What this addendum covers
api.alura.io: the REST API, used with API keys.mcp.alura.io: the MCP server, used by AI clients such as Claude, ChatGPT and Cursor.auth.alura.io: the OAuth service that connects AI clients to your Alura account.- The API pages in Alura settings on platform.alura.io: API keys, API usage, connected apps and the OAuth consent screen.
docs.alura.io: this documentation site.
What we collect when you use the API
Your account and workspace
The API uses the Alura account you already have. When you sign in to approve an AI client or to manage API keys, platform.alura.io checks your sign-in with Firebase Authentication. The API then works with your Alura user ID, your workspace ID, your role in the workspace and the workspace’s plan. It does not ask for any new personal details. When an AI client signs up a person who has no workspace yet, we create a Free workspace for them. To stop people from farming free workspaces, we record one row per person: a normalized form of the email address (lower case, and for Gmail without dots or a+tag), the IP address, the IP network, and when the claim was made. We keep these rows with no end date today. [OWNER TO CONFIRM: a retention period. Cutting the IP address after 30 days is planned and not built.]
API keys
We never store an API key itself. We store a SHA-256 hash of it, the first characters for display (such asalura_sk_ and 8 more characters), its name, its scopes, the workspace, the user who created it, and when it was created, last used, rotated, expired or revoked. Key rows stay after a key is revoked so the security record stays complete. [OWNER TO CONFIRM: a retention period for revoked keys.]
If GitHub finds one of your keys in public code, GitHub sends us the key and the URL where it found it. We revoke the key at once, email the workspace owners and the key’s creator, and record the event. We answer GitHub with a hash of the key, never the key.
OAuth grants and tokens
When you connect an AI client, you approve a grant on platform.alura.io. The grant lets that one client act for you in your workspaces, one current workspace at a time, with the scopes you approved.
The consent screen selects all four scopes by default. You can see which ones you approve before you continue.
What we store and for how long:
An access token carries the grant ID, the client ID, the scopes and your Alura user ID. It does not carry your email address or your workspace. The API looks up the grant’s current workspace and your membership on every request, so a grant stops working in a workspace as soon as you leave it.
When you approve a grant, we email every owner of the workspace it starts in. The first time a grant switches into another workspace, we email that workspace’s owners too.
Request logs
Every authenticated request to the API or the MCP server writes one row to our request log. That includes requests we refuse for rate limits and replays of earlier requests. A row holds:
The request log never holds request headers, API keys, tokens, cookies, search terms or other query parameters, or response bodies.
How long we keep it. The log is stored in calendar months. We delete a month once it ended more than three full calendar months ago. Each row is therefore kept for at least three months and at most about four months. Truncating IP addresses after 30 days and deleting old months both run in a daily job.
Who sees it. Alura staff with access to the production database, for support, billing questions, security and abuse review. [OWNER TO CONFIRM: which staff roles have this access.] Workspace owners and admins see daily counts of calls, errors and average response times for their workspace on the API page in settings. Nobody outside Alura sees IP addresses, networks or user agents.
Usage events and the API credit ledger
Every charge of API credits is recorded in our API credit ledger: the workspace, the operation, the API credits, the client, the API key ID if a key made the call, the request ID, and the product, shop or keyword the call returned. The ledger is the billing record of API credits.GET /v1/usage/events shows each charge from the last 90 days to the workspace, with the same fields. GET /v1/usage and GET /v1/usage/by-day show totals. Any API key or grant with the usage:read scope can read them, and so can owners and admins in settings.
We keep the ledger with no end date today. [OWNER TO CONFIRM: a retention period, which may depend on bookkeeping rules.]
