Privacy and cookies policy
Version of 25 September 2026. AXITAM Public API is in public beta.
1. Controller
AXITAM SRL, enterprise number 0420.254.973, Belgium, is the controller of the personal data processed by the AXITAM Public API developer portal. Contact: publicapi@axitam.net.
2. What we collect and why
Developer account: e-mail address, display name, language, the dates of registration, verification and approval, the version and date of the terms you accepted, the status of the account, and your password stored as a salted hash (never in clear). Purpose: providing the account you asked for (performance of a contract). Subscription and API keys: the plan, the dates of your subscription, and for each key its visible prefix, a hash of the key, the label you gave it and the minute of its last use. Purpose: providing the keys and applying your plan's limits (contract). Login attempts: a hash of the e-mail address, the IP address of the client and the result, for 24 hours. Purpose: pausing logins after repeated failures (legitimate interest: security). Anonymous API use: the IP address of each client is kept in memory for the usage limits and forgotten 10 minutes after its last request; refused requests are logged with the IP address truncated. Technical logs: the server logs record the requests (IP address, path, time, result) and the security events (account created, approved, key created or revoked, identified by account id, never by e-mail address). They are kept for the time needed to operate and secure the service, generally a few weeks. E-mails we send you (verification, approval, password reset, security notices) are necessary to the service; we send no newsletter.3. Retention
Your account data is kept as long as your account exists. When you delete your account, its personal data is anonymised at once (e-mail address, name and password removed; the history of your subscriptions and key identifiers stays without any link to you). Verification and reset links expire after 24 hours and 1 hour respectively and are purged. Login attempts are purged after 24 hours. Accounts refused or never verified may be deleted after one year.
4. Recipients
Your data is processed by AXITAM SRL only, on servers it operates in Belgium, and by the e-mail infrastructure it uses to send you the messages above. It is never sold or shared for marketing, and no third-party analytics service runs on the portal.
5. Your rights
You may access your data (the portal exports everything stored about your account as JSON), rectify it (name and language in the portal; e-mail address on request), erase it (delete your account in the portal), and ask for restriction, objection or portability by writing to publicapi@axitam.net. You may lodge a complaint with the Belgian Data Protection Authority (www.dataprotectionauthority.be).
6. Cookies
The portal uses only cookies that are strictly necessary or functional; no advertising, tracking or audience-measurement cookie, no third-party cookie. This is why no consent banner is shown.
| Cookie | Purpose | Lifetime |
|---|---|---|
PUBLICAPI_SESSION | Keeps you logged in to the portal (session identifier). | Until you log out or after 12 hours without activity |
XSRF-TOKEN | Protects the portal against cross-site request forgery. | Session |
publicapi_lang | Remembers the language you chose for the portal. | 1 year |
The public API itself (the endpoints under /api/v1) sets no cookie.
7. Changes
This policy may be updated; the version date at the top changes accordingly and significant changes are announced by e-mail to account holders.