Privacy Policy
Effective: April 2026
What We Collect
When you use upc.dev, we collect minimal data necessary to operate the service:
- API Usage: For authenticated API users, we log request counts, endpoints accessed, and timestamps for rate limiting and billing. We do not log the content of API responses.
- Server Logs: Standard HTTP access logs (IP address, user agent, requested URL, response status) retained for 30 days for security and debugging.
- Account Data: If you register for an API key, we store your email address and API key hash. Passwords are never stored in plaintext.
What We Don't Collect
- No tracking pixels or third-party analytics on product pages
- No cookies for advertising or cross-site tracking
- No personal data sold to third parties
- No fingerprinting or device identification
Product Data
Product data displayed on upc.dev is aggregated from public sources (government databases, open data projects, public APIs). This is factual product information, not personal data. We do not collect or display information about individual consumers.
Sub-Processors (GDPR Art 28)
We use the following sub-processors to operate the service. Each processes limited data as described and has a Data Processing Agreement (DPA) in place:
| Sub-Processor | Purpose | DPA |
|---|---|---|
| Cloudflare | CDN, WAF, DDoS protection, security cookies | DPA |
| Stripe | Payment processing for API subscriptions | DPA |
| Sentry | Error tracking and performance monitoring | DPA |
| UptimeRobot | Uptime monitoring (external health checks only) | Terms |
To request the current sub-processor list or be notified of changes, contact legal@upc.dev.
Data Retention
- Server logs: 30 days
- API usage metrics: retained for the duration of your account
- Account data: retained until you request deletion
Your Rights (Data Subject Access Requests)
Under GDPR, you have the right to access, rectify, erase, restrict processing, and port your personal data. To exercise any of these rights, submit a Data Subject Access Request (DSAR) to POST /v1/dsar with your email address, or email legal@upc.dev.
Data scope: API keys, usage logs, email from account registration or contact forms. We respond within 30 days (extendable to 60 days for complex requests, per GDPR Art 12).
Last updated: April 2026