Privacy notice

01

Scope

This notice explains information processed when you visit Global Property Metrics, request or use an API key, or contact the operator about the service. The project does not currently offer user accounts, paid subscriptions, advertising or consumer profiling.

02

Information handled

• Information you provide in a direct access request, such as your name, contact details, organization, intended use and related correspondence.
• API-key records, including a one-way hash of the key, a short identifying prefix, issue and last-used timestamps, status, tier and configured limits. The service does not need to store the full secret key after issuance.
• Metering records, including the key identifier, endpoint category, time bucket and request count.
• Standard infrastructure logs that a hosting or security provider may process, such as IP address, request time, URL, response status, user agent and diagnostic information.

03

API-log privacy

API logs are used to authenticate requests, enforce quotas, investigate errors and misuse, understand aggregate demand, and protect service availability. Metering is associated with the issued key, so API use is not anonymous to the operator even when the response contains only public data.

Do not place personal, confidential or sensitive information in query parameters, headers other than the authentication credential, or other request fields. API keys are secrets and should be rotated if exposed.

04

Why information is used

• Provide and secure the website and API.
• Review access requests and communicate about issuance, misuse, revocation or material service changes.
• Measure quotas, diagnose failures and maintain reliable official-data publication.
• Comply with legal obligations and enforce the service terms.

05

Sharing and service providers

Information may be processed by hosting, database, security and other infrastructure providers that support the service. It may also be disclosed when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or complete a project reorganization.

The project does not sell personal information and does not use API logs for third-party advertising.

06

Retention and security

The project has not yet adopted a fixed production retention schedule. Access-request records, key records and logs are kept only as long as reasonably needed for the purposes above, source-license compliance, security, dispute handling and legal obligations, then deleted or aggregated where practical.

Reasonable technical and organizational safeguards are used, but no internet service can guarantee absolute security.

07

Your choices and rights

You may stop using the service at any time and may ask through the direct project contact channel to revoke an API key or raise a privacy request. Depending on where you live, applicable law may provide rights to access, correct, delete, restrict or object to certain processing. Identity may need to be verified before a request is completed.

08

International processing

The service and its providers may process information in more than one country. Any legally required safeguards for cross-border processing will apply. Specific hosting locations and transfer mechanisms will be documented as the production setup is finalized.

09

Changes and contact

This notice may change as the service, providers and legal review mature. The updated date will change when a revision is published. Privacy questions may be raised through the same direct project contact channel through which access to the service was provided; a public privacy desk is not yet available.