Privacy Policy

Correction, 18 October 2026. The international-transfers paragraph had said that the 2021 Standard Contractual Clauses are incorporated by reference in each subprocessor's Data Processing Addendum. Not every Addendum does: some apply the clauses only to a transfer that needs them. The paragraph now says so. The Effective date above is unchanged.

Correction, 8 October 2026. Sections 5 and 10 now name email delivery and the host of our own mailbox and of the site feedback form (Google Workspace) among our service providers, which they had left out. The Effective date above is unchanged.

Correction, 29 September 2026. We corrected this policy to describe what our systems actually do: how API keys are stored, what we receive from RapidAPI, which request logs our hosting provider keeps and for how long, how IP addresses are shortened, which request contents are stored, how long account data, watchlists and webhooks are kept, how backups work, what our own analytics keep, and which section to write to for requests. The effective date above is unchanged; only the wording changed, except that on the same date erasure was extended to keys deactivated before the request and now reports an erasure it could not finish, watchlists, webhooks and daily RapidAPI counts now expire (if setting an expiry ever fails, a cleanup we run at every deploy sets it, or deletes the record if it should already have expired), and two application log lines stopped recording which record was requested.

This ALETHEIA Privacy Policy is a product-level companion to the HQ Data Policy, which is the controller-level source of truth across the Holistic Quality ecosystem. Where this notice provides additional implementation detail, it is consistent with the HQ Data Policy on controller identity, subprocessors, retention, and rights. In the event of a conflict, the HQ Data Policy governs.

1. Overview and Scope

This Privacy Policy describes how Holistic Quality LLC ("Holistic Quality," "we," "us," "our") collects, uses, discloses, and retains personal data in connection with the ALETHEIA chemical safety reference API, related SDKs, documentation, and the websites aletheia.holisticquality.io and safety.holisticquality.io (collectively, the "Service").

ALETHEIA is a business-to-business API. It is designed for use by developers, researchers, and organizations, and it does not knowingly process data of individuals under 18. Because the Service is primarily a data-returning API with narrow personal-data surface, this Privacy Policy is intentionally scoped to the categories of personal data the Service actually processes.

This Privacy Policy is incorporated into the ALETHEIA Terms of Service (the "Terms") by reference. Capitalized terms not defined here have the meanings given in the Terms. In the event of a conflict between this Privacy Policy and the Terms, this Privacy Policy governs solely with respect to the processing of personal data. In the event of a conflict between this Privacy Policy and the Disclaimer, this Privacy Policy governs solely with respect to the processing of personal data, and the Disclaimer governs with respect to all other matters.

2. Personal Data We Collect

2.1 For users accessing the Service through RapidAPI

When you access the Service through the RapidAPI marketplace, RapidAPI is the primary collector of your account and billing information and processes that data under its own privacy policy. The information we receive from RapidAPI in connection with your use is limited to:

• your RapidAPI username, which RapidAPI sends with each request and which we use as the key for rate-limit and daily usage counters
• request metadata (endpoint called, timestamp, request-level parameters, rate-limit tier)
• response metadata (status code, latency, error details where applicable)

We do not receive your RapidAPI account email address, password, payment card details, or billing address.

2.2 For users with a direct-issued API key

For users issued an API key directly by Holistic Quality (if offered), we collect:

• the email address provided at the time of key issuance
• the organization name, if provided
• the API key itself, which the key store holds so that requests can be authenticated
• request and response metadata as described above

2.3 For visitors to our websites

When you visit aletheia.holisticquality.io or safety.holisticquality.io, our hosting provider (currently Vercel) processes technical information in server logs, including:

• IP address
• browser type, version, and User-Agent string
• referring URL
• pages visited, time and date of visit
• request and response metadata, including error details where applicable

This technical information is logged by our service providers primarily for infrastructure reliability, security, and abuse prevention under their respective privacy policies. For our own analytics we use aggregated counts, plus two per-client records kept 30 days: a daily list of unauthenticated API clients that made more than 100 requests that day, and a daily count of each client’s rate-limited requests. Each client is identified by a keyed hash of its IP address or, for requests made with an API key, of that key. We use them to see which clients use the API heavily and may need an API key or a paid plan.

A current list of subprocessors and core service providers that may process personal data on our behalf is maintained at /privacy/subprocessors. We also use cookies and similar technologies only as described in our Cookie Notice.

