Privacy

Bosco Labs runs this website and the HTTP API at https://api.boscolabs.dev. We collect as little as we can. Contact for anything below, including access and deletion requests: support@boscolabs.dev.

API calls

What we log, one line per call: a key id, the tool, the HTTP status, the number of rows, the credits charged, the duration and any source warnings.
What we never log or store: request bodies and results. The names you screen with sanctions-screening and the companies or laws you look up are processed only to answer the call and are never stored.
Keys are stored only as a SHA-256 hash; we cannot show a key again.
The credit ledger keeps, per key: the tool, the rows charged and the time, so your balance and our accounts add up.

Accounts and payments

To issue a key we store your e-mail address and send you a one-time link. To limit abuse of the free trial we keep a daily-salted hash of the sign-up IP address, never the address itself.
When you buy credits, Stripe handles the payment. We keep your e-mail address, the Stripe customer id, the billing country and a VAT ID if you give one; never card details.

This website

No cookies and no third-party trackers. Vercel Web Analytics counts page views without cookies and without storing IP addresses.

Processors

Vercel: hosting of the website and the API, and request logs.
Supabase: the database with keys (hashed), e-mail addresses and the credit ledger (EU region, Ireland).
Stripe: payments.
Resend: the e-mails that deliver your key link.

Retention

API request logs: only as long as Vercel keeps runtime logs (days, not months).
E-mail address, hashed key and ledger: while your key exists; ask us to delete them. Payment records: as long as bookkeeping and tax law require (seven years in the Netherlands).
Sign-up IP hashes: only for the daily sign-up limit.

Data in the results

Some tools return personal data that official sources publish, such as the names of sanctioned persons, company officers or insiders in SEC filings. We return it unchanged, with a link to its source, for compliance, research and due-diligence purposes, and limit how much a single call returns.

Last updated 2026-11-06.