as published. We do not negotiate variations: one published addendum that every customer can read and compare is worth more than a drawer of bespoke ones.

Where this Addendum and the Terms of Service conflict on the handling of personal data, this Addendum wins. Everything else in the Terms of Service continues to apply unchanged.

• Customer Data has the meaning given in the Terms of Service: the request parameters you submit to the Service and the data retrieved and returned to you in response.
• Personal data, processing, controller, processor, data subject, and personal data breach have the meanings given in the applicable data protection law. Where a law uses different words for the same idea, its words apply: a controller is a "business" under the CCPA and a "Data Controller" under Thailand's Personal Data Protection Act, and a processor is a "service provider" and a "Data Processor" respectively.
• Data protection law means every law on the protection of personal data that applies to a party's processing under this Addendum, including the EU and UK General Data Protection Regulation, the Swiss Federal Act on Data Protection, US state privacy laws, and Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
• Sub-processor means a third party engaged by AnyAPI that processes Customer Data. Annex B lists them.

Customer Data: you are the controller, AnyAPI is your processor. You decide what the Service retrieves and why. We act only on your instructions and have no independent purpose of our own for that data.

Account, billing, and website data: AnyAPI is the controller. Your name and email, your wallet and payment records, your support messages, and the analytics we collect on our own websites are ours to handle, and our Privacy Policy governs them, not this Addendum.

Operational telemetry is ours. Request counts, latency, error rates, spend, and which source served a request are facts about how our own Service ran. We process them as controller to operate, secure, bill for, and improve the Service, and we may publish them only in aggregated, de-identified form.

Your instructions to us are: the Terms of Service, this Addendum, and the API requests you make. We process Customer Data only to provide, secure, bill for, and support the Service, and for no other purpose. We do not sell Customer Data, we do not share it for cross-context behavioral advertising, and we do not use it to train machine learning models, our own or anyone else's.

If we believe an instruction of yours breaks data protection law, we will tell you rather than carry it out silently. If a law requires us to process Customer Data beyond your instructions, we will tell you before we do, unless that same law forbids telling you.

You remain responsible for lawful collection. Nothing in this Addendum moves that responsibility to us. You choose which accounts, pages, and records to retrieve and you must have a legal basis for doing so, as Section 8 of the Terms of Service and the Acceptable Use Policy both say. We make no representation that retrieving any particular data is lawful for your purposes.

Access to Customer Data is limited to the people who need it to run the Service, each of whom is bound by a duty of confidentiality that survives the end of their engagement. AnyAPI Labs is a one-person company today, so in practice that is the founder alone; if that changes, the duty above is what every new person is bound by before they are given access.

We maintain technical and organizational measures appropriate to the risk, and we will not weaken them during the term. Today these are:

• Encryption in transit. HTTPS on every public surface, and on every call we make to a data source on your behalf.
• Encryption of retained failure bodies. When a source returns an error, its response body is stored encrypted, capped at 256 KiB, and every read of it is recorded with who read it and when.
• Credential handling. Your API key is stored only as a SHA-256 hash, so a lost key can be revoked and replaced but never recovered from us. The credentials we use with data sources are ours, held in a managed key vault rather than in the application.
• Access control and isolation. Production access is restricted to the people named in Section 5, over an authenticated private network. Customer Data is partitioned by account and every request is scoped to the account whose key made it.
• Least retention. The windows in Section 10 are enforced by scheduled deletion in the gateway itself, not by policy alone.

We hold no third-party security certification: there is no SOC 2 report and no ISO 27001 certificate. We say so here rather than let a reviewer assume otherwise.

You give AnyAPI general authorization to engage sub-processors. Annex B lists the ones engaged today and what each does. Every sub-processor is bound by written terms that impose data protection obligations no weaker than this Addendum, and AnyAPI remains liable to you for a sub-processor's performance as if it were our own.

Before a new sub-processor begins processing Customer Data, we will update Annex B and notify you by email at least 30 days beforehand. If you reasonably object on data protection grounds within those 30 days, tell us and we will either keep your traffic away from that sub-processor or, if we cannot, let you terminate the affected part of the Service and refund your unused purchased balance for it.

If a data subject contacts us directly about Customer Data, we will not answer them on your behalf. We will pass the request to you and tell the person we have done so. Taking account of what we hold and the short windows in Section 10, we will give you reasonable help to meet a request to access, correct, delete, restrict, or port personal data, or to object to its processing. For most requests the honest help is fast: we typically hold no response payload at all, so the answer usually lies in your own systems rather than ours.

