Privacy Policy

Who we are

reqi.dev is a trade name of Surf Online, registered in the Netherlands (under KvK 42127201). Surf Online is the data controller for personal data described in this policy.

For privacy and data subject requests relating to the Service, contact hello@reqi.dev.

Scope

This policy applies when you use our landing page at reqi.dev, human documentation at docs.reqi.dev, the Service and flag redirects on api.reqi.dev, and flag images on cdn.reqi.dev. We do not offer user accounts.

What we process

When you use the Service, our hosting and CDN providers may process technical data on their systems to deliver requests (see Subprocessors). We do not store IP addresses in our own application logs or database.

We store application-level metadata for public API routes under /v1 in our database: country code (from headers where available), User-Agent, and optional X-Client-Id when you send that header. We do not store Authorization, cookies, payment signatures, IP addresses or request bodies. We use this data to operate the Service, identify abusive or unusual traffic, and debug integrations.

We do not intentionally collect names, email addresses, or payment card details through the public API or landing page, and we do not build advertising profiles from API use.

Query parameters and your data

We do not use query parameters or request paths to target advertising. You and your applications control what you send in URLs; please do not pass personal or sensitive data in query strings. Such data may still be recorded in logs that our infrastructure processes.

Cookies and local storage

The public landing page does not set analytics or advertising cookies. If we add optional analytics in the future, this policy will be updated.

Why we process information

We use log and technical data to operate and protect the Service, understand aggregate usage, diagnose errors, and improve reliability. We do not sell personal information.

Legal bases

Where the GDPR or similar laws apply, we rely on the following legal bases for processing technical data:

Legitimate interests (Article 6(1)(f) GDPR): operating, securing, and improving the Service; detecting abuse; understanding aggregate usage; and maintaining reliability. We balance these interests against your rights and expect minimal impact because we do not operate accounts or targeted advertising.

Legal obligation (Article 6(1)(c) GDPR): when we must retain or disclose information to comply with applicable law.

We do not rely on consent for marketing cookies on the public landing page (we do not set analytics or advertising cookies there today). We do not process data under a user contract because we do not offer sign-in accounts for the public API.

Subprocessors

• Vercel hosts the Service and processes technical data on our behalf. Vercel’s privacy practices are described at https://vercel.com/legal/privacy-policy.
• Mintlify hosts human documentation at docs.reqi.dev and may process technical data when you browse the docs. Mintlify’s privacy practices are described at https://www.mintlify.com/legal/privacy.

Sharing

We share data only with infrastructure providers that process it on our behalf to deliver the Service, or when required by law. We do not sell personal information.

Retention

Server and CDN logs are retained for a limited period according to our host’s defaults and operational needs, then deleted or aggregated.

International transfers

Infrastructure providers may process technical data in multiple countries as part of delivering the Service globally.

Children

The Service is not directed at children under 16. We do not knowingly collect personal information from children.

Your choices and rights

If you are in the EEA, UK, or another region with similar privacy laws, you may have the right to access, rectify, erase, restrict, or object to processing of your personal data, and to data portability where applicable. Because we do not operate user accounts, we may only be able to respond based on information you provide (for example, approximate time of a request, optional X-Client-Id, User-Agent, or stored country code). Email hello@reqi.dev to submit a request; we will respond within the timeframes required by applicable law.

You may lodge a complaint with the Autoriteit Persoonsgegevens (AP), the Dutch supervisory authority, at https://autoriteitpersoonsgegevens.nl. If you are in the United Kingdom, you may also contact the Information Commissioner’s Office (ICO) at https://ico.org.uk.

Changes

We may update this policy from time to time. The effective date at the top of this page indicates the latest revision.