Privacy Policy

Effective March 7, 2026 · LOTD PBC (Public Benefit Corporation) · 24000 Avila Road, Laguna Niguel, CA 92677

1. Information We Collect

• Account data: Email address (for API key delivery and billing)
• API usage logs: Endpoint called, timestamp, response time, API key used (no query content stored)
• Billing data: Processed by Stripe — we do not store payment card details

We do not collect: cookies for tracking, device fingerprints, location data, or content of API queries.

2. How We Use Information

• Deliver and maintain the API service
• Enforce rate limits and prevent abuse
• Process billing via Stripe
• Send transactional emails (welcome, usage alerts, billing)
• Aggregate anonymous usage statistics to improve the service

3. What We Don't Do

• No third-party analytics or tracking pixels
• No advertising or behavioral profiling
• No selling or sharing data with third parties for marketing
• No training AI models on your API usage patterns

4. Data Storage

Data is stored on Cloudflare's global edge network using Workers, D1 (SQLite), KV, and R2. All data is encrypted at rest and in transit (TLS 1.3). No single geographic data center — data is replicated across Cloudflare's network for performance and resilience.

5. Third-Party Services

• Stripe — Payment processing. Stripe Privacy Policy
• Resend — Transactional email delivery. Resend Privacy Policy
• Cloudflare — Infrastructure. Cloudflare Privacy Policy

6. Data Retention

• API logs: 90 days, then automatically deleted
• Account data: Retained until you request deletion
• Usage analytics: Aggregated, anonymized, retained 12 months
• Billing records: As required by law (typically 7 years)

7. Your Rights

California (CCPA): Right to know what data we collect, right to delete, right to opt out of data sales (we don't sell data), right to non-discrimination.

European Union (GDPR): Right to access, rectification, erasure, data portability, restriction of processing, and objection. Our lawful basis for processing is contract performance (API service) and legitimate interest (security).

To exercise your rights, email privacy@lotdpbc.com. We respond within 30 days.

8. Children's Privacy

We comply with COPPA. We do not knowingly collect personal data from children under 13. API accounts require users to be 13 or older. Our educational content is designed for all ages, but account registration is restricted.

9. Public Benefit Corporation

LOTD PBC is incorporated as a Public Benefit Corporation under Delaware law. Our charter requires that data processing serve our educational mission. We are structurally prohibited from monetizing user data through advertising or data brokerage.

10. Security

• TLS 1.3 encryption for all connections
• API keys hashed at rest (never stored in plaintext)
• Cloudflare edge security (DDoS protection, WAF)
• Rate limiting and abuse detection
• No sensitive data in URL parameters or logs

11. International Transfers

Data may be processed in any country where Cloudflare operates edge nodes. We rely on Cloudflare's EU-US Data Privacy Framework certification and Standard Contractual Clauses for international transfers.

12. Changes to This Policy

We will notify you of material changes via email and our changelog at least 30 days before they take effect.

13. Contact

Privacy questions: privacy@lotdpbc.com

LOTD PBC · 24000 Avila Road · Laguna Niguel, CA 92677