If we become aware of a personal data breach affecting Customer Data, we will notify you without undue delay and in any event within 72 hours, by email to your account address. The notice will describe what happened, the categories and rough volume of data and people affected so far as we know them, the likely consequences, and what we are doing about it. If we cannot establish all of that at once we will send what we have and follow up rather than wait. We will give you reasonable help with your own notification duties to regulators and data subjects.

These windows are enforced by scheduled deletion in the gateway itself, not by policy alone:

• Retrieved data (the response payload): normally not stored at all. On an ordinary successful request we do not persist the response. It is written down in exactly two cases. If you send an idempotency key so a retry can replay the same answer, it is kept for 24 hours. If your client disconnects mid-request after we have already paid a source for the data, it is kept for 5 minutes so your retry can collect it. Payloads above 5 MiB are not stored in either case.
• Request parameters: kept with the billing record. What you asked for, which endpoint, what it cost, when, and which API key made the call. This is the record that proves a charge, so it is not on a short clock and we cannot delete it while it is needed for billing, tax, or accounting.
• Source error bodies: 30 days, encrypted and access-logged, kept so a failure can be diagnosed.
• Per-attempt diagnostics: 90 days. Which source was tried, what it returned, what it cost, how long it took.

The shortening lever is in your hands. If you do not send idempotency keys, no response payload of yours is ever written to our database. If you need a shorter window than the ones above for the records we do keep, write to support@getanyapi.com; we will tell you plainly whether we can do it rather than agree to something the gateway does not do.

When you close your account, or on your written request, we will delete Customer Data within 30 days, except what we must keep for legal, tax, and accounting purposes and any copy held in routine encrypted backups, which ages out on the backup cycle. Aggregated, de-identified statistics that can no longer identify you or any data subject may be retained. We will confirm deletion in writing if you ask.

On request, and no more than once a year unless a regulator or a breach requires otherwise, we will give you the information reasonably needed to show we are meeting this Addendum: a written answer to your security questionnaire, a description of our measures, and our current sub-processor list. We do not offer on-site inspection, and we will not pretend otherwise: we are a one-person company with no audit function to host one. If your procurement process requires an on-site audit or a SOC 2 report, ask us before you build on us and we will tell you plainly where we stand.

AnyAPI is established in the United States and Customer Data is processed there and at the edge locations of the delivery network in Annex B. Annex C sets out the transfer mechanism for each region whose law restricts transfers, including the standard contractual clauses for the EEA, the UK, and Switzerland, and the appropriate safeguards under Section 28 of Thailand's PDPA.

This Addendum lasts as long as we process Customer Data for you, and the obligations in Sections 5, 9, 10, and 11 survive its end. Each party's liability under this Addendum is subject to the limitations and exclusions in the Terms of Service, and those caps apply to both parties' liability in aggregate under the Terms and this Addendum together.

We may update this Addendum to reflect a change in law, a new sub-processor, or a change in how the Service works. For a material change we will give notice by email or through the Service before it takes effect, and the revised date at the top of this page is always the date that applies.

Data protection questions, signature requests, sub-processor objections, deletion requests, and breach correspondence all go to support@getanyapi.com. There is no separate privacy address today; mail sent there reaches the founder.

• Subject matter. AnyAPI's provision of the Service: retrieving data you ask for from third-party sources, normalizing it to the endpoint's published schema, returning it to you, and metering the charge.
• Duration. For as long as the Terms of Service are in force, plus the retention windows in Section 10 of this Addendum.
• Nature and purpose. Collection, transmission, structuring, short-term storage where Section 10 allows it, and deletion. We process Customer Data to provide, secure, bill for, and support the Service, and for nothing else.
• Frequency. Continuous, on each request you make.
• Types of personal data. Determined by you, because you choose the endpoints and the parameters. In practice the public web and social endpoints return account handles and display names, profile descriptions, avatar and media links, post and review text, timestamps, engagement counts, and whatever personal data a person has chosen to publish in that content. Some business data endpoints return names, job titles, employers, work email addresses, and phone numbers.
• Categories of data subjects. Determined by you. In practice: holders of public accounts, authors of public posts and reviews, and business contacts whose details you request.
• Special category data. The Service is not designed for it and you must not instruct us to seek it out, as the Acceptable Use Policy says. Where public content you retrieve happens to contain it, you are responsible for having a lawful basis.

