Privacy
What the current features process and retain.
Contact messages
The contact form sends your name, email and message to the CleAPI server for email delivery. Optional company and phone details are included if you supply them. Send only information needed for your request.
Accounts and API usage
When customer access is enabled, CleAPI stores the account identity binding, display name, key digests, scopes, key changes and request usage. Request IDs and fingerprints help prevent duplicate accounting. Account sign-in depends on a configured identity provider; it is currently unavailable.
Webhook payloads
Receiver history stores request bodies and selected headers and query fields. Recognized secret fields are redacted, but bodies may still contain sensitive data. Legacy receiver history is accessible to anyone with its endpoint ID. Account-owned history requires the owning account. Use synthetic payloads and keep receiver URLs private.
Retention
Webhook events stop appearing after one hour and may be evicted sooner by storage limits. Expired records are removed during receiver activity or maintenance. Account, key audit, API accounting and request replay records have no automatic deletion policy in the current implementation. Contact delivery and hosting logs have separate storage policies that must be confirmed for the configured services.
Tools and external requests
Text and image utilities that run in your browser process their input there. Webhook proxy requests send your chosen payload to the requested destination. Video requests contact YouTube. Contact, proxy and video features send input to the server; avoid sending secrets through debugging tools.
Sessions and service providers
Customer sign-in and payment providers have not been configured. Any provider enabled later may process identity, session or payment information under its own policy. Hosting infrastructure may process request metadata.
Questions about your information? Contact CleAPI.