Skip to main content

Privacy Policy

Last updated: October 21, 2026

This Policy explains how Ermulin studio, the operator of AntAPI (“we,” “us”), handles personal information when you visit our website, create an account, or use our Console and APIs. Ermulin studio is the data controller responsible for account, service administration, security, and billing information. Where you submit personal information for processing on behalf of your organization, you remain responsible for having the authority and lawful basis to do so. Any separate data processing agreement governs the processing it covers.

1. Information we handle​

  • Account and workspace information: email address, display name, password hash, email verification records, organization and project details, membership and invitations, and account preferences. We do not store your password in plaintext.
  • Authentication and security information: session identifiers, API key hashes and display identifiers, security and administrative audit records, and technical information needed to investigate abuse or protect access.
  • Usage and execution metadata: organization and project identifiers, Request IDs, operation and price versions, timestamps, status, errors, billable quantities, and execution or settlement records.
  • Billing information: purchased plans and Credits, payment and subscription identifiers, payment status, refunds, ledger entries, and charge receipts. Stripe processes payment details under its own Privacy Policy. AntAPI does not store full payment card numbers or card security codes.
  • API inputs and results: information needed to carry out your request, such as a domain name for WHOIS or a domain list for a batch. Batch work stores the inputs, position mapping, progress, and results needed to execute and retrieve the job. WHOIS retrieves registration information from registry and registrar RDAP or WHOIS services; those sources may supply personal information or redact it.
  • Communications and connection information: information you choose to send when requesting help, and connection information such as IP address and browser or client details that hosting and network services may process to deliver traffic and protect the Services.
  • Public website analytics: page visits, referring pages, browser and device information, and cookie-based identifiers processed through Google Analytics 4 to understand use of our public website.

We do not store general API request or response bodies by default. This does not mean that every API is stateless: execution inputs and results needed for documented batch features are stored for that purpose. Platform application logs are not intended to contain request or response bodies, plaintext API keys, or other secrets. Avoid sending sensitive information that an API does not require.

2. How and why we use information​

We use information to:

  • Create and authenticate accounts, deliver verification and password reset emails, and manage organizations and projects.
  • Execute API requests, retrieve source data, deliver batch results, and provide customer support.
  • Enforce limits and budgets, meter usage, settle Credits, process payments and refunds, and maintain accounting records.
  • Detect abuse, investigate incidents, secure the Services, resolve disputes, and comply with legal obligations.
  • Communicate service, security, billing, or policy changes relevant to your account.
  • Understand visits to the public website and improve its content and navigation.

Where applicable data protection law requires a legal basis, we rely on performance of our agreement with you for service delivery, legal obligations for required records and disclosures, and legitimate interests in security, fraud prevention, support, and reliable operation where those interests are not overridden by your rights. Where consent is required for an optional activity, we will request it and you may withdraw it. Automated service controls include authentication, rate limits, budget checks, and usage settlement. Contact us if you believe a control has incorrectly restricted your account.

3. Cookies and browser storage​

Console uses a session cookie for authentication and a session-bound CSRF token to protect requests. Interface components may store necessary preferences, such as navigation state. Your language, theme, and timezone preferences are stored locally in your browser. These mechanisms support security and your chosen interface settings.

The public website uses Google Analytics 4 for website analytics. Google Analytics may use first-party cookies, including _ga, to distinguish visits and sessions, and Google processes the associated analytics information under its Privacy Policy. This website integration does not add Google Analytics to Console, Admin, or API execution. We do not attach account details, API key secrets, or API request and response bodies as analytics event parameters.

We do not store API key secrets or API request and response bodies in browser local storage. You can clear or block cookies and local storage through your browser, although doing so may sign you out or reset preferences. Blocking necessary cookies may prevent Console from working.

4. When information is shared​

We share information only as needed for the purposes described in this Policy:

  • Service providers: hosting, infrastructure, email delivery, payment, and public website analytics providers that help operate the Services. They receive information needed for their function and are subject to appropriate contractual or legal obligations.
  • API data sources: a WHOIS lookup sends the queried domain to a relevant registry or registrar service. The source can see the query and our service's connection information. Do not submit unrelated personal information as lookup input.
  • Your organization: authorized members can access organization projects and associated usage information; owners manage membership and billing. Consider what you share when joining an organization.
  • Legal and security needs: where required by law, valid legal process, or reasonably necessary to protect rights, investigate abuse, or prevent harm.
  • Business transfers: if the Services are involved in a merger, acquisition, or asset transfer, information may transfer subject to applicable law and appropriate privacy protections.

We do not sell personal information or share it for cross-context behavioral advertising. Links to external websites and payment pages lead to services governed by their own policies.

5. Retention​

We retain information according to its purpose rather than keeping every category indefinitely:

  • Account and organization information is retained while needed to provide the account and manage authorized access. After a verified closure request, we delete or de-identify information no longer needed, subject to outstanding work, security, dispute, and legal requirements.
  • Request Run technical metadata is normally retained for 30 days. Financial receipts and ledger records are separate and are retained longer for accounting, reconciliation, disputes, and legal obligations.
  • WHOIS batch business inputs and results are normally available for seven days under the configured retention policy. Minimal execution and completion evidence needed to settle authorized work may remain longer, including while settlement is unresolved. See the relevant API documentation for result availability.
  • Payment, Credits, and audit records are retained for as long as necessary to meet accounting, legal, security, and dispute-resolution needs. Historical financial records are not removed merely because an account closes.
  • Sessions and verification data are subject to expiry. Infrastructure logs and backups may remain for their operational retention periods and are restricted to those purposes.

Actual retention may be extended by a legal obligation, an active dispute, or a security investigation. When information is no longer required, we delete or de-identify it through our operational processes. Account closure does not instantly remove copies from backups.

6. Security and international processing​

We use safeguards appropriate to the Services, including access controls, hashed passwords and API keys, session protection, and separation of platform billing data from product execution data. No system is completely secure. Protect your credentials and contact us if you suspect an incident.

We and our service providers may process information outside your country. Privacy laws can differ between countries. Where applicable law requires safeguards for an international transfer, we use the required lawful transfer mechanism and protections. Contact us for information about a transfer relevant to your account. This Policy does not promise storage in a particular country.

7. Your choices and rights​

You can update supported profile settings in Console, manage organization access, and revoke API keys. Contact us to request account closure or exercise a privacy right that is not available in Console.

Depending on your location and applicable law, you may have rights to access or obtain a copy of your personal information, correct it, request deletion, restrict or object to processing, receive portable data, or withdraw consent where processing relies on it. These rights are subject to legal conditions and exceptions, including required financial records and other people's rights. We may need to verify your identity and authority before responding. We respond within the period required by applicable law and do not discriminate against you for exercising an applicable privacy right.

You may also complain to the data protection authority responsible for your location. If your concern relates to information an organization submitted through an API, contact that organization as well. If it relates to an underlying domain registration record, the relevant registry or registrar controls that source record; changing your AntAPI account does not change it.

8. Children​

The Services are intended for adults and are not directed to anyone under 18. We do not knowingly collect children's personal information. Contact us if you believe a child has provided personal information so we can investigate and take appropriate action.

9. Changes to this Policy​

We may update this Policy as the Services or legal requirements change. We will publish the updated version with a revised date and provide additional notice of material changes through the website, Console, or your account email where appropriate. Where a change requires consent, we will request it before the relevant processing begins.

10. Contact​

For privacy questions or requests, contact Ermulin studio at [email protected]. Describe your request and the account or organization it concerns. Never send passwords or API keys.

See also our Terms of Service.