Privacy policy

Last updated 2026-10-13.

1. Scope and contact

   This policy describes the personal information processed by Aurevant LLC, a Wyoming (USA) limited liability company, through the DataXAPI website, the Console, the API and its other ways in (MCP, SDKs, the command-line tool), support and complaints. Write to privacy@dataxapi.com; you need not have an account or have paid anything. The original platforms, and other applications you connect, have their own rules.

   We are responsible for the processing whose purposes and means we decide. Callers who use results in their own business have duties of their own for what they collect, store, share and do with them. Who holds which legal role depends on the activity; calling the service a technical intermediary does not remove responsibility.

2. What we collect and why

   • Account and sign-in. Your email address; if you sign in with Google, the basic profile Google sends us (such as your email address, name and account identifier); the name and language you set; your sessions; and what you tell us at sign-up, such as what you use the service for and where you heard of it. There is no password and we do not ask for a phone number.
   • API keys. A key’s name, its first characters, a digest of the key, its limits, the endpoints it may call, its expiry, its state and when it was last used. The full key is shown once, when it is created; we cannot show it again.
   • Calls. For each call: the endpoint, the time, how long it took, the outcome, what it cost, its request ID and the key that made it. The parameters you sent are kept for 30 days. The data returned is kept for 24 hours.
   • Money. Your balance, your top-ups, a ledger of every amount added and spent, and the payment references the payment provider gives us. Card details go directly to the payment provider; we do not receive or store full card numbers or security codes.
   • Visits to the site. A random visitor ID kept in your browser; the path of the page you first landed on and its source parameters (such as utm_source); the host and path of the page you came from; your browser’s language; and the first time you do a few things, such as viewing a kind of page, copying code, starting to sign up or starting a top-up. We do not record your IP address or a browser identifier with these events.
   • Requests and complaints. What you write to us, the email address to answer at and, for a complaint, the platform and the link or ID of the content.
   • Security. Signals from the human check at sign-up and on public forms, and the network information that hosting and rate limiting need, to hold off automated abuse and unauthorized access.

   Do not submit unrelated sensitive information, platform passwords, cookies, private sessions or other people’s secret credentials. Public content may contain personal information and remains protected. If private or sensitive information is returned unexpectedly, stop distributing it and write to rights@dataxapi.com.

3. Who receives data

   We pass on only what a defined purpose needs. We do not sell personal information to data brokers or trade advertising audiences, and we do not use account, request or complaint content to train models. This does not grant anyone training rights in the underlying public content.

   These services are used, or are switched on by configuration. A service may act for us for one activity and on its own account for another; a name here does not fix a single legal role or a single country of processing.

   • Supabase. Account email, sign-in and the database of the service.
   • Vercel. Requests to the site and the API, and what hosting, delivery and operational security need.
   • Cloudflare. DNS; the signals of the human check on sign-up and public forms; forwarding of the mail sent to our addresses.
   • Google. Sign-in with Google, if you choose it; and the mailbox in which support, privacy and rights mail is read.
   • Resend. The recipient address, content and delivery state of service email, such as sign-in codes and balance reminders.
   • Stripe. What you enter at checkout, and payment and dispute data, to process payments and meet its own security and compliance duties.
   • Sentry and PostHog, when configured. Sentry receives where an error happened, its kind and the request ID, to find faults. PostHog receives counts of visits to pages of the site. Neither is sent your queries or the data returned.
   • Data suppliers. A call sends the parameters and public identifiers it needs to the supplier used by that endpoint. It never sends your DataXAPI key, your payment details or anything from a complaint.

   For a legal demand, for security or in a dispute, we verify the request and its scope, disclose what is necessary and tell the people concerned where we are permitted to. A transfer of the business that involves personal information requires notice of who receives it and of your rights.

4. How long we keep it

   • Results of calls. 24 hours, to be read again by request ID or on a retry; then deleted. A block for a rights or safety reason can end availability sooner.
   • Parameters of calls. 30 days, to show a call in the Console; then cleared.
   • Records of calls. The endpoint, time, outcome, cost and counts of a call are kept as accounting records, without its parameters or the data returned.
   • Account and keys. While the account is open. Disabling a key ends what it authorizes at once.
   • Money. The ledger, top-ups and payment and dispute references are kept for as long as accounting and legal duties require, including after an account is closed.
   • Free credit. That an email address has received free credit stays on record after the account is closed, so that it is not given twice.
   • Requests and complaints. While we handle them; afterwards only what a later review, a dispute or the law requires.

   Records kept after an account is closed have restricted access and no unrelated use, and are deleted or made anonymous when their purpose ends. The 24 hours concern results served by the service, not the simultaneous erasure of every backup copy; a backup is used for recovery only, and data restored from one is not served again past its period. You may ask which categories we hold about you, why and for how long, and object to retention that is not needed.