Sub-processors of Customer Data. These process the request parameters you send and the data retrieved for you:

• Microsoft Azure. Gateway compute, the request database, and secret storage. Processed in: United States.
• Cloudflare. Website and gateway delivery, caching, and denial-of-service protection. Processed in: Global edge network, with our origin in the United States.

Third-party data sources. To answer a request we send the parameters needed to fulfill it to the source that serves that endpoint, and it returns the data. These sources are sub-processors of Customer Data and are bound by written terms as Section 7 requires. Every endpoint page in the catalog lists the sources that can serve that endpoint, with each one's price and its measured uptime. Direct sources are listed under their own brand; others are listed under a stable substitute name, because which source serves a given request is commercially sensitive and changes with price, health, and availability.

If you need the identities behind those substitute names for your own data protection register, write to support@getanyapi.com and we will provide the current list under a mutual non-disclosure agreement. We will not map a source to an individual request or confirm which one served a particular call.

Not sub-processors of Customer Data. These see only account, billing, and website data, for which AnyAPI is the controller and the Privacy Policy governs:

• Clerk. Account authentication and sign-in. Processed in: United States.
• Autumn. Wallet billing and subscription records. Processed in: United States.
• Stripe. Payment processing for wallet top-ups, behind Autumn. Processed in: United States.
• PostHog. Product analytics and session replay on our websites and dashboard. Processed in: United States.

C.1 EEA, United Kingdom, and Switzerland. Where you transfer personal data subject to the EU GDPR, we enter into the standard contractual clauses in Commission Implementing Decision (EU) 2021/914, which are incorporated into this Addendum by reference. Module Two applies where you are a controller, and Module Three where you act as a processor for another controller. For the options in those clauses: Clause 7 (docking) applies; Clause 9 option 2 applies, with the 30 days notice in Section 7 of this Addendum; the optional redress clause in Clause 11(a) does not apply; Clause 17 option 1 applies with the law of Ireland; and the forum under Clause 18(b) is the courts of Ireland. Annex I is populated by Annex A and the party details in this Addendum, Annex II by Section 6, and Annex III by Annex B.

For personal data subject to the UK GDPR, the International Data Transfer Addendum issued by the Information Commissioner under Section 119A of the Data Protection Act 2018 (version B1.0) applies to those clauses. Table 1 is populated by the party details in this Addendum, Tables 2 and 3 by the paragraph above and its annexes, and neither party may end the UK Addendum under Table 4. For personal data subject to the Swiss FADP, the clauses apply with references to the GDPR read as references to the FADP, the competent authority read as the Federal Data Protection and Information Commissioner, and the protections extended to data about legal entities.

C.2 Thailand. Where you are a Data Controller subject to Thailand's Personal Data Protection Act B.E. 2562 (2019) and you send personal data to AnyAPI in the United States, this Addendum is the appropriate safeguard for that transfer under Section 28 of the PDPA and the Personal Data Protection Committee's notification on the criteria for protecting personal data sent or transferred abroad (B.E. 2566, 2023). We state plainly that the Committee has not designated the United States as providing adequate protection, so what protects the transfer is this contract, not a finding about our country.

As your Data Processor, AnyAPI undertakes the duties in Section 40 of the PDPA:

• To process personal data only on your documented instructions, as Section 4 of this Addendum provides, and to tell you if we believe an instruction breaks the PDPA.
• To provide appropriate security measures to prevent loss and unauthorized access, use, alteration, or disclosure, as Section 6 of this Addendum sets out.
• To notify you of a personal data breach without delay. Section 9 of this Addendum binds us to 72 hours, which is the shorter commitment and the one that applies.
• To prepare and maintain a record of the processing activities we carry out for you.

Onward transfers carry the safeguard with them: every sub-processor in Annex B is bound by terms no weaker than this Addendum, and AnyAPI stays liable to you for what they do. You may enforce these commitments against us directly, and we will cooperate with the Committee on any request that concerns your data.

Two limits, said rather than left for you to discover. This safeguard covers the transfer of personal data to us and what we do with it once it arrives. It does not supply your lawful basis under Section 24 or Section 26 of the PDPA for collecting the data in the first place, and it does not make us responsible for whether your collection is lawful. That division is the same one Section 4 of this Addendum and Section 8 of the Terms of Service already draw.