Privacy Policy

1. Information We Collect

We collect information strictly necessary to provide developer API access, process calculations, and prevent abuse:

A. Account Information

When you create an account directly or authenticate via Google OAuth, we collect your name, email address, password hash (via bcryptjs), and optional profile avatar.

B. API Calculation Request Data

When sending requests to /api/v2/bazi/calculate (or legacy /api/v1/bazi/calculate), our servers receive:

• Birth date (YYYY-MM-DD) and birth time (HH:mm)
• Biological gender (male or female)
• Timezone identifier (e.g., Asia/Shanghai, UTC)
• Language preferences (en or zh)

This data is processed in ephemeral memory and may be cached in Redis with a short TTL strictly to accelerate duplicate calculation requests. We do not correlate individual birth calculation requests with user personal records or store them for any other purpose.

C. Technical Telemetry & API Logs

For rate limit enforcement and system observability, our systems log request metadata including API key prefix, client IP address, user-agent, endpoint path, HTTP response status code, and latency in milliseconds. These logs are retained for a maximum of 90 days.

2. How We Use Your Data

Your information is used solely to:

• Verify API key credentials and process Four Pillars calculation requests.
• Monitor sliding window rate limits (RPM) and plan quotas.
• Send critical transactional notices (email verification, plan renewal, quota exhaustion warnings).
• Protect against DDoS attacks, brute-force attempts, and unauthorized key usage.

We do not use your data for advertising, behavioral profiling, or sale to third parties.

3. Third-Party Service Providers

We work with trusted third-party service providers that help us operate and secure the BaZi API platform:

• Payment Provider / Merchant of Record: Handles checkout, payment processing, subscription billing, applicable taxes, and related payment services. We do not receive or store customers' raw credit/debit card numbers.
• Google Identity Services: Provides optional, secure single sign-on (SSO).
• Transactional Mail Delivery: Delivers account verification and security alerts via secure TLS SMTP.

We do not sell, rent, or monetize your personal information to third parties or advertisers.

4. Data Retention

We retain your data only as long as necessary:

• Account data: Retained for the lifetime of your account. Deleted within 30 days of a verified account deletion request.
• API request logs: Retained for 90 days for rate limiting and abuse prevention, then automatically purged.
• Calculation cache (Redis): Short TTL, typically under 24 hours. Not linked to individual identities.

5. Your Privacy Rights & Regulatory Commitments

Under international privacy regulations, you have the right to:

• Access: Request a complete export of personal data held about you.
• Rectification: Update or modify your account information through your dashboard.
• Erasure (Right to be Forgotten): Request the permanent deletion of your account, API keys, and associated logs.
• Instant Key Revocation: Immediately revoke active API keys via your dashboard at any time.

To exercise your data privacy rights, email us at support@baziapi.pro.