Privacy Policy

1. Who we are

DescriptorAPI is a product of ApisOS. ApisOS is responsible for the personal data described here. For anything about your data, email [email protected].

This policy covers the website, the dashboard and the API. When you send us descriptors about your own customers' transactions, you decide what to send, and we process that data on your behalf to give you Results.

2. What we collect

Your account. Your email address, a securely hashed password (we never store the password itself), the company or project name if you give one, the country your sign-up came from (worked out from your network connection, not your exact location), your plan, and when you last signed in.

API requests. The descriptor text you send and the Result we return. The amount is checked but not stored. The currency is used to work out where the transaction happened, and is kept with our reading of a descriptor. We record usage counts per API key to apply quotas and rate limits and to bill you.

Website visits. Like every web server, ours receives your IP address, browser type and the page requested. We use this to deliver pages, keep the Service secure and fix problems. The playground uses your IP address to apply its daily limit of free tries; that count is kept in memory only.

Statements you analyze. If you use the statement analyzer, the transactions read from the statements you upload, as described in section 5.

Messages to us. What you send us by email or with the contact form (your name, email address, topic and message) and our replies. The contact form uses your IP address, or your account when you are signed in, to limit how many messages can be sent; that count is kept in memory only.

We do not need, and ask you not to send, card numbers, cardholder names, bank account numbers or any other personal data in descriptors.

3. How we use it

• To provide the Service: create your account, sign you in, issue API keys, return Results, show your usage and recent requests in the dashboard.
• To improve recognition: merchants we recognise are cached so the next request is faster, and descriptors we could not recognise are reviewed, without your account details, so we can recognise them in future.
• To keep the Service secure: detect abuse, enforce rate limits and investigate incidents.
• To contact you: email confirmation, password resets, security notices and important changes to the Service or your plan. We do not send marketing email without your consent.
• To bill you for paid plans, and to meet our legal and tax obligations.
• To understand how the website is used, only if you allow analytics (see section 7).

Where the GDPR or similar laws apply, we rely on: performing our contract with you (providing the Service), our legitimate interests (security, improving recognition, understanding our product), your consent (analytics cookies), and legal obligations (tax and accounting records).

4. AI processing

When a descriptor is not in our merchant database, we may ask an AI model to identify the merchant. The AI provider receives only the cleaned merchant text, not your account details or API key, under terms that do not allow the provider to train on it. Neither we nor the provider use your data to train AI models. Person-to-person transfers are never cached or kept.

5. Statement analyzer

Signed-in users can upload a bank or card statement as a PDF to see their spending broken down by merchant and category. Statements contain personal financial information, so we handle them as follows.

• The PDF is never stored. It is read in memory while your upload is processed and then discarded. If it has a password, the password is only used to open it and is never stored.
• What we keep: what was read from the statement: the bank, the statement period and printed totals, and each transaction's date, description, reference, amount, currency and, where printed, the masked card number. With them we keep the merchants identified. This is encrypted in our database and visible only to your account. You can delete an analysis at any time, and it is deleted when you close your account.
• Identifying merchants: each transaction description goes through the same recognition as the API (section 4), so a description we do not recognise may be sent to an AI model. Each merchant found counts toward your monthly API allowance.
• Banks we cannot read yet, only with your consent. If you tick the box when uploading, we make a copy of the statement's text with your name, card numbers, account numbers, IBANs, reference numbers and email addresses removed. Amounts, dates and the bank's own wording remain. An AI model receives that copy to work out how the bank lays out its statements, and our team may review it to check the result. The copy is encrypted and deleted after 30 days at most; you can ask us to delete it sooner. We remove the holder's name where the statement labels it and any name you give us, but other personal details printed on the statement, such as a postal address, may remain in the copy.
• Banks we cannot read: without your consent, nothing from the statement is kept. We only count, by bank name, how many statements we could not read, to decide which banks to support next.
• Learning from it: what we learn is how a bank lays out its statements, never anything about you. Your statements are not used to train AI models.

We process statements to provide the analyzer you asked for (our contract with you), and the de-identified copy only with your consent, which you give for each upload. Only upload statements you are entitled to share, such as your own.

6. Cookies and local storage

We use a small number of essential cookies. They are needed for the site to work, so they do not need your consent:

The site also saves your preferred code language in the docs and your recent playground descriptors in your browser's local storage. That data stays on your device and is never sent to us.

Analytics cookies are only set if you choose "Accept all" in the cookie banner. You can change your choice at any time with Cookie settings, also linked at the bottom of every page.

7. Analytics

We may use third-party analytics services to understand how visitors use the website, for example which docs pages are most read and where visitors come from, so we can improve it. Analytics is limited as follows:

• No cookies without consent. Analytics cookies are set only after you choose "Accept all". With "Essential only", or until you choose, the analytics script stores nothing on your device and sends only anonymous, cookieless measurements (such as a page view) that cannot be linked to you or to your other visits.
• Public website only. It covers public pages such as the home page, docs, pricing, playground and merchant pages. It never runs in the dashboard, and never on API requests.
• What is collected: pages viewed, the referring site, browser and device type, screen size, approximate location (country or city, derived from your IP address) and interactions such as clicks on buttons and links.
• What is never collected: your email address, password, API keys, the descriptors you enter in the playground or send to the API, or any Results.
• How it is used: only to measure and improve the website. Not for advertising, not to build profiles of individuals, and never sold. Where the provider supports it, IP addresses are shortened before storage.
• How long: analytics data is kept for no longer than 14 months.

8. Who we share it with

We do not sell personal data. We share it only with service providers who help us run the Service, under contracts that limit them to processing it for us:

• hosting and database infrastructure;
• content delivery and network security, which also tells us the country a request comes from;
• email delivery, for account and service emails;
• payment processing for paid plans. Card details go directly to the payment provider; we never see or store full card numbers;
• AI processing, as described in section 4 and, for the statement analyzer, section 5;
• analytics, only with your consent, as described in section 7.

We may also disclose data when the law requires it, to protect our rights or users, or as part of a merger or sale of the Service, in which case this policy continues to apply to it.

9. How long we keep it

• Account data: while your account is open. When you ask us to close it, we delete it within 30 days, except records we must keep by law, such as invoices.
• Recent requests: the last 100 requests per account, so you can debug them in the dashboard. Older ones are deleted automatically.
• Detailed usage records: 90 days. Daily totals are kept for billing and your usage history.
• Descriptors we could not recognise or have not confirmed yet: up to 30 days, without your account details, and deleted once confirmed.
• Statement analyses: until you delete them or close your account. The statement PDF itself is never kept.
• De-identified statement copies, only if you agreed: up to 30 days.
• Recognised merchants: the merchant database and its cache hold merchant information, not information about you or your customers.
• Server logs: a short period for security and troubleshooting, after which they are overwritten.

10. Security

All traffic is encrypted with HTTPS. Passwords are hashed with a modern, slow algorithm, API keys are stored only as hashes, statement analyses and copies are encrypted, and admin access requires two-factor authentication. No system is perfectly secure, but we will tell you without undue delay if a breach affects your data.

11. International transfers

Our providers may process data in countries other than yours. Where the law requires it, we use safeguards such as standard contractual clauses to protect data transferred abroad.

12. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a copy in a portable format, object to or restrict how we use it, and withdraw consent at any time (for analytics, use Cookie settings). Email [email protected] from the address on your account and we will reply within 30 days. You can also complain to your local data protection authority.

13. Children

The Service is for businesses and developers. It is not meant for children and we do not knowingly collect data from anyone under 16.

14. Changes to this policy

We will update this policy when our practices change. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell account holders by email before it takes effect.