# Hagglyai Privacy Policy **Effective date:** 13 October 2026 **Last updated:** 13 October 2026 This Privacy Policy explains what personal data Hagglyai collects, why, how long we keep it, who we share it with, and the rights you have. It applies to the website at https://hagglyai.com, its markdown and JSON pages, the public API at `/api/v1`, the MCP server at `/mcp`, and related tools (the "**Service**"). **Who we are.** The Service is operated by Fraser McKenzie, trading as Hagglyai, in the United Kingdom ("**Hagglyai**", "**we**", "**us**"). For data protection law, including the EU and UK General Data Protection Regulation ("**GDPR**"), we are the **controller** of the personal data described here. **The short version** - There are **no accounts** and **no sign-in**. You can use Hagglyai without telling us who you are. - We do **not** sell or rent personal data, and we do **not** use it for advertising. - We do **not** use your data to train AI models. - Like any website, our hosting provider (Cloudflare) processes your **IP address** and request details to deliver and protect the Service. We keep short-lived technical logs. - We use **Google Analytics cookies only if you accept them** in the cookie banner. You can change your choice at any time with "Cookie settings" at the bottom of every page. - Most of what Hagglyai stores is **public information about APIs**, not about you. --- ## 1. What personal data we collect and why ### 1.1 When you visit the website, call the API or use the MCP server | Data | Example | Why we use it | Legal basis (GDPR) | |---|---|---|---| | **Technical request data** | IP address, approximate location derived from it (country), browser or client user agent, the page or API route requested, date and time, response status | To deliver the Service, keep it secure, prevent abuse and fix errors | Legitimate interests (running a secure, working service) | | **What you search or ask for** | Text typed in the search box, `find_best` tasks, filters such as a maximum price | To answer your request and, in aggregate, to learn which categories people need | Legitimate interests (providing and improving the Service) | Please **do not include personal or confidential information** in search queries or tasks. They are meant to describe a type of API ("web search", "weather in London"), not to contain personal details. We do not try to identify individual visitors, and we do not combine this data with other sources to build profiles. ### 1.2 When you email us If you contact us, for example with the "Request a category" link, a removal or correction request, or a privacy request, we process your **email address, name (if you give it) and the content of your message**, to reply and to handle your request. Legal basis: legitimate interests, or taking steps at your request. ### 1.3 Information about API providers ("Listings") The Service shows information about third-party APIs, Apify actors and MCP servers, collected from **public sources** (the Coinbase x402 Bazaar, the PayAI catalogue, the Apify Store and the MCP Registry) and from our own automated, unpaid checks of those endpoints. This includes the **API name, description, URL, availability, how to use it, payment rail, tags, price and price scheme, payout wallet address, reported usage, and the site's favicon**. This is mostly business information. Where it relates to an identifiable person, for example a sole developer's name, or a public blockchain wallet address linked to them, we process it on the basis of our **legitimate interests** in providing an accurate, independent comparison of publicly listed paid APIs. If you are a provider and want information corrected or removed, see section 6. ### 1.4 Semantic search with Cloudflare Workers AI When a search query or `find_best` task does not match one of our categories by keyword, we may send **the text of that query** to **Cloudflare Workers AI**, which turns it into a numerical representation ("embedding") so we can find the closest matching APIs. The query is processed on Cloudflare's network as our processor. We do not send your IP address or any identifier with it, and we do not use these queries to train AI models. See Cloudflare's [Workers AI data usage](https://developers.cloudflare.com/workers-ai/platform/data-usage/). ### 1.5 Google Analytics and cookies With your consent, we use **Google Analytics** to understand how visitors use the website: pages viewed, approximate location, device and browser type, and how you arrived. Google Analytics sets cookies and processes your IP address to do this. We do not use advertising features: advertising storage is always off. **Until you choose, no analytics cookies are set.** The site uses Google Consent Mode with analytics storage turned off by default; it is turned on only if you select **Accept** in the cookie banner. Legal basis: **consent**, which you can withdraw at any time with **Cookie settings** at the bottom of every page. Google may process this data outside your country; see section 4. Google Analytics data is kept for 14 months. ### 1.6 Data stored in your browser We store **your cookie choice** (accepted or rejected) in your browser's local storage, so we don't ask again on every page. It stays on your device, is not sent to us, and you can clear it at any time in your browser settings or change it with **Cookie settings**. --- ## 2. How we store and protect data - **Where:** The Service runs on **Cloudflare** (Workers, D1 database, R2 storage, Queues, Vectorize and Workers AI). Data is stored and processed on Cloudflare's global