2.4 Data we do not collect

We do not collect, store, or process:

• payment card or bank account information (handled by RapidAPI or other payment processors)
• government-issued identifiers (SSN, national ID, passport, etc.)
• biometric or health data
• precise geolocation beyond IP-level inference
• data about individuals who are not our users

3. How We Use Personal Data

We process personal data only for the following purposes:

• Providing the Service: authenticating API calls, enforcing rate limits, and routing requests.
• Operational reliability: debugging errors, monitoring performance, and preventing abuse (such as credential stuffing, scraping, or denial-of-service attempts).
• Aggregate analytics: understanding usage patterns in aggregate to improve the Service. We do not use identifiable request-level data to profile individual users. Request parameters (such as chemical identifiers, CAS numbers, and material compositions) may constitute sensitive business information; we do not use query patterns for competitive intelligence purposes, and we do not share them with third parties except as required for Service operation or by law.
• Usage and plan analytics: to see which clients use the API heavily and may need an API key or a paid plan, using the per-client records described in Section 2.3.
• Communications: responding to support requests and sending service-related notices (outages, security advisories, material changes to the Terms or this Privacy Policy).
• Legal and compliance: complying with applicable law, responding to lawful requests from authorities, and enforcing our Terms.

We do not sell personal data. We do not use personal data for advertising or behavioral targeting. We do not share personal data with advertisers.

4. Legal Bases (for users in the EEA, UK, and similar jurisdictions)

Where applicable law requires a legal basis for processing personal data, we rely on:

• Contract performance — for data processing necessary to provide the Service to you.
• Legitimate interests — for operational reliability, fraud prevention, aggregate analytics, and usage and plan analytics (seeing which clients use the API heavily and may need an API key or a paid plan), where our interests are not overridden by your rights.
• Legal obligation — where processing is required by law.
• Consent — for any processing for which we specifically ask for and obtain your consent.

5. Sharing and Disclosure

We share personal data only with:

• Service providers who process personal data on our behalf under contracts that require them to use the data only to provide services to us: hosting (Vercel) and operational tooling (including email delivery, Google (Google Workspace), which hosts our own mailbox and the form behind the site feedback widget, and, for users with direct-issued accounts, payment processors). A current list is maintained at /privacy/subprocessors.
• RapidAPI, which is an independent data controller for its marketplace users' accounts and billing data and operates under its own terms and privacy policy rather than as a processor for Holistic Quality. We receive only the limited information described in Section 2.1 from RapidAPI.
• Successors in the event of a merger, acquisition, reorganization, or sale of assets, with notice to you where required.
• Authorities and third parties when required by law, subpoena, or court order, or where necessary to protect rights, property, or safety.

We do not share personal data with any other third party without your consent.

6. Data Retention

We retain personal data only for as long as needed to provide the Service and for the purposes described in Section 3, or longer where retention is required by law. The full canonical retention matrix (with GDPR Art. 6 legal basis per category) is maintained in the HQ Data Policy. The categories most directly relevant to the Service are:

• Request logs. Our hosting provider (Vercel) logs each request's time, path including any query parameters, status, full IP address and User-Agent; these logs are kept for 30 days. Our own database keeps, for each API key, the last-used time and the last IP address truncated to /24 for IPv4 or /112 for IPv6, for 90 days.
• Account data (email, organization, API key) is kept up to 2 years after your API key was last used (a paid key that is never used: 2 years after it is issued; a trial key that is never used: 14 days after it is issued). Cancelling does not shorten this. The Stripe customer reference, which holds your email, is kept for up to 5 years from checkout while the subscription is active, and 90 days after cancellation. A verified erasure request deletes all of these sooner.
• Rate-limit counters, and the daily request count kept for each RapidAPI username, expire within 24 hours. If setting a daily count's expiry ever fails, a cleanup we run at every deploy sets it, or deletes the count if its day is already over.
• Saved watchlists and webhooks (webhook registrations, which include the API key they belong to, and their delivery logs of the last 50 deliveries) expire with the API key record they belong to (up to 2 years after the key was last used). If setting that expiry ever fails, a cleanup we run at every deploy sets it, or deletes the record if its key record is already gone. You can delete them sooner, a deleted webhook takes its delivery log with it, and a verified erasure request deletes them.
• Backup snapshots of API-key, Stripe-customer and webhook records are written weekly to the same database, and each expires 30 days after it is taken.
• Trial and reminder-email flags, keyed by your email address, expire within 30 days.
• Unsubscribe records. If you unsubscribe from our emails, we keep your email address, which emails you left and when, with no expiry, so that the unsubscribe keeps being honoured. An erasure request does not delete this record.
• Per-client analytics (the daily list of the busiest unauthenticated clients and the daily count of each client’s rate-limited requests, each client identified by a keyed hash of its IP address or API key) expire after 30 days.
• Verified erasure requests are processed without undue delay after verification (typically within 30 days for general requests; California requests under the CCPA follow section 9.8) and always shorter than the normal post-cancellation window.
• Aggregated or anonymized analytics data may be retained indefinitely, as it no longer identifies individuals.

