Privacy policy

bigapi.dev, api.bigapi.dev (including the MCP connector), console.bigapi.dev · Controller: Artoption GmbH, Hamburg, Germany · support@bigapi.dev

1. What we process and why

API keys and accounts. A key is created without personal data. We store a hash of the key, its name, creation and last-use time, balance and usage counters. Legal basis: contract (Art. 6(1)(b) GDPR).
Files you send. Files are processed in memory or in a temporary in-memory directory and deleted immediately after the response is delivered, at the latest within 10 minutes. We do not read, index or keep them. Results requested through the MCP connector are the one exception, see section 2.
Usage records. Per operation: type, timestamp, duration, page count, size, cost, HTTP status, key id. Kept for billing and abuse prevention, 24 months. No file content.
Key issuance limits. A hash of the IP address, made with a random key that changes every day and is never stored, plus a daily counter; deleted after 7 days. It limits free keys per IP (legitimate interest, Art. 6(1)(f)).
Payments. Handled by Stripe as merchant of record (Stripe Payments Europe Ltd.). We receive your email, the amount and a payment reference; we never see card data. Stripe’s privacy notice: stripe.com/privacy.
Server logs. IP address, request path, status, timestamp, user agent – 7 days, for security and fault diagnosis.
Unknown paths. Requests to non-existent API paths are counted per path and day (no key, no IP) to decide which operations to build next.

2. MCP connector (Claude, ChatGPT and other AI assistants)

If you use bigapi through api.bigapi.dev/mcp or api.bigapi.dev/mcp/connect (setup: MCP guide), the assistant you use (for example Claude by Anthropic or ChatGPT by OpenAI) sends us the tool calls. What you write in that chat is governed by that provider's privacy policy; we only receive the tool call itself.

Sign-in. When you connect, you enter your bigapi API key on our page. We store it encrypted (AES-256-GCM) together with hashes of the access token (valid 30 days) and refresh token (valid 180 days) that we issue to the app. Expired tokens are deleted automatically within an hour. We also store the app's registration (name and return address, no personal data). Legal basis: contract (Art. 6(1)(b) GDPR).
Input files. The assistant passes files as a download link or inline. We fetch linked files from the address given (HTTPS only) and hold all input files in memory only, for the duration of the operation.
Results. A result file is kept on our server for at most 15 minutes so the assistant can offer you a download link. The link works once; the file is deleted after the download or when the 15 minutes are over, whichever comes first.
Usage records. As in section 1, marked as coming from the connector. No file content.
Disconnecting. Remove the connector in your assistant, or revoke the key in the console; all tokens issued for that key stop working immediately.

3. Where

Processing servers: Hetzner Online GmbH, Germany. Account database: Supabase (EU region). Website and console hosting: Hostinger (EU). Fonts are served from our own web space; your browser does not connect to Google or any other font provider.

4. Cookies and tracking

None. The console stores your API key in your browser only if you tick “remember on this device”. No analytics, no ads.

5. Your rights

Access, rectification, erasure, restriction, portability and objection under Art. 15–21 GDPR, and the right to complain to a supervisory authority (for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit). To exercise them, email support@bigapi.dev from the address linked to your account, or quote your key prefix.

6. Deletion

Revoke keys any time in the console. To delete the account and its records, email us; balance refunds follow the terms.

Last updated: 6 October 2026.