Privacy Policy

1. Information We Collect

We collect the following information when you use csv-api:

• Account information: email address and a securely hashed password when you register. We require email confirmation before you can access the Service.
• CSV data: the files you upload and the data contained within them, stored in dedicated database tables.
• API usage logs: for each API request we record the dataset accessed, your IP address, the timestamp, and the HTTP response status code. These logs are retained for 90 days and then automatically deleted.
• Account activity: we log key account events (sign-ins, API key creation/revocation, dataset creation/deletion, plan changes) along with your IP address and browser user agent for security and auditing purposes.
• Contact form submissions: if you contact us through the website, we collect your name, email address, subject, and message. These are sent to our support email and are not stored in the database.
• Natural-language prompts: if you use the optional natural-language query feature ("prompt" parameter), the text of your prompt and your dataset's column names and types are sent to OpenAI for translation into a structured query. See Section 6 for details.

2. How We Use Information

We use your information to:

• Provide and maintain the Service, including storing your data and serving it through the API
• Authenticate your identity and authorize API requests using securely hashed API keys
• Enforce plan limits and per-user rate limiting
• Process payments and manage your subscription through Stripe
• Send account notifications such as email confirmation, password reset, and account unlock emails
• Respond to support requests submitted through the contact form

3. Data Storage & Security

Your uploaded CSV data is stored in PostgreSQL. Each dataset gets its own isolated database table. All dynamic queries use parameterized SQL to prevent injection attacks. Database connections are encrypted via TLS in production.

Passwords are hashed using bcrypt. All traffic is encrypted in transit via HTTPS. Accounts are protected against brute-force attacks with automatic lockout after repeated failed login attempts.

About API keys: csv-api keys are designed as public, revocable identifiers — similar to a Stripe publishable key or an Algolia search-only API key. They are intended to be embedded in client-side JavaScript on your own websites so visitors can read your dataset. Because keys are public by design, the API namespace is strictly read-only and protected by per-key rate limiting. Rotating a key acts as the kill switch to disable an embedded integration without deleting the underlying dataset. Treat your keys accordingly: do not use them to gate sensitive data, and rotate them whenever you want to revoke a published integration.

We implement reasonable security measures to protect your data, but no method of electronic storage or transmission is 100% secure.

4. Data Retention & Deletion

We retain your data for as long as your account is active. Specific retention policies:

• API request logs: automatically deleted after 90 days by a recurring background job.
• Datasets: when you delete a dataset, the underlying database table and all its data are permanently and immediately dropped.
• Account data: if your account is terminated, all associated datasets, API keys, account events, and API request logs are permanently deleted.

5. Cookies

csv-api uses session cookies to keep you logged in. These are essential cookies required for the Service to function. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

6. Third-Party Services

We use the following third-party services to operate csv-api:

• Stripe — payment processing and subscription management. When you subscribe to a paid plan, Stripe processes your payment information directly. We store only your Stripe customer ID and subscription status, never your payment card details. See Stripe's Privacy Policy.
• Resend — transactional email delivery for account confirmation, password resets, and support notifications. See Resend's Privacy Policy.
• Railway — cloud infrastructure hosting. See Railway's Privacy Policy.
• OpenAI — used only when you (or a visitor to one of your shared pages) submit a natural-language query via the optional prompt parameter. To translate your prompt into a structured query we send the following to OpenAI's API: (a) the literal text of your prompt, and (b) the column names and data types of the dataset being queried. Your row data is never sent to OpenAI — only schema metadata and the prompt itself. This data sharing is intrinsic to the natural-language query feature; if you do not use the prompt parameter, no data is sent to OpenAI. Translated queries are cached for one hour to minimize duplicate calls. Per OpenAI's API data usage policy, prompts submitted via the API are not used to train OpenAI's models. See OpenAI's Privacy Policy and API data usage. If your dataset's column names or its prompts may contain information you do not wish to share with a third party, do not use the prompt feature.

7. Your Rights

You have the right to:

• Access: view all data associated with your account through the dashboard and API
• Export: retrieve your data at any time through the API
• Delete: remove individual datasets and all their underlying data at any time
• Correct: update your email address and password through the account settings page

8. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect information from children under 13. If you believe we have collected such information, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by posting the updated policy on this page with a revised "last updated" date.

10. Contact

If you have questions about this Privacy Policy or how we handle your data, please contact us at [email protected].