1. Who we are and what this policy covers
This policy explains how Program Alpha, Inc. (“PrimaryAPI”, “we”) handles personal information when you use our website, dashboard, API, MCP server and agent files (the “Service”).
It has two audiences:
- Customers, meaning the people and organisations with an account, and the agents acting for them. For this information we are the controller.
- People whose information passes through the API, for example the owner of a public profile a customer looks up, or the person behind an email address a customer validates. For this information we act as a processor on the customer’s instructions; the customer is the controller. See data that passes through the API.
2. What we collect about customers
| Category | Examples |
|---|---|
| Account | Name, email address and a hash of your password (never the password itself). If you sign in with GitHub or Google, also your account ID there and your profile picture; see signing in with Google. |
| Billing | Credit purchases and plan payments (amounts and dates), your credit balance and the payment provider’s customer and payment references. Card details are entered on the payment provider’s page; we never see or store full card numbers. |
| API keys | A one-way hash of each key, its visible prefix, label, access level, spend limit and expiry. |
| Usage | For each call: the API, status, cost, latency, timestamps, the provider that served it and a request ID. For non-restricted APIs also the input you sent; for restricted APIs only a hash of it. The full result for the retention window. |
| Agent trial keys | The optional label the agent supplied, the network address it signed up from (used to limit sign-ups) and what the key spent. |
| Security records | For sign-in sessions and security-relevant actions (such as creating, rotating or revoking a key): IP address, browser user agent and time. |
| Communications | Messages you send us, including API requests and bug reports. For the public API request form we keep the email you give us, if any, and a keyed hash of your IP address for spam control, not the address itself. |
3. How we use customer information
- To run the Service: authenticate you, route and run your calls, and keep your request history and stored results.
- To bill you: charge each call in credits, process credit purchases, plan payments and any refunds, and keep accounting records.
- To keep the Service safe: enforce spend limits and rate limits, detect fraud and abuse, and investigate security incidents.
- To support you: answer questions, look into failed calls and tell you about changes that affect your account.
- To improve the Service, using aggregated figures such as request counts and success rates per API and provider. The public network page shows only aggregates and never identifies a customer.
- To meet legal obligations, such as tax record keeping and responding to valid legal requests.
4. Signing in with Google
You can create your PrimaryAPI account and sign in with your Google account. Google first asks for your permission, then shares the following with us (the openid, email and profile permissions):
- your Google account ID, which links your Google account to your PrimaryAPI account;
- your email address and whether Google has verified it;
- your name and a link to your profile picture.
That is all. Signing in with Google does not give us access to your Gmail, Google Drive, Calendar, Contacts or any other Google data, and it does not let us act in your Google account.
How we use it
Only to create your account, sign you in and send you emails about your account, such as sign-in and billing emails. We do not use it for advertising, we do not sell it, and we do not use it to train AI models.
How we store and protect it
We keep these details with your account in our database, hosted by our cloud provider and protected as described under security. Google also gives us a short-lived access token to read them; we use it once during sign-in and do not store it.
Who we share it with
No one, except the service providers that host our database and deliver our account emails, under contracts that limit their use of it, and where the law requires it (see who we share information with). We do not transfer it to advertisers, data brokers or other apps.
How long we keep it, and how to delete it
We keep it while your account is open. To delete it, email [email protected] from the address on your account; we delete your account and these details, except records the law requires us to keep. You can also remove PrimaryAPI’s access at any time on your Google Account’s third-party apps and services page.
PrimaryAPI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Legal bases (EU and UK)
- Contract: running your account, your calls and your credits.
- Legitimate interests: security, fraud and abuse prevention, service improvement from aggregated data, and communicating with you about the Service. We balance these against your rights and you can object.
- Legal obligation: accounting, tax and responses to lawful requests.
- Consent: only where the law requires it, and you can withdraw it at any time.
7. Data that passes through the API
Customers send us inputs, such as a username, profile URL, domain, email address or phone number, and we return data from third-party sources. For this processing we act on the customer’s instructions under our Data Processing Addendum.
- We pass the parameters a call needs to the provider that serves it. Sources are publicly available, logged-out pages and services, licensed data providers and public registries.
- We do not maintain or sell a database of people. We do not combine results across customers, and there is no shared cache.
- Full results are kept for the retention window so the customer can read them again, then deleted. For restricted APIs (such as people search and contact data) we keep only a hash of the input.
- The customer decides why and how to use the results, and is responsible for having a lawful basis and giving any notices the law requires. Our Acceptable Use Policy forbids surveillance, stalking, spam and decisions about people’s eligibility for credit, employment, housing or insurance.
If you were looked up
You can ask us what we hold about you and ask us to delete it. Email [email protected] with the identifier concerned (for example a username or email address). We delete stored results that contain your information and, where our records show which customer ran the lookup, we pass your request on to them, because they decide how the data is used. We will never ask for a government ID number to verify a request.
9. International transfers
We and our service providers may process information in countries other than yours, including the United States. Where the law requires it, we protect transfers out of the EU, the UK and Switzerland with appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK addendum to them.
10. How long we keep information
| Information | How long |
|---|---|
| Full API results | The retention window, 24 hours by default, then deleted. |
| Request records (API, status, cost, timing, provider; the input for non-restricted APIs) | While your account is open, so you can see your history and we can resolve billing questions. |
| Inputs to restricted APIs | Never stored in readable form; only a hash is kept, with the request record. |
| Account, keys and credit balance | While your account is open. After closure we delete or anonymise them, except records we must keep by law. |
| Billing and ledger records | As long as tax and accounting law requires. |
| Security records (sessions, audit log) | As long as needed to protect accounts and investigate incidents. |
| Messages and API requests you send us | As long as needed to handle them and follow up. |
Signed-in sessions expire after 30 days without use.
11. Security
We hash API keys, session tokens and passwords, serve the Service over encrypted connections, give keys the least access they need and limit what we store. No system is perfectly secure; our security page describes the measures in place today, what we do not have yet and how to report a vulnerability.
12. Your rights
Depending on where you live, you may have the right to:
- know what personal information we hold about you and get a copy of it, in a portable format where applicable;
- correct information that is inaccurate;
- delete your information;
- object to or restrict certain processing, including processing based on legitimate interests;
- withdraw consent where processing is based on consent;
- opt out of the sale or sharing of personal information (we do neither) and limit the use of sensitive information (we do not use it to infer characteristics about you);
- not be treated differently for exercising these rights; and
- complain to your data protection authority.
To make a request, email [email protected]. We may need to confirm that the request comes from you, usually by replying from the email address on the account. An authorised agent can make a request for you with your signed permission. We answer within one month for GDPR requests and within 45 days for California requests, and tell you if we need longer.
If your request concerns data a customer looked up through the API, we act as that customer’s processor and will forward it to them as described above.
13. Children
The Service is not directed to children, and customers must be at least 18. We do not knowingly collect information from children as customers. If you believe a child has given us information, contact us and we will delete it.
14. Changes to this policy
We will update this policy when our practices change. For material changes we will tell customers by email or in the dashboard before they take effect. The date at the top shows the latest revision.
15. Contact
Program Alpha, Inc., 1388 Haight St #1301, San Francisco, CA 94117, United States. Privacy questions and requests: [email protected].