Privacy Policy
In short: We store your email, your API key hashes, your credit balance and a log of the requests you make. Payments are handled by Waffo Pancake, so we never see or store your card number. We do not store the Reddit data returned to you. We do not sell personal data and we run no advertising trackers. Write to support@apixstar.com to access or delete your data.
1. Who this policy covers
This policy explains how comiaos, LLC, a company organized under the laws of the State of Delaware, United States, with its address at 1207 Delaware Ave #1163, Wilmington, DE 19806, United States ("Apixstar", "we", "us") handles personal data when you visit the website, hold an account or call the API. For that data we are the data controller. Privacy requests go to support@apixstar.com. We have not appointed a data protection officer, because our processing does not require one.
It also explains, in section 7, how we handle public Reddit content that passes through the API, and what a Reddit user can ask of us.
2. What we collect
| Data | Details | Why |
|---|---|---|
| Account | Your email address and the Google account identifier, received from Google when you sign in. We do not receive your Google password. | To create and secure your account and to contact you about it |
| Session | A hashed session token and its expiry time. The session cookie lasts up to 30 days. | To keep you signed in |
| API keys | A hash of each key, its short prefix, name, creation time, last use and revocation time. The full key is shown once and is not stored in readable form. | To authenticate requests |
| Billing | Top-up bought, amount, currency, order reference, status and time. Payment is processed by Waffo Pancake. Card numbers and other payment credentials never reach our servers. | To deliver credits, handle refunds and keep financial records |
| Credits | Your balance and a ledger of grants, purchases, charges and reversals | To meter usage accurately |
| API usage | For each request: the API key used, method, requested path, status, results returned, amount charged, duration and time | To show your usage, bill correctly, debug and prevent abuse |
| Technical | IP address, user agent and similar request metadata, processed by our hosting provider to deliver and protect the Service | Security, rate limiting and reliability |
| Support | Messages you send us and our replies | To answer you |
We do not ask for your Reddit username or password, and the Service never logs in to Reddit as you.
3. How we use it and our legal bases
- To provide the Service you signed up for: accounts, keys, metering and support. Legal basis: performance of our contract with you.
- To take payment and keep records. Legal basis: contract and legal obligation.
- To keep the Service secure and reliable, including rate limiting, fraud prevention and debugging. Legal basis: our legitimate interests.
- To send service messages, such as receipts, security notices and changes to our terms. Legal basis: contract and legitimate interests.
- To comply with the law and respond to lawful requests.
We do not sell personal data. We do not share it for cross-context behavioral advertising. We do not use it for automated decisions that have legal or similarly significant effects on you. We send marketing email only if you have opted in, and you can opt out at any time.
4. Who we share it with
We share personal data only with providers that help us run the Service, and only as far as they need it:
| Provider | Role | Data |
|---|---|---|
| Cloudflare | Hosting, network, database and storage | All Service data, request metadata |
| Sign-in | Email address and account identifier | |
| Google Analytics | Visit statistics for the public website | Pages viewed, referrer, approximate location, device and browser, and a random visitor ID kept in a cookie |
| Waffo Pancake | Checkout, payment processing, sales tax, refunds and chargebacks, as merchant of record | Your internal account ID, the top-up bought and our order reference |
Payments. When you buy credits, you pay on a checkout page run by Waffo Pancake. It collects your payment details, billing email, billing country and any tax ID directly from you, and it is an independent controller of that payment, tax, fraud-prevention, refund and chargeback data under its own privacy policy, which is linked on the checkout page. Payment card data is processed only by Waffo Pancake, a PCI DSS certified processor, and is not stored on our servers. We do not send it your email address. It tells us whether an order was paid or refunded so that we can add or remove credits.
API requests are fulfilled through infrastructure operated by the same team that runs Bavior. Your account email and billing details are not sent with those requests.
We may also disclose data when the law requires it, to protect our rights or the safety of others, or as part of a merger, acquisition or sale of assets. In that last case we will tell you before your data becomes subject to a different privacy policy.
5. Cookies
We use a first-party cookie, apixstar_session, which keeps you signed in. It is strictly necessary and does not track you across other sites. We do not use advertising cookies or third-party advertising pixels.
The public website at apixstar.com uses Google Analytics to count visits and see which pages are read. It sets first-party cookies whose names start with _ga, which hold a random visitor ID for up to two years. The console and the API do not load it, and we do not send it your account email or your API requests. You can block it with the Google Analytics opt-out add-on or by blocking cookies in your browser.
Our pages load fonts from Google Fonts. Your browser contacts Google to fetch them, which shares your IP address with Google. Waffo Pancake may set its own cookies on its checkout pages. We use no marketing cookies.
6. How long we keep it
| Data | Retention |
|---|---|
| Account and API key records | While your account is open, then deleted or anonymized within 30 days of closure |
| Sessions | Up to 30 days, or until you sign out |
| API usage logs | Up to 12 months |
| Billing and credit ledger records | As long as tax and accounting law requires, typically up to 7 years |
| Support messages | Up to 3 years |
We may keep data longer where the law requires it or where we need it to resolve a dispute or enforce our terms.
7. Public Reddit content
The API returns content that is publicly visible on Reddit, such as posts, comments, usernames and scores. This content can include personal data about Reddit users.
- Content is fetched when a customer requests it. We do not build profiles of Reddit users, and we do not keep an archive of API responses as a product. Responses may be held briefly in transit or in short-lived caches to deliver them reliably.
- We read only what is publicly accessible. We do not access private communities, private messages or anything behind a login that belongs to someone else.
- Our Terms forbid customers from using the data to harass, surveil, re-identify or profile individuals.
- Customers who receive this content decide how it is used in their own systems and are responsible for handling it lawfully.
If you are a Reddit user and want your public content to stop being served through Apixstar, write to support@apixstar.com with your username or the link to the content. We will respond within 30 days. Removing or hiding content on Reddit itself is the most effective step, because the API reads what is publicly visible there. We cannot remove content from Reddit or from copies already held by a customer.
8. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct data that is wrong;
- delete your data;
- restrict or object to our processing;
- receive your data in a portable format;
- withdraw consent where we rely on it;
- complain to your local data protection authority.
These rights are provided by laws such as the EU and UK General Data Protection Regulation and the California Consumer Privacy Act. We will not treat you differently for using them. To make a request, write to support@apixstar.com from your account email. We respond within 30 days and may need to verify your identity first.
9. International transfers
We and our providers operate in several countries, so your data may be processed outside the country where you live. Cloudflare stores and serves data from its global network, Google processes sign-in data in the United States and other countries, and Waffo Pancake is operated from Hong Kong. Where the law requires it, we rely on recognized safeguards for those transfers, such as standard contractual clauses.
10. Security
Connections to the Service are encrypted in transit. API keys and session tokens are stored as hashes, not in readable form. Access to production systems is limited to people who need it. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authorities without undue delay and, where the law sets a deadline, within 72 hours of becoming aware of it.
To report a vulnerability, write to support@apixstar.com.
11. Children
The Service is for developers and businesses. It is not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, tell us and we will delete it.
12. Changes to this policy
We may update this policy. We will post the new version here with a new effective date. If a change is material, we will also notify account holders by email at least 14 days before it applies.
13. Contact
For privacy questions and requests, write to support@apixstar.com. We respond within 30 days.
Apixstar is operated by comiaos, LLC, 1207 Delaware Ave #1163, Wilmington, DE 19806, United States.