Privacy Policy

1. Overview & Data Controller

This Privacy Policy explains how Gaara APIs ("we", "our", "us"), operating Gaara APIs (gaara-apis.online), collects, uses, and safeguards information when you register, access our API gateway, and utilize our developer tools.

For any data protection inquiries, you may contact our designated data officer directly at support.gaaradev@gmail.com.

2. Data We Collect

• Authentication Information: When signing in via Google OAuth 2.0, we receive your email address, verified display name, and profile picture.
• API Telemetry & Request Metadata: We log timestamp, endpoint accessed, HTTP status code, request duration in milliseconds, and IP address for security, rate-limiting, and quota enforcement.
• Feedback Data: Any feedback, bug reports, or feature requests voluntarily submitted via our community portal.

3. Purpose of Processing & Legal Basis

We process personal data under the following legal bases:

• Performance of Contract: Provisioning your API credentials, enforcing monthly request quotas, and serving gateway responses.
• Legitimate Interests: Protecting our infrastructure against Distributed Denial of Service (DDoS) attacks, brute-force requests, and abuse.
• Consent: Storing cookie preferences and non-essential analytical cookies where permitted.

4. Third-Party Data Processors

We utilize trusted third-party infrastructure providers:

• Supabase Inc. — Managed PostgreSQL database with Row Level Security (RLS) located in secure cloud regions.
• Google LLC — OAuth 2.0 Identity Provider authentication.
• Brevo (Sendinblue SAS) — Transactional email delivery for security alerts and quota notifications.
• Vercel Inc. — Edge hosting and serverless API execution runtime.

5. Data Retention & Your Rights

You retain the right under GDPR and applicable data protection regulations to request access to, correction of, or deletion of your personal data stored within our Supabase database. To exercise your rights, email support.gaaradev@gmail.com.