1. Scope and controller
This notice covers the Apirelio website, account workspace, ingestion API and related communications. “Apirelio”, “we” and “us” mean the service provider identified in your applicable order form or commercial agreement. Before entering a paid agreement, we provide the contracting entity and registered details.
For telemetry submitted by a customer through the SDK, that customer generally decides why the data is processed and Apirelio acts as its service provider. Account and website data are processed by Apirelio for operating the service.
2. Data we process
Account and workspace data
Name, email address, password hash, organization and project settings, API-key metadata, alert configuration, report recipients and encrypted webhook destinations configured by workspace members.
Integration telemetry
Normalized route, HTTP method and status, duration, service, environment, customer and application identifiers, API version, SDK version, release, stable error code and explicitly allow-listed metadata.
Contact and security requests
The name, email, company, selected topic and message you submit. Infrastructure may temporarily process connection information for delivery, abuse prevention and rate limiting; it is not added to customer analytics.
Request or response bodies, credentials, cookies, query strings or client IP addresses as event dimensions.
3. Website analytics
We use a self-hosted instance of Umami on our public website to understand aggregate traffic and improve content and navigation. It records page views, referring pages, browser and operating-system categories, device type, approximate country and visit time. We do not use this information for advertising or cross-site tracking.
The tracker does not set cookies, use browser fingerprinting or store a persistent identifier on your device. We do not send names, email addresses or Apirelio workspace activity to Umami, and authenticated dashboard routes are excluded from website analytics.
We process these limited statistics for our legitimate interest in measuring and improving the public website. Website analytics are retained for no longer than 12 months and are hosted on infrastructure under our control.
4. Optional cookies and conversion measurement
If you choose “Allow optional cookies”, we load the Google tag to understand whether a Google ad led to a new Apirelio account. Google may store first-party advertising and measurement identifiers in your browser and receive page and conversion information together with an opaque, randomly generated transaction ID.
We do not send Google your name, email address, Apirelio account activity or customer telemetry, and we disable ad-personalization signals. The tag is not loaded before permission is granted. You can reject or change your choice at any time through “Cookie settings” in the website footer.
Your permission is optional and can be withdrawn at any time. Withdrawing it stops future advertising measurement in this browser; it does not affect processing that occurred while permission was active.
5. Error monitoring
We use Sentry to detect software failures and keep Apirelio reliable. Error reports can include a stack trace, application release, environment, browser or runtime version, and the application code location where the failure occurred.
Our integration removes user identity, request and response bodies, URLs, headers, cookies, query strings, breadcrumb details and custom metadata before an error is sent. Performance tracing, profiling and session replay are disabled. Sentry processes these limited diagnostics as our service provider for our legitimate interest in securing and maintaining the service.
6. Why we process data
We process data to provide and secure the service, authenticate users, display integration analytics, deliver requested reports, alerts and webhook notifications to destinations selected by workspace members, respond to messages, prevent abuse and meet legal obligations. With permission, we separately measure Google Ads registrations. We do not sell personal data or use customer telemetry for advertising.
8. Retention and security
Telemetry retention is configured per project and plan. Account data is kept while the workspace is active and for a limited period needed for recovery, security and legal obligations. Contact messages are retained only as long as reasonably needed to answer and document the request.
We use access controls, hashed secrets, scoped ingestion keys, validation and operational monitoring. No internet service can promise absolute security; suspected issues can be reported through our dedicated security contact path.
9. Your choices and rights
Depending on your location, you may request access, correction, deletion, restriction, portability or objection. You may also complain to your local data protection authority. Workspace administrators can update most account and project information directly.
We verify requests before acting and may need to retain limited information where required by law or necessary to protect the service.
10. Contact
Submit privacy questions or rights requests through the contact form and choose “Privacy request”. Include the email associated with your account, but never send passwords, ingestion keys or customer payloads.
Contact privacy →