Security audit events
We record security events: API keys created, rotated, revoked or revoked automatically; grants created or revoked; workspaces removed from a grant; every consent; workspace switches; Free workspaces created; and consent refused during a support session. Each event holds the time, the action, who did it (a user ID, an operator or the system), the workspace, the key or grant, the IP address, the user agent, and details such as the client, its redirect address and the scopes. These events cannot be edited or deleted by the API. The plan is to keep them for one year. [OWNER TO CONFIRM: nothing deletes them yet, and the IP address in them is not truncated.]Load balancer and server logs
Google Cloud’s load balancer in front of the API, the MCP server and the OAuth service logs every request: the full URL including query parameters, the IP address, the user agent, the status and the time taken. A query parameter can hold a search term, a keyword or an Etsy link you looked up. Our services also write operational log lines, such as alerts. Google Cloud Logging keeps these logs for 30 days (checked 2026-10-15). Alura staff with access to the Google Cloud project can read them.Error reports
When the API fails with an internal error, it sends one report to Sentry: the error type, its message, the stack trace, the request ID and the operation or tool. Reports never include request headers, the request body, the path or query parameters. We remove anything that looks like an API key, a bearer token or a cookie before sending. [OWNER TO CONFIRM: Sentry’s retention period and data region for this project.]Cached data and rate limits
We keep short-lived data in Upstash Redis databases: request counters for rate limits, which expire within minutes; the enumeration throttle’s record of which shops and products a workspace opened in the last hour; and copies of research results for up to 5 minutes. The OAuth service has its own Redis database, separate from the API’s (see the table above).Saved research
Folders, lists and saved items you create through the API are the same saved research you see in the Alura app, and the Privacy Policy covers them. A folder or list is visible to everyone in the workspace, or only to the person who created it. An API key acts as the person who created it, so it sees that person’s private lists.Data about other people: Etsy shops and reviews
Research data comes from public Etsy pages and Etsy’s API: products, shops, reviews and keywords. Some of it is about people: a shop name can be a person’s name, and a review is written by a buyer.- We never return buyer names, buyer IDs, transaction IDs or shop owner names.
- Review text, review photos and shop announcements are returned as written. They can contain personal details that the writer chose to post on Etsy.
- A shop that asked Alura not to track it is never returned. A direct request for it gets
404 shop_opted_out. The rule applies to every request, from the moment the opt-out is recorded. - To opt a shop out, or to ask about data about you in Etsy research data, write to [OWNER TO CONFIRM: the contact for opt-outs and data requests].
- [OWNER TO CONFIRM: how quickly a review removed on Etsy stops being served. No rule for this exists yet.]
What your AI client receives
When you connect Claude, ChatGPT, Cursor or another MCP client, the client sends us tool calls and we send back results. The client’s provider receives those results and processes them under its own terms and privacy policy, not ours. Results can include:- Etsy research data: product and shop details, sales estimates, keywords and trends;
- review text and review photos written by buyers, and shop announcements written by sellers;
- your saved folders and lists, with their names and items;
- the names and plans of your workspaces, if you belong to more than one;
- your workspace’s API credit usage.
- Claude: Anthropic’s privacy policy
- ChatGPT: OpenAI’s privacy policy
- Cursor: Cursor’s privacy policy
How to stop access
- Revoke a grant you made: in Alura, open Settings, then Connected apps, and revoke it. The client’s next call gets
401, and its refresh token stops working. - Remove a grant from your workspace: owners and admins open Settings, then API. Under Connected apps, remove any member’s grant from the workspace. It stops working in this workspace at once and can never switch back to it.
- Revoke an API key: owners and admins open Settings, then API, and revoke the key. It stops working within about a second.
- You can also remove Alura in the AI client’s own settings. That stops the client from calling us. Revoke the grant in Alura as well, so the grant cannot be used again.
Who receives data
Claude, ChatGPT, Cursor and other AI clients are not on this list. They receive data because you connect them, as described in “What your AI client receives”.
Some of these recipients are in the United States. [OWNER TO CONFIRM: the transfer safeguard for each, such as the EU-US Data Privacy Framework or standard contractual clauses, and whether a data processing agreement is signed with each.]
Why we process this data
[OWNER TO CONFIRM with legal review. Proposed legal bases:]- To provide the API and MCP server you asked for: performance of our contract with you.
- To keep the service secure, stop scraping and abuse, and protect our Etsy API access: our legitimate interests.
- To keep billing records of API credits: our legitimate interests, and legal obligations where bookkeeping law applies.
- To serve research data from public Etsy pages that mentions people: our legitimate interests, balanced by leaving out buyer and owner identities and by honoring shop opt-outs.
Your rights
Your rights are listed in the Privacy Policy under “Your rights”. They cover this data too. To use them, write to hello@alura.io. Workspace owners and admins can see their workspace’s usage in settings and throughGET /v1/usage/events.