Privacy Policy

The data controller is LiveAPI. For any question about this policy or your data, write to info@liveapi.io.

• Account data. The email address you sign in with. There is no password; we send a one-time login code that expires after 10 minutes and is discarded once it is used or expires.
• Profile. The first and last name you choose to add in Settings. Both are optional. If you change your email address, we send a code to the new address to confirm it before switching.
• Newsletter consent. Whether you opted in to the product newsletter and when. It is off unless you turn it on, and you can turn it off at any time in Settings.
• API keys. The names and values of the keys you create, and the call allowance, wallet balance and plan on your account.
• Request log. For each API call: the time, method, endpoint route, response status and whether the call was counted. The route is the endpoint pattern, such as /v1/ip/:ip or /v1/timezone, not the address you called, so IP addresses, coordinates, query strings and other values you send are not kept in the log. We do not store request bodies or the Authorization header.
• Billing data. Your plan and purchase status, received from our payment provider. We never see or store card numbers.
• Support messages. The name, email address and message you send through the support form.
• Technical data. Your IP address is processed when you visit the site or call the API, for example to answer a location request, to apply the homepage lookup limit, and to protect the service against abuse.

The API is built to check and enrich data that you, our customer, send in requests. That data can include personal data of your own users or contacts, such as email addresses, IBANs, Turkish identity (TC kimlik) and tax numbers, phone numbers, VAT numbers, coordinates and IP addresses.

• Request bodies (for example to /v1/email/validate, /v1/iban/validate, /v1/validate/{country}/{type}, /v1/tr/identity/validate, /v1/phones/validate or /v1/vat/validate) are processed only to produce the response and are not stored or logged.
• Values in the URL, such as an IP address in /v1/ip/{ip} or coordinates and dates in a query string, are processed only to produce the response. The request log keeps only the endpoint route, method, status and time, as described in section 2, not the values themselves.
• Some checks call a third party with the minimum needed: a VAT number is sent to the European Commission's VIES service, and an email check sends only the domain part of the address to a DNS resolver. See section 6.

For this data, you are the controller and LiveAPI acts as your processor: we process it only on your instructions, which are the API requests you make, and only to provide the service. You are responsible for having a lawful basis to process it and to send it to us, for informing the people concerned, and for not sending data the endpoint does not need. To agree a data processing agreement, write to info@liveapi.io.

GET /v1/ip describes the device that makes the request, using the location data our hosting provider attaches to that request. A lookup for another IP address returns an approximate country, region, city, coordinates and network operator (ASN), taken from the DB-IP Lite databases. The coordinates point to a city, not to a device; the result never returns a street address or identifies a person.

We share data only with providers that help us run the service, and only as much as they need:

• Cloudflare hosts the website and the API and stores account data.
• Resend delivers login codes and forwards support messages by email.
• Lemon Squeezy processes payments as merchant of record and handles invoices, taxes and refunds under its own privacy policy.
• European Commission (VIES) receives the country code and VAT number of each VAT check, because the check is answered live by the EU's VAT Information Exchange System.
• Nager.Date receives only a country code and a year when you request holidays for a country other than Turkey. No personal data is sent.
• Cloudflare DNS over HTTPS (cloudflare-dns.com) receives the domain of an email address you check, for example example.com, to look up its mail records. The full address is not sent.
• Google Analytics receives page views and technical data about the visit only after you accept analytics cookies. See the cookie policy.

We also use data that we download and serve from our own systems. No data about you or your requests is sent to these sources:

• DB-IP Lite databases for IP location (CC BY 4.0).
• OpenStreetMap for Turkish district data. District data © OpenStreetMap contributors, available under the Open Database License (ODbL) 1.0.
• LiveAPI in-house postal-code and country-boundary datasets.

Some of these providers process data outside your country, including in the United States. Where that happens, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

• Login codes: up to 10 minutes.
• Sign-in sessions: 30 days, or until you sign out.
• Request log entries (endpoint route, method, status and time): 30 days, then deleted automatically.
• Request bodies sent to the API: not stored; discarded once the response is sent.
• Account data, profile, newsletter consent and API keys: while your account exists. When you close the account in Settings, they are deleted at once, together with your request log and sign-in sessions.
• After an account is closed we keep only a minimal order record (order id, date, product, amount and refund status), not linked to your email address, for as long as tax and accounting law requires. Lemon Squeezy keeps its own records as merchant of record.
• To prevent abuse of the free calls, we also keep a one-way keyed hash of the closed account's email address. It cannot be turned back into the address; it only lets us recognise a new sign-up with the same address, which then starts without free calls. We keep it for as long as the free calls are offered.
• Billing records: as long as tax and accounting law requires.
• Support emails: as long as needed to handle the request, and no longer than 2 years.

Depending on where you live, including under the EU and UK GDPR and Turkey's Law No. 6698 (KVKK), you can ask to access, correct, delete or export your data, object to or restrict its processing, and withdraw any consent you gave. Send the request to info@liveapi.io from the email address on the account. We reply within 30 days. You can also complain to your local data protection authority.

Traffic is encrypted with HTTPS, session cookies are HTTP-only, and API keys are shown in full only to the signed-in owner. No system is perfectly secure; if you believe a key has leaked, delete it on the account page and create a new one.

The service is meant for developers and businesses. It is not directed at children under 16, and we do not knowingly collect their data.

We may update this policy as the service changes. The date at the top shows the latest version. For significant changes, we will tell account holders by email before they take effect.