Privacy
policy.

This Privacy Policy explains how api-fortnite.com (“we,” “our,” or “us”), operated by Yael BRINKERT, collects, uses, and protects your personal data, in accordance with the EU General Data Protection Regulation (GDPR) and French law.

When you create an account and use the Service, we collect:

• Account data from Discord (via Better Auth / Discord OAuth): your Discord username, email address, and avatar image, plus the OAuth tokens needed to authenticate you.
• Billing references: your Stripe customer ID and subscription ID. Card details are handled exclusively by Stripe — we never see or store full card numbers.
• Service data: your API keys (stored hashed) and daily usage counters (request counts, parsing credits used).
• Technical data: session information including IP address and browser user-agent, used for security and session management.

We do not collect passwords (authentication is delegated to Discord) and we do not collect any data beyond what is listed above. We do not knowingly collect data from children under 15.

We use your data to (with the corresponding GDPR legal basis):

• Provide and secure access to our API and website — performance of a contract (Art. 6(1)(b)).
• Manage subscriptions, payments, and invoicing — performance of a contract and legal obligations (Art. 6(1)(b) and (c)).
• Prevent fraud and abuse (rate limiting, quota enforcement, account security) — legitimate interest (Art. 6(1)(f)).
• Improve performance and reliability using aggregated, cookieless analytics — legitimate interest (Art. 6(1)(f)).

We do not sell or rent your personal data to anyone.

We only use strictly necessary cookies for session management and authentication (Better Auth). These do not require consent under EU rules. Our analytics (Vercel Analytics) are cookieless and do not track you across sites. If we ever introduce advertising or non-essential cookies, we will ask for your consent first.

Your data is processed by the following providers:

• Vercel Inc. (USA) — hosting of the website/frontend and cookieless analytics. Transfers are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.
• Infomaniak Network SA (Switzerland) — hosting of the API and the main database. Switzerland benefits from an EU adequacy decision.
• Stripe — payment processing, under its own privacy policy.
• Discord Inc. — authentication provider (OAuth). Discord only shares with us the data listed in Section 1.

Our domain name is registered through Hostinger, which does not process user personal data. Separately, we maintain an archive of purely technical, non-personal data (e.g. historical game data) on self-hosted infrastructure; it contains no personal information — no names, email addresses, or payment references.

• Account and service data: kept as long as your account exists, then deleted when you delete your account or ask us to.
• Sessions: expire automatically and are removed after expiry.
• Billing and invoicing records: retained for the duration required by French accounting law (up to 10 years), even after account deletion.

All traffic is encrypted with SSL/TLS. API keys are stored hashed, and the database is hosted on secured infrastructure at Infomaniak (Switzerland). However, no online service is 100% secure; in the event of a data breach affecting your personal data, we will notify the CNIL and affected users as required by the GDPR.

You have the right to:

• Access, correct, or delete your personal data
• Receive a copy of your data in a portable format
• Restrict or object to certain processing
• Withdraw consent where processing is based on consent
• Lodge a complaint with the French supervisory authority (CNIL, www.cnil.fr) or your local authority

To exercise these rights, contact us at support@api-fortnite.com or on Discord. We respond within one month.

We may update this policy periodically. The latest version will always be available on this page, with the date of the last update shown at the top.