network. - **In transit:** All connections to the Service use **HTTPS (TLS)**. - **At rest:** Data stored with Cloudflare is **encrypted at rest** by Cloudflare ([D1 data security](https://developers.cloudflare.com/d1/reference/data-security/)). - **Access:** Access to our systems and admin functions is limited to authorised people and protected by Cloudflare Access. - **No accounts, no passwords:** we hold no user accounts, passwords or payment card details. No system is completely secure, but we take reasonable technical and organisational measures to protect personal data against loss, misuse and unauthorised access. --- ## 3. How long we keep data | Data | How long | |---|---| | Technical request logs ([Cloudflare Workers Logs](https://developers.cloudflare.com/workers/observability/logs/workers-logs/)) | 7 days, then deleted automatically | | Search queries and tasks in those logs | As above | | Google Analytics (only if you accept) | 14 months | | Emails you send us | Up to 24 months after your request is resolved, unless needed longer for a legal claim | | Listing data | While the Listing appears in a public source we read, plus 3 days; health-check results for 30 days | | Raw copies of public catalogues (for auditing our data) | 12 months, then deleted automatically | --- ## 4. Sharing and international transfers We **do not sell** personal data and do not "share" it for cross-context behavioural advertising (as those terms are used in the CCPA/CPRA). We share personal data only with: 1. **Service providers (processors)** who host and run the Service for us under contract: - **Cloudflare, Inc.**: hosting, content delivery, security, storage, logs and AI processing. - **Google LLC / Google Ireland Limited**: Google Analytics, only if you accept analytics cookies. - **Titan (Titan Labs)**: email, for messages sent to hello@hagglyai.com. 2. **Authorities or others** where required by law, or where needed to protect our rights, users or the public. 3. **A buyer or successor** if Hagglyai is reorganised, merged or sold, subject to this policy. **International transfers.** Our providers may process data outside the UK or the European Economic Area, including in the United States. Where they do, we rely on appropriate safeguards such as the **EU-US Data Privacy Framework (and its UK Extension)** or **Standard Contractual Clauses**. **AI training.** We do not use personal data, search queries or tasks to train AI models, and we do not allow our processors to do so (see Cloudflare's [responsible AI](https://www.cloudflare.com/trust-hub/responsible-ai/) commitments). --- ## 5. Your rights ### 5.1 Everyone You can ask us at any time for access to, correction of, or deletion of personal data we hold about you, using the contact details in section 7. Because we have no accounts, we usually cannot link logs to you unless you give us details such as the approximate date, time and IP address of your request. We may need to verify your identity before acting on a request. ### 5.2 UK, EEA and Swiss residents (GDPR) You have the right to: - **access** your personal data and get a copy; - **rectify** inaccurate data; - **erase** your data ("right to be forgotten"); - **restrict** our processing; - **object** to processing based on our legitimate interests, including the processing of Listing data; - **data portability**, where processing is based on consent or contract and carried out by automated means; - **withdraw consent** at any time, where we rely on consent (analytics cookies), without affecting earlier processing; and - **complain** to a supervisory authority, such as the UK **Information Commissioner's Office (ico.org.uk)** or the authority where you live or work. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Our rankings rate APIs, not people. We respond within **one month**, which we may extend by two further months for complex requests. ### 5.3 California residents (CCPA/CPRA) You have the right to: - **know** the categories and specific pieces of personal information we collect, use and disclose (described in this policy); - **delete** personal information we hold about you; - **correct** inaccurate personal information; - **opt out of the sale or sharing** of personal information. We do not sell or share personal information, so there is nothing to opt out of; and - **non-discrimination** for exercising these rights. You can use an authorised agent to make a request; we may ask for proof of their authority. We respond within **45 days**. ### 5.4 How to make a request Email hello@hagglyai.com with "Privacy request" in the subject line and say which right you want to use. There is no charge. --- ## 6. If you are an API provider If your API, actor or MCP server is listed and you want us to correct or remove information about it, or you object to our processing of personal data in a Listing, email hello@hagglyai.com with the URL of the Listing. We will correct factual errors and consider removal or objection requests in line with section 5. --- ## 7. Contact **Privacy enquiries:** hello@hagglyai.com --- ## 8. Children The Service is for developers and businesses. It is not directed at children, and we do not knowingly collect personal data from anyone under **16**. If you believe a child has sent us personal data, contact us and we will delete it. --- ## 9. Changes to this policy We may update this policy when the Service or the law changes. We will post the new version on this page and change the "Last updated" date. If a change is material, we will give reasonable notice on the Service before it takes effect.