7. Security and Breach Notification

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal data, including transport encryption (TLS) and access controls. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

Breach notification. If we become aware of a breach affecting your personal data, we will notify you without undue delay, and we will notify applicable authorities within 72 hours (or such shorter period) where required by applicable law. For breaches affecting RapidAPI-routed users, we will coordinate with RapidAPI in good faith.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate personal data;
• delete your personal data, subject to legal and contractual retention requirements;
• restrict or object to certain processing;
• portability — receive a copy of your personal data in a structured, machine-readable format;
• withdraw consent, where processing is based on consent;
• lodge a complaint with a supervisory authority in your jurisdiction.

To exercise any of these rights, contact us at the address in Section 13. We will respond within the timeframe required by applicable law, provided that for users accessing through RapidAPI, primary responsibility for rights requests lies with RapidAPI, and our ability to fulfill certain rights (such as portability or deletion of request metadata) is limited by technical and operational constraints inherent to a small-scale B2B API operator.

Users accessing through RapidAPI should direct rights requests concerning their RapidAPI account information to RapidAPI directly. We will coordinate with RapidAPI in good faith for data under our shared responsibility.

9. California Privacy Rights (CCPA / CPRA)

This Section supplements the rest of this Privacy Policy with disclosures and rights specific to residents of California, as required by the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"). It applies only to California residents and only to the extent the CCPA applies to our processing of your personal information ("PI"). Capitalized terms used in this Section but not otherwise defined have the meanings given in the CCPA.

9.1 Categories of personal information we collect

Within the past twelve (12) months, we have collected the following CCPA-enumerated categories of PI from California residents in connection with the Service:

• Identifiers — email address (for direct-issued account holders), API key, RapidAPI username (for RapidAPI users), IP address.
• Customer records (Cal. Civ. Code § 1798.80(e)) — organization name and email address, where you provide them.
• Commercial information — subscription tier and billing-related metadata received from RapidAPI or Stripe.
• Internet or other electronic network activity — request and response metadata (endpoint called, timestamp, status, latency, User-Agent, referring URL).
• Geolocation data — coarse, IP-derived only. We do not collect precise geolocation.
• Inferences — none. We do not draw inferences from your PI to create a profile reflecting your preferences, characteristics, behavior, or aptitudes.

We do not collect the following CCPA categories: biometric information; sensory data (audio, visual, thermal, olfactory); professional or employment-related information; education information; or characteristics of protected classifications under California or federal law.

9.2 Sensitive personal information

We do not knowingly collect "Sensitive Personal Information" as defined in CCPA § 1798.140(ae) (e.g., government identifiers, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, biometric data, health data, or contents of personal communications). Accordingly, the right to limit the use of Sensitive PI does not have practical effect because we do not use Sensitive PI.

9.3 Sources of personal information

We collect PI directly from you (when you create a direct-issued account, contact us, or submit a form on our websites), from RapidAPI (limited to the categories described in Section 2.1), and from your interactions with the Service (request and response metadata).

9.4 Business and commercial purposes

We use PI for the business purposes described in Section 3 (Providing the Service, operational reliability, aggregate analytics, usage and plan analytics, communications, and legal and compliance). Usage and plan analytics is a commercial purpose: it shows us which clients use the API heavily and may need an API key or a paid plan. We do not use PI for any other commercial purpose.

9.5 Disclosure of PI to third parties

In the past twelve (12) months we have disclosed PI to the categories of service providers and third parties listed in Section 5 (Sharing and Disclosure), for the business purposes described in Section 3. The current list of subprocessors is maintained at /privacy/subprocessors.

