TwittrAPI

Privacy policy

How we process personal data on this website, in the dashboard and in the API.

Last updated: 13 October 2026

1. Controller

The controller within the meaning of Art. 4(7) GDPR for this website (www.twittrapi.com), the dashboard (app.twittrapi.com) and the API is TwittrAPI, reachable by email at support@twittrapi.com.

No data protection officer is required or appointed.

2. Website

Hosting. The website is hosted on Vercel. When you open a page, your browser sends technical data (for example IP address, browser type, requested URL and time) that the hosting provider processes to deliver the page and keep it secure (Art. 6(1)(f) GDPR).

Website analytics

We measure how the website is used so we can see which content helps visitors and where the way to an account or a purchase breaks off.

Vercel Web Analytics counts page views without cookies and without storing anything on your device. Vercel recognises a visit by a hash of the request that changes every day; we see only totals (pages, referring sites, countries, device types). Query parameters other than campaign parameters (utm_*) are removed before sending. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in measuring and improving the website).

PostHog (PostHog Inc., EU cloud in Frankfurt, as our processor) records page views and interactions: clicks on buttons and links, tab changes, the price calculator, the endpoint explorer, the free tools (whether a lookup worked, not what you entered), copied code samples, search terms in the documentation (shortened, with email addresses and keys removed), scroll depth and pages not found. We never record what you type into form fields, API keys or email addresses, and we do not use session recordings. Requests go through this website's own domain (path /ingest); our server removes your IP address and cookies before forwarding them to PostHog, PostHog is set to discard IP addresses, and location lookup is switched off. We do not create profiles of anonymous visitors.

  • Without your consent (default): PostHog runs without cookies. The random visitor ID exists only in the memory of the open page and is gone when you reload or close it; nothing is stored on or read from your device. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in understanding and improving the website). You can object at any time (Art. 21 GDPR), for example by emailing us or by sending a browser privacy signal (see below).
  • With your consent: if you click "Accept" in the consent bar, PostHog stores a random ID in a cookie (ph_<project key>_posthog, for twittrapi.com and its subdomains, 1 year) and in your browser's local storage. This lets us recognise your browser on later visits and in the dashboard (app.twittrapi.com) and see which pages lead to sign-up, first API call and top-up. If you then create an account or log in, the dashboard links this ID to a pseudonymous account ID (a keyed hash of the account number, never your email address). Legal basis: your consent under the ePrivacy rules and Art. 6(1)(a) GDPR.
  • Your choice is stored in the cookie twittrapi_consent (for twittrapi.com and its subdomains, 180 days), so one decision applies to the website and the dashboard. This cookie is technically necessary to respect your choice (no consent needed under the ePrivacy rules; Art. 6(1)(c) and (f) GDPR).
  • Withdraw or change your choice at any time with "Cookie settings" at the bottom of every page. When you decline, we delete the PostHog cookie and local storage entries; cookieless measurement continues as described above.
  • Browser privacy signals: if your browser sends Global Privacy Control (GPC) or Do Not Track, we treat this as declining and do not load PostHog in your browser at all.
  • Retention: analytics events are deleted after 24 months at the latest.

Links to other services. The "Get started" and pricing pages link to RapidAPI, JojAPI and our dashboard. Outbound links carry campaign parameters (utm_source, utm_medium, utm_campaign) that tell the destination which part of this website the link came from. Once you leave this website, the privacy policy of the destination applies.

Email. If you email us, we use your message and address only to answer your request.

3. Dashboard and API

We process only the personal data needed to run the Service:

  • Account data: email address, password (stored only as a hash), API key and account settings. Purpose: account, authentication, communication. Legal basis: Art. 6(1)(b) GDPR (contract).
  • Business and billing data: company name, VAT ID, country, contact for card requests, invoices and Balance transactions. Purpose: billing, taxes. Legal basis: Art. 6(1)(b) and (c) GDPR.
  • Payment data: card payments are processed by our payment provider (see section 4); we receive only the result and transaction references, not your full card number. For crypto top-ups we assign you a deposit address and record incoming transactions (network, amount, transaction ID). Blockchain transactions are public by nature.
  • Request logs: time, endpoint, status code, response time and Balance change of each API call; for failed calls also the query parameters (credential-like values redacted) and the first 200 characters of the error response. Cookies and proxy credentials sent with account actions are never logged. Purpose: billing, refunds of failed calls, abuse detection, debugging. Legal basis: Art. 6(1)(b) and (f) GDPR. Request logs are deleted after 24 hours. We keep aggregated call counts (without request details) for billing and statistics.
  • Security data: IP address, IP-based country and a coarse browser fingerprint at registration and login, failed login attempts, and a bot check (Cloudflare Turnstile) at registration. Purpose: preventing abuse, duplicate trial accounts and brute-force attacks. Legal basis: Art. 6(1)(f) GDPR.
  • Dashboard usage: page views and clicks in the dashboard with IP address and browser/device type, stored in our own database. Purpose: improving the dashboard and detecting misuse. Legal basis: Art. 6(1)(f) GDPR.
  • Product analytics: our server records the main steps of the customer journey and sends them to PostHog (EU, see section 2) under a pseudonymous ID (a keyed hash of your account number; no email address, no IP address): registration started and completed, with the campaign parameters of the link you came from (utm_*, referring site and first page visited on our website, stored with your account as "first touch"), email confirmed, first API call, use of the test credit, top-ups (method, network, amount), changes of price tier or plan, monitor bookings, API key created or rotated, sign-ups and purchases by AI agents, and apps connected via OAuth. Nothing is stored on your device for this. Purpose: understanding where customers get stuck and improving sign-up and payment. Legal basis: Art. 6(1)(f) GDPR. With your consent (the same consent bar and cookie as on the website, section 2), PostHog also runs in the dashboard in your browser: page views, clicks and form steps (for example "form submitted" or which field had an error, never the values you type), linked to the pseudonymous ID; without consent the dashboard measures without cookies.
  • Account monitoring (if you use it): the accounts you watch, your webhook URL and signing secret, and the delivered posts. Delivered posts are kept for 7 days; failed webhook deliveries are retried for up to 24 hours. Legal basis: Art. 6(1)(b) GDPR.
  • Service emails: we email you about your own account: confirmation and password links, payments, your test credit and test period, low-balance alerts, and help with your first API call. These emails contain no advertising. Legal basis: Art. 6(1)(b) GDPR. We record which of these emails we sent and when, so none is sent twice; addresses that bounce are no longer emailed.
  • Product updates and offers (only with your consent): if you tick the optional box at sign-up or on the "Email preferences" page, we email you product updates and offers, at most twice a month. Emails start only after you confirm the link we send to your address (double opt-in). As proof of your consent we store the time, IP address, browser user agent, the exact text you agreed to and where you agreed (sign-up, preferences or email link). Legal basis: Art. 6(1)(a) GDPR; for the proof, Art. 6(1)(c) and (f) GDPR with Art. 7(1) GDPR. You can withdraw your consent at any time with the unsubscribe link in each of these emails (one click) or on the "Email preferences" page.
  • Existing customers: if you buy credit, we may use the email address you gave us to tell you about similar TwittrAPI products, as the law on direct marketing to existing customers allows. We tell you about this at sign-up and when you top up. Legal basis: Art. 6(1)(f) GDPR (our interest in direct marketing to our customers). You can object at any time, free of charge (apart from the transmission costs at basic rates), on the "Email preferences" page or with the link in each of these emails.

API content. We do not store X/Twitter content returned by successful API calls; it is relayed in real time. For data you retrieve through the API, you are the controller (see the terms).

We do not process special categories of personal data (Art. 9 GDPR) and do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR.

4. Recipients

We share data only as far as necessary with:

  • Payment provider for card payments. For one-time card packages it acts as reseller and processes payment data as an independent controller under its own privacy policy, which is shown at checkout; for approved business card payments and auto top-up it processes payments for us.
  • Hosting and infrastructure providers (servers, databases, website hosting, email delivery), which process data on our behalf.
  • PostHog (PostHog Inc., data stored in the EU, Frankfurt) for website and product analytics (section 2 and 3), as our processor. PostHog Inc. is based in the USA; access from there is covered by the EU standard contractual clauses.
  • Cloudflare for the bot check at registration.
  • Telegram, which we use for internal notifications to the operator (for example new registrations or payment events).
  • Competent authorities, where we are legally required to disclose data.

We do not sell personal data and do not share it with others for their advertising. We use your email address for our own product emails only as described in section 3. Where providers process data outside the EU/EEA, this happens on the basis of an adequacy decision or the EU standard contractual clauses.

5. Retention

We keep personal data only as long as necessary for its purpose or as required by law. Request logs are deleted after 24 hours; monitoring deliveries after 7 days. Invoices and booking records are kept for up to 10 years as required by commercial and tax law. Records of consent to product emails and of withdrawals or objections are kept as long as your account exists, to prove that our emails were lawful. When you delete your account, we delete or anonymise your personal data within 30 days, subject to these statutory retention obligations.

6. Cookies and storage on your device

  • Strictly necessary: the dashboard's session cookie (login) and twittrapi_consent (your analytics choice, 180 days). No consent needed under the ePrivacy rules.
  • Only with your consent: PostHog's cookie ph_<project key>_posthog (1 year) and the matching local storage entry, as described in section 2.
  • Without consent, the website and the dashboard store nothing else on your device. We use no advertising cookies.

7. Your rights

Under Arts. 15–21 GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interests. You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR) and object to the use of your data for direct marketing at any time (Art. 21(2) GDPR); for product emails, the unsubscribe link in each email or the "Email preferences" page in the dashboard is enough. To exercise these rights, email support@twittrapi.com. We respond within one month.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement.

8. Changes

We may update this policy. The current version is always available on this page; material changes are announced in the dashboard.