5. Browser storage, counts and email

   Signing in keeps a session in your browser’s storage, so that you stay signed in; signing out or clearing the site’s data removes it. The site also keeps the random visitor ID described above and small preferences, such as the language of code examples. The payment provider’s checkout pages and the human check apply their own storage rules. On a shared device, sign out when you are done.

   The site carries no advertising tracking. The counts of visits described above are our own and are used to learn which pages bring people to the service. If we ever add tracking that needs your consent, we ask first.

   Sign-in codes, security notices and the replies you ask for are part of the service. A balance reminder can be turned off in Settings or with the link in the email. Signing up does not subscribe you to marketing. For a privacy request, write to the address above; do not reply to the sender of a sign-in code.

6. Where data is processed

   The database and the API run in the United States. The services listed above, and the data suppliers, may process data in other countries. We do not promise that data stays in any one country. Where a law requires a specific notice, a separate consent or a transfer procedure, that comes before the processing it concerns; this policy is not itself a separate consent.

7. Your rights

   Depending on the law that applies to you, you may ask what we hold, for access, a copy, correction, deletion or restriction, object to processing, withdraw a consent you gave, and complain to an authority. Withdrawing consent does not undo what was done before, and does not cancel other lawful grounds.

   We verify a request in proportion to what it asks; identity documents are not required by default. If we cannot act, we say why and how to ask for a review, and we answer within the periods the law sets. Refusing unnecessary processing, or using a right, brings no unreasonable difference in how you are treated.

   For your own account, use Settings in the Console as described in the next section. If your concern is a piece of content the service returns, use the complaint form on this page; it needs no account.

8. A copy of your data, and deleting your account

   Both are requests you make from Settings in the Console. A request is recorded and staff handle it; nothing happens by itself, and there is no instant deletion or download. We answer at your sign-in email address. If you cannot sign in, write to privacy@dataxapi.com.

   A copy of your data

   Staff send a file to your sign-in email address. It holds the account, its sign-in addresses, your keys by name and first characters (never the keys themselves), your balance, top-ups, the ledger, the records of your calls and the requests you have made to us. It does not hold the data that calls returned, which is kept for 24 hours only.

   Deleting your account

   Asking does not delete anything at once: your keys keep working until staff close the account. From the request until it is handled, the account cannot be topped up. If you change your mind, write to support before the account is closed.

   When staff close the account, its keys stop working, the sign-in is removed, and this cannot be undone. Any balance left is not paid back, as the Terms say. An account with an open payment dispute is closed only after the dispute is settled. The money records described above are kept. Signing up again with the same email address opens a new, empty account without a second free credit.

9. Security and changes

   We use protection in transit, digests in place of stored keys, access controls, logs without request content and a record of what staff do. No system is perfectly secure. After a security incident we take remedial action and give the notices the law requires. If a minor may have given us information without meeting the conditions of the service, write to privacy@dataxapi.com so that we can look into it.

   A material change to what we collect, why, or who receives it is announced. Where a new consent is required, it comes before the processing. This page shows the date of its last change, and changes are listed in the changelog. Replacing the page does not erase a completed transaction or a request you have already made.

10. Complaints about content and data rights

    If content that DataXAPI returns affects your privacy, your copyright, your safety or another right of yours, use the form below. You need no account and need not be a customer. You can also write to rights@dataxapi.com.

    What to give

    • A contact email address at which we can answer.
    • The ground: copyright, privacy, safety or other.
    • The platform the content is on.
    • The link to the content, or its ID on the platform. One of the two is enough.
    • A message of up to 2,000 characters: how you are related to the content, what is wrong, and what you want done.

    Identity documents are not required by default. Do not send card numbers, passwords, API keys or unrelated sensitive material. A representative gives only what is needed to show authority. The form has a human check and takes at most three complaints an hour from one contact address.

    What happens next

    You are given a reference such as DX-7K2M9QXA4T. Keep it. We answer by email at the contact address; quote the reference when you follow up. The site does not show the state of a complaint, to you or to anyone else.

    We check the content, the ground and the scope, and may ask you for more. We may stop returning that content or that creator, pause an endpoint, or explain why we do not act. A credible urgent risk may be met with a temporary block before we have finished checking. A complaint by itself does not prove that content is unlawful or that anyone is at fault. You can ask for a review with new facts, by the same reference.

    Your contact details and evidence are not passed to API callers. A block applies to what this service delivers from then on, stored results and retries included. It does not remove the content from the original platform or from copies others already hold; for that, use the platform’s own channel. Callers who use the service are bound by the Acceptable use policy. None of this replaces your right to turn to a regulator or a court.

    File a complaint

    Your email, for our answerWhat it is aboutCopyrightPrivacySafetySomething elsePlatformTikTokYouTubeInstagramX (Twitter)DouyinXiaohongshu (RedNote)RedditFacebookWeChat Official AccountsWeChat ChannelsWeChat SearchBilibiliWeiboLinkedInThreadsKuaishouZhihuTelegramPinterestMeta Ad LibraryGoogle AdsAnother platformOr its ID on the platformLink to the contentWhat is wrong, and what you want done