9.6 We do not "sell" or "share" personal information

We do not sell PI as that term is defined in the CCPA, and we do not share PI for cross-context behavioral advertising. We do not have actual knowledge of selling or sharing PI of consumers under sixteen (16) years of age. Because we neither sell nor share PI, we do not maintain a "Do Not Sell or Share My Personal Information" link; this Section serves as the disclosure of that fact.

9.7 Your California privacy rights

Subject to verification and the limitations below, California residents have the following rights under the CCPA:

• Right to Know — request the categories and specific pieces of PI we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties to whom we have disclosed PI.
• Right to Delete — request deletion of PI we have collected from you, subject to legally permitted exceptions (e.g., to complete a transaction, comply with a legal obligation, or detect and prevent security incidents).
• Right to Correct — request correction of inaccurate PI we maintain about you.
• Right to Opt-Out of Sale or Sharing — not applicable. We do not sell or share PI (see Section 9.6).
• Right to Limit Use of Sensitive PI — not applicable. We do not collect Sensitive PI (see Section 9.2).
• Right to Non-Discrimination — we will not discriminate against you for exercising any of these rights, including by denying service, charging different prices, or providing a different level or quality of service. We do not offer financial incentives for the collection of PI.

9.8 How to exercise your rights

To submit a request to know, delete, or correct, contact us at privacy@holisticquality.io. For deletion requests we will use the verified-erasure flow at /api/keys/erasure, which sends a one-time verification code to the email address associated with the account being erased. We will respond to verifiable consumer requests within forty-five (45) days, with one extension of up to forty-five (45) additional days where reasonably necessary, as permitted by the CCPA.

Authorized agents. You may designate an authorized agent to make a request on your behalf. We may require the agent to provide written permission signed by you and, for verification, may contact you directly. We may also require proof of the agent's identity and the existence of the agency relationship.

Limitations. Our ability to fulfill certain rights is constrained by the technical and operational realities of a small-scale B2B API. For users accessing the Service through RapidAPI, the primary controller of your account information is RapidAPI; please direct related rights requests to RapidAPI. We retain certain PI for the periods described in Section 6 even after a deletion request to the extent permitted by the CCPA's permitted-purposes exceptions (security, legal compliance, completion of transactions).

9.9 Notice of financial incentives

We do not offer any financial incentive or price difference in exchange for the collection, sale, sharing, or retention of PI.

9.10 Metrics

The CCPA requires businesses that buy, sell, or share the PI of 10,000,000 or more California residents per calendar year to publish certain request-handling metrics. We do not approach that threshold and are therefore not required to publish those metrics.

10. International Transfers

Holistic Quality LLC is based in Ohio, USA. Core ALETHEIA account and API-key records are stored in Upstash Redis on AWS eu-west-1 (Ireland), inside the European Union. Other subprocessors (Vercel, Stripe, Resend and Google, which hosts our own mailbox and the site feedback form) may process personal data in the United States or across global networks. Where applicable law requires safeguards for a transfer, we rely on the transfer mechanism in the subprocessor's Data Processing Addendum, including the European Commission's 2021 Standard Contractual Clauses where that Addendum provides for them. Some Addenda apply the clauses only to a transfer that needs them (for Google, where Google has not adopted an Alternative Transfer Solution for the transfer). Per-processor transfer-mechanism status (SCC execution, EU-US Data Privacy Framework participation) is tracked at /api/compliance.

For B2B customers who require a signed processor agreement, see the Data Processing Agreement — it is Article 28 GDPR-compliant, incorporates the EU SCCs (Module Two, Controller-to-Processor) and the UK IDTA by reference, and applies to every Customer of the Service.

11. Children

The Service is not directed to children under 18, and we do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, contact us and we will take reasonable steps to delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be announced at least thirty (30) days before taking effect, through the Service website, the RapidAPI listing, or, for users with direct-issued accounts, via email to the address associated with your account. Continued use of the Service after the effective date of a change constitutes acceptance of the updated Privacy Policy.

13. Contact

Questions about this Privacy Policy or our data practices, including requests to exercise the rights described in Sections 8 and 9:

Holistic Quality LLC
Lebanon, Ohio
privacy@holisticquality.io