Privacy Policy

Effective: 2026-06-21   Updated: 2026-10-01   Operator: X80 Pte. Ltd. (Singapore) — "we", "us"   Service: the MyAPI platform at myapihq.com and its APIs (auth, email, domains, funnels, billing, and related primitives) — "the Service"

1. Who this policy is for

MyAPI is an API platform used by developers and agents ("customers") to build applications. This policy covers two groups of people:

• Customers — those who hold a MyAPI account and API key.
• End users — people who interact with a customer's application, including signing in through the MyAPI authentication API.

2. What we collect

From customers: account email, organization details, API-key identifiers (never the secret in plaintext after creation), billing records, and the configuration you create (domains, mailboxes, funnels, workflows).

From API traffic: request and response metadata — timestamp, source IP, API-key identifier, endpoint, payload size, latency, and status code — plus the content you send to an endpoint for the duration needed to fulfil it.

Content you store with us: whatever you put in the primitives you use — database tables and key-value data, CRM contacts, files, websites, mailboxes and the mail they receive, and a record of each email you send (sender, recipients, subject, status). This is your data; we hold it to provide the Service.

From visitors to customer websites: when a customer's site uses the MyAPI pixel, we record each page visit — page address, referring page, IP address, country, a visitor identifier and, where the site sends them, form fields such as an email address.

From end users signing in (authentication API): when a customer's application uses MyAPI to authenticate an end user via a third-party identity provider (for example, Google), we receive from that provider the end user's basic profile: their unique account identifier, email address, email-verified status, display name, and profile picture URL. We collect only what the customer's application needs to establish the end user's identity.

3. Google user data

When an end user signs in with Google through the MyAPI authentication API, MyAPI requests only the openid, email, and profile scopes. We use this data solely to:

• verify the end user's identity and create or match their account within the customer's application, and
• return the end user's identity to the customer application that initiated the sign-in.

MyAPI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not transfer it to others except to deliver the sign-in to the customer application that requested it or as required by law, and we do not use it to train any models.

4. What we do with it

• Provide the Service. We process requests, deliver email, manage domains, publish websites, run your code, and authenticate end users on behalf of customers.
• Operational logs. Status, latency, errors and usage counts, kept to operate, secure, and debug the Service. Logs do not contain email subjects or bodies, and email addresses in them are masked to their domain (for example ***@example.ch).
• Billing. Usage by API-key identifier is retained to produce invoices and reconcile balances.

We do not train models on your data, sell personal data, or use request content for marketing.

5. Retention

• Content you store (tables, CRM, files, websites, mailboxes): until you delete it. Deleting an organization deletes its records in our database immediately.
• Sent-email records and website visit records (including visitors' IP addresses): kept for the life of your account. They are not tied to a single organization, so deleting an organization does not remove them.
• Your account: when you close it, it is deactivated at once and its data is no longer reachable through the Service. To have everything erased, write to simon@myapihq.com; we erase the account and all its data within 30 days.
• End-user identity records: while the customer's application keeps the end user active; deleted on the customer's instruction.
• Operational logs: 30 days.
• Database backups: 7 days, then overwritten.
• Billing records: as long as accounting law requires.

6. Subprocessors

These companies process personal data on our behalf. Some are used only when you turn on the feature named.

Some of our own pages (the sign-in consent screen and the API reference) load fonts from Google Fonts and a script from jsDelivr, so your browser contacts them directly when you open those pages.

End-user sign-in additionally involves the identity provider the end user chooses (for example, Google), governed by that provider's own privacy policy.

7. Where your data is kept

Each organisation has a residency, chosen when it is created and fixed after that: us (the default) or ch. The content of an organisation with residency ch — its database records, files, containers, mailboxes and their messages, end users, keys and logs — is stored and processed in Switzerland (Zurich), with the exceptions listed here.

• Kept in the United States for every organisation: your account (name, email, sign-in), API keys, billing and payment records, the list of your organisations with their names, usage records (which service was used, when, and its cost — never the content), the names that must be unique across the platform (domain names), and operational counts.
• Passes through the United States without being stored: requests made through our MCP connector for an organisation in Switzerland, which are forwarded to Zurich; a request sent to the wrong regional address, which is refused with the correct address; and the one-time code of a Google sign-in, on its way to Zurich.
• Global by nature: encrypted connections are opened at the nearest Google network edge before the request travels to Zurich; Cloudflare (DNS and the edge), Stripe, and the domain registries work as described in section 6.
• AI: AI requests of an organisation in Switzerland are processed in Google data centres in the EU; models that are not available there are refused, not sent elsewhere.

8. Transfers abroad

We are a company in Singapore, and the Service stores and processes data in the United States, Sweden and — for organisations with residency ch — Switzerland and the EU, and on Cloudflare's global network, as listed above. Where personal data of people in Switzerland or the EU/EEA goes to a country without an adequacy decision, the transfer relies on the recipient's certification under the Swiss–U.S. and EU–U.S. Data Privacy Framework (Google, Amazon Web Services, Cloudflare, Stripe, Microsoft, GitHub) or on the Standard Contractual Clauses in its data processing terms (Instantly). Sweden and the Netherlands are in the EU.

9. Your rights

If you are an end user of a customer's application, the customer is the controller of your data; please direct access or deletion requests to them, and we will assist them as processor. For direct customer requests, write to simon@myapihq.com with the account or API-key identifier and the right you wish to exercise. We respond within 30 days.

10. Security

• All traffic to the Service is TLS-encrypted.
• API-key secrets and end-user credentials are stored hashed at rest; secrets are shown only at creation time.
• We follow least-privilege practices for operator access to production systems.

11. Changes

We will notify customers of material changes to this policy at least 30 days before they take effect, by email to the account contact on file.

12. Contact

Operator: X80 Pte. Ltd. (Singapore)   Email: simon@myapihq.com