> ## Documentation Index > Fetch the complete documentation index at: https://docs.alura.io/llms.txt > Use this file to discover all available pages before exploring further. # Privacy policy: API and MCP addendum > What the Alura API, the MCP server and the OAuth service collect, how long we keep it, who receives it, and what goes to your AI client. This addendum adds to the [Alura Privacy Policy](https://www.alura.io/privacy-policy). The Privacy Policy covers the Alura website, app and Chrome extension. This addendum covers the Alura API and MCP server. Where the two differ for the API and MCP server, this addendum applies. Alura is operated by Net Ventures AS, Oslo, Norway ("Alura", "we", "us"). Net Ventures AS is the controller of the personal data described here. Contact: [hello@alura.io](mailto:hello@alura.io), for privacy questions, requests and our postal address. Help center: [https://alura.io/help](https://alura.io/help). ## What this addendum covers * `api.alura.io`: the REST API, used with API keys. * `mcp.alura.io`: the MCP server, used by AI clients such as Claude, ChatGPT and Cursor. * `auth.alura.io`: the OAuth service that connects AI clients to your Alura account. * The API pages in Alura settings on platform.alura.io: API keys, API usage, connected apps and the OAuth consent screen. * `docs.alura.io`: this documentation site. "Workspace", "API key", "grant", "client" and "API credits" mean what they mean in the [API terms of use](/legal/api-terms). ## What we collect when you use the API ### Your account and workspace The API uses the Alura account you already have. When you sign in to approve an AI client or to manage API keys, platform.alura.io checks your sign-in with Firebase Authentication. The API then works with your Alura user ID, your workspace ID, your role in the workspace and the workspace's plan. It does not ask for any new personal details. When an AI client signs up a person who has no workspace yet, we create a Free workspace for them. To stop people from farming free workspaces, we record one row per person: a normalized form of the email address (lower case, and for Gmail without dots or a `+tag`), the IP address, the IP network, and when the claim was made. We keep these rows while your account is active and for up to 12 months after it is closed, unless the law requires us to keep them longer. ### API keys We never store an API key itself. We store a SHA-256 hash of it, the first characters for display (such as `alura_sk_` and 8 more characters), its name, its scopes, the workspace, the user who created it, and when it was created, last used, rotated, expired or revoked. Key rows stay after a key is revoked so the security record stays complete. We keep them while the workspace is active and for up to 12 months after it is closed, unless the law requires us to keep them longer. If GitHub finds one of your keys in public code, GitHub sends us the key and the URL where it found it. We revoke the key at once, email the workspace owners and the key's creator, and record the event. We answer GitHub with a hash of the key, never the key. ### OAuth grants and tokens When you connect an AI client, you approve a grant on platform.alura.io. The grant lets that one client act for you in your workspaces, one current workspace at a time, with the scopes you approved. | Scope | What it allows | | - | - | | `research:read` | Read Etsy research data: products, shops, reviews, keywords, categories, trending and sales history | | `saved:read` | Read the saved folders and lists you can see in the workspace | | `saved:write` | Create, rename, move and delete saved folders and lists, and add or remove items | | `usage:read` | Read the workspace's API credit usage | The consent screen selects all four scopes by default. You can see which ones you approve before you continue. What we store and for how long: | Item | Where | How long | | - | - | - | | The grant: your user ID, the client, the scopes, the current workspace, the workspaces it covers, and when it was created, last used and revoked | Our database | Until you or a workspace owner revokes it. After that, kept as a security record while your account is active and for up to 12 months after it is closed, unless the law requires longer. | | The client: its ID, its kind (Claude, ChatGPT, Cursor or other) and its registration details, such as redirect addresses | Our database | For as long as any grant uses it. A client that registers itself and is never used is deleted after 24 hours. | | Access tokens | Not stored. They are signed tokens that the AI client holds. | Each one expires after 15 minutes. | | Refresh tokens | The OAuth service's own Redis database | 30 days. Each refresh replaces the token with a new one. If a used refresh token is ever presented again, we revoke the whole grant. | | Authorization codes | The OAuth service's Redis database | 60 seconds, single use | | The sign-in step between platform.alura.io and the OAuth service | Our database and the OAuth service's Redis database | The handoff code is stored only as a hash and works once, within 60 seconds. The sign-in session lasts 10 minutes. The handoff record (your user ID, the workspace, the client and the scopes) is kept like the grant's security record. | An access token carries the grant ID, the client ID, the scopes and your Alura user ID. It does not carry your email address or your workspace. The API looks up the grant's current workspace and your membership on every request, so a grant stops working in a workspace as soon as you leave it. When you approve a grant, we email every owner of the workspace it starts in. The first time a grant switches into another workspace, we email that workspace's owners too. ### Request logs Every authenticated request to the API or the MCP server writes one row to our request log. That includes requests we refuse for rate limits and replays of earlier requests. A row holds: | Field | Notes | | - | - | | Time and request ID | The request ID is the `req_` value in the `Request-Id` response header | | Workspace and plan | | | API key ID, or OAuth client ID and grant ID | Never the key or token itself | | Client | `claude`, `chatgpt`, `cursor`, `other` or `script` | | REST or MCP, the operation, and the MCP tool and method | Such as `research.products.search` or `search_products` | | Status, error code, time taken and API credits charged | | | Whether the workspace was throttled, and whether the request was a replay | | | IP address | Cut to its network (the first 24 bits of an IPv4 address, the first 48 of IPv6) after 30 days | | Network (ASN) | The internet provider's network number, from our load balancer | | User agent | The first 512 characters. Anything that looks like an API key is removed. | | The product or shop in the request path | Such as the shop whose reviews you asked for | | Page depth, and the ID of the first request of a run through pages | So we can see a walk through results without storing the search itself | | How many fetches the request left pending | | | Selected request body fields | Only fields we list one by one for each operation. Today: the scopes of a new API key, and the workspace ID of a workspace switch. Never a key name. | The request log never holds request headers, API keys, tokens, cookies, search terms or other query parameters, or response bodies. **How long we keep it.** The log is stored in calendar months. We delete a month once it ended more than three full calendar months ago. Each row is therefore kept for at least three months and at most about four months. Truncating IP addresses after 30 days and deleting old months both run in a daily job. **Who sees it.** Alura staff with access to the production database, for support, billing questions, security and abuse review. Only staff who need it for that work have this access. Workspace owners and admins see daily counts of calls, errors and average response times for their workspace on the API page in settings. Nobody outside Alura sees IