FIRMSapiLegal
Privacy Policy
Version
This policy explains how Atom Interactive, LLC, a Pennsylvania limited liability company (“FIRMSapi”, “we”, “us”), handles personal information when you use firmsapi.com, the docs at docs.firmsapi.com, the developer portal at app.firmsapi.com and the FIRMSapi API (together, the “Service”). Questions go to support@firmsapi.com.
What we collect
Account details. Your email address and the user ID our sign-in service (Amazon Cognito) gives you. If you sign in with Google, Google tells us your email address and whether it’s verified. We keep your plan, subscription status, the date you accepted the Terms and which version you accepted.
API keys and usage. We store a one-way hash of each API key, never the key itself, plus its name, mode (live or test), a shortened display form and when it was created and last used. We count your calls per month and per day for quotas and billing.
Requests to the API and portal. Our servers log each request’s time, IP address, method, path, status,
response time and account ID. Access logs don’t record request bodies or query strings. We don’t store the content
of searches, validations or batches, except as follows. Addresses you send to /nearby may be geocoded with
Amazon Location Service, and the resulting coordinates are cached with the address but without a link to your
account. Codes on your watchlist and webhook URLs you register are stored with your account.
Payments. Link, Stripe’s payment service, collects your payment details at checkout as merchant of record. We never see or store card numbers. We receive a Stripe customer ID, subscription status and billing period, and records of call packs and overage usage.
Emails. We send sign-in codes and service emails through Amazon SES, which tells us whether a message was delivered, bounced or marked as spam. Email you send to support@firmsapi.com is handled by Google Workspace, and we keep the conversation.
Analytics and session recordings. We use PostHog on the website, docs and portal to understand how people use them. PostHog records pages viewed, clicks, referrer, browser and device details, and an approximate location derived from your IP address. In the portal we link these events to your account ID and plan. PostHog also makes session recordings: a replay of the page as you saw it (which in the portal can include your email address), with mouse movements, clicks and browser console messages. Everything typed into form fields is masked before it leaves your browser, and so is a new API key when the portal shows it to you.
Why we use it
- To run the Service: sign you in, issue and check API keys, enforce quotas and bill for usage.
- To keep it secure and reliable: detect abuse, debug errors and investigate incidents.
- To communicate: send sign-in codes, receipts (sent by Link) and notices about your account or these policies.
- To improve it: understand which pages and features people use, and where they get stuck.
- To meet legal obligations and enforce our Terms of Service.
We don’t sell personal information, and we don’t share it for cross-context behavioral advertising. We don’t use advertising cookies or trackers.
Who processes it for us
| Provider | What they do | Data involved |
|---|---|---|
| Amazon Web Services | Hosting (Amplify, Lambda, API Gateway, DynamoDB, S3, CloudWatch), sign-in (Cognito), email (SES), geocoding (Amazon Location Service) | Everything above, stored in the US (us-east-1) |
| Stripe and Link | Checkout, payments, taxes, receipts, refunds and payment support, as merchant of record | Payment and billing details, email address |
| PostHog | Product analytics and session recordings (US cloud) | Usage events, session recordings, IP-based location, account ID and plan |
| Email for support@firmsapi.com (Google Workspace); optional sign-in with a Google account | Support emails and their contents; email address and verification status |
Each provider processes data under its own privacy terms. Link is merchant of record for purchases, so it also handles payment data under Link’s privacy policy. We may disclose information if the law requires it, to protect the Service or others, or as part of a merger, acquisition or sale of the Service.
Cookies and browser storage
- PostHog sets a first-party cookie and local storage entry with a random ID, so visits and sessions can be counted.
- The portal keeps your sign-in tokens in browser storage until you sign out, and briefly remembers the plan you picked on the pricing page.
- The docs remember your light or dark theme.
- Stripe and Link set their own cookies on their checkout and billing pages, for payments and fraud prevention.
You can block or clear cookies in your browser. The portal needs browser storage to keep you signed in.
How long we keep it
| Data | Kept for |
|---|---|
| Account, API key records, watchlists, webhooks | While your account is open, then deleted when you ask us to close it |
| Monthly usage totals and billing records | While your account is open, and longer where tax or accounting rules require |
| Daily usage counts | 400 days |
| API and portal request logs | 30 days |
| Session recordings | 30 days |
| Analytics events | As long as our PostHog plan retains them |
| Database backups | Rolling 35-day window |
Link and Stripe keep payment records as their own policies and legal obligations require.
Your choices and rights
- Access and correction. The portal shows your account details, keys and usage. To change your email or get a copy of your data, write to us.
- Deletion. To delete your account and its data, email support@firmsapi.com from the address on the account. We’ll confirm the request, cancel any subscription, revoke your keys and delete your account data within 30 days. Backups roll off within 35 days after that. We keep what the law requires us to keep, such as billing records, and Link keeps its own payment records.
- Analytics. Browser privacy settings and content blockers that block PostHog stop analytics and session recording.
- Where you live. Depending on your location, you may have more rights, such as objecting to or restricting processing, data portability, or complaining to a data protection authority. Write to us to use them. We won’t treat you differently for doing so.
Security
We encrypt data in transit and at rest, store API keys only as hashes, limit staff access, and keep sign-in codes short-lived. No system is perfectly secure. If we learn of a breach affecting your personal information, we’ll tell you as the law requires.
Children
The Service is for businesses and isn’t directed to children. We don’t knowingly collect information from anyone under 18.
International users
We are based in the United States, and our providers process data in the United States. If you use the Service from elsewhere, your information is transferred to and processed in the United States.
Changes
We’ll post updates on this page with a new date at the top. For material changes, we’ll email you or tell you in the portal before they take effect.
Contact
Atom Interactive, LLC · support@firmsapi.com
See also: Terms of Service