Privacy Policy

This policy explains how cheapxapi handles personal information about visitors to cheapxapi.com and about customers who use the console and the API. “We” means the operator of cheapxapi.

Public X content that customers retrieve through the API is a different matter, covered in Public X data below.

Account details. Your email address and, if you sign in through a third-party provider, the basic profile it shares with us, such as your name, profile picture and account identifier. We also store what we create for you: API keys, your credit balance and your settings.

Payments. Card and crypto payments are handled by our payment processors. We receive a confirmation with the amount, currency, status and the processor’s reference, and for cards a limited description such as the brand and last four digits. Full card numbers and security codes never reach us.

API requests. For every call we log the endpoint, the time, the account and key used, the request parameters, the response status, the credits charged and the originating IP address. This is what lets us bill accurately, answer support questions, enforce rate limits and stop abuse.

Website visits. Our network provider processes your IP address, browser type and the pages you request in order to deliver the site and protect it from attacks.

Messages. If you contact us, we keep your message, your email address and our reply.

• Your X password or login session. cheapxapi is read-only and never acts on an X account, so it has no use for them.
• Advertising or analytics cookies on this website.
• Personal information bought from data brokers.

• To create your account, issue API keys and answer your API requests.
• To count usage, deduct credits, take payments and issue refunds.
• To keep the service secure: rate limiting, fraud and abuse detection, incident investigation.
• To answer support emails and warn you when something goes wrong with a payment or your account.
• To let you know about changes to pricing, these policies or the service.
• To keep the tax and accounting records the law asks for, and to act on breaches of our terms.

Where the EU or UK GDPR applies, we rely on the following legal bases: performing our contract with you, our legitimate interest in running a secure and reliable service, compliance with legal obligations and, where required, your consent.

We do not sell personal information and we do not share it with advertising networks. The following categories of service providers process it on our behalf, each only to the extent its job requires:

Outside that list, information is disclosed only if a court, regulator or police authority legally compels it, if it is needed to stop fraud or abuse aimed at customers or at cheapxapi, or if the business changes hands, in which case the new owner must protect it at least as well as this policy does.

The public website sets no tracking cookies. Our network provider may set a strictly necessary cookie to tell people from bots. When you sign in to the console, a cookie keeps you signed in; without it, the console cannot work.

• Account details: for as long as your account is open, and deleted when you ask us to close it.
• Detailed request logs: for a limited period needed for billing questions, support and abuse investigations, then deleted.
• Payment and refund records: as long as tax and accounting rules require, including after an account is closed.
• Support conversations: until the issue is closed, plus a reasonable period in case it comes up again.

Responses from the API contain content anyone can already see on X, such as public posts and profiles, and some of it is personal information about the people who posted it. Which accounts and posts are fetched, and what happens to them afterwards, is the customer’s decision and the customer’s responsibility under our Terms of Service. People on X who want to raise a question about their own public data can reach us at [email protected].

You can ask us to show you the personal information we hold about you, correct it, export it, delete it, or stop or restrict a particular use of it. Send the request to [email protected] from your account email so we can verify it is really you. Payment records with a legal retention period survive deletion.

Residents of the EU, the UK and California, among other places, have additional statutory rights. Exercising any of them will never change the price or quality of service you get, and you can always lodge a complaint with your data protection regulator.

All traffic to the website and the API is encrypted with HTTPS, access to production systems is restricted, and we monitor for abuse. No system is completely secure; if a breach affects your personal information, you and the competent regulator will be told within the time limits the law sets. Treat API keys as secrets and rotate any key you suspect is exposed.

We and our providers process information in more than one country, which may not be the country you live in. Where the law requires it, we use appropriate safeguards such as standard contractual clauses for these transfers.

cheapxapi is a developer tool, not a service for children, and accounts are not meant for anyone younger than 16. If we find out that one belongs to a child, it will be closed and its data erased.

This page is revised as cheapxapi evolves; the “last updated” line shows the current version. Account holders are emailed about any significant revision.