Tourism API privacy

Tourism API (tourismapi.com) is operated by DeveloperData.net (Developer Data), Empire Tower, 41st Floor, Unit 4106-7, South Sathorn Road, Yannawa, Sathorn, Bangkok 10120, Thailand ("we", "us").

DeveloperData.net is the controller of the personal data described here.

What we keep

• Your account: email address, name and plan. When you sign in with Google, Google shares your name, email address and profile picture with us; we keep the picture address with your account.
• API keys, only as a fingerprint, never the key itself.
• Usage counts: calls per key per day, and per endpoint.
• Support tickets, held in our support system.
• Page and API logs: the page or endpoint, the time, your IP address, browser and country.

Card details

We never hold card details. Stripe takes the payment and keeps the card.

Why we keep it

To run the API and your account, bill your plan, answer support, stop abuse and keep the service secure. Nothing is sold, and there is no advertising tracking.

Who else handles it

• Stripe, for payments.
• Cloudflare, for the network and security.
• Our email provider, through Developer Data.
• Google, for sign-in with Google.
• Our hosting company.

While you are signed out, our pages load Google's sign-in script, so Google receives your IP address and may use its own cookies.

Cookies

• ta_sid: keeps you signed in, for up to 30 days.
• ta_ot: a one-time value that protects the Google sign-in pop-up, for ten minutes.
• ta_out: marks that you have just signed out, so Google does not sign you straight back in, for one minute.
• ap_click: first-party; remembers which partner sent you, so they can be credited if you buy. It holds no personal details and lasts 60 days (a newer partner link replaces it).

There are no third-party analytics cookies.

How long we keep it

• Your account and what you put in: while the account is open.
• After you delete your account: gone within 30 days, backups included.
• Billing records (invoices, payments): as long as tax and accounting law requires, even after the account is deleted.
• Page, API and security logs: 30 days.
• Support tickets: while the account is open, then deleted with it.

Your rights

You can see what we hold about you, have it corrected, take a copy, or have it deleted. Ask through /support; we answer within 30 days.

Deleting your account

Delete it yourself from your account (Delete my account). Your plan is cancelled at once (the unused part is not refunded), every API key stops working, you are signed out, and your account is deleted within 30 days. If you cannot sign in, ask through /support.

Children

Tourism API is not for anyone under 18.

Changes

Changes are posted here with their date. A change that matters is emailed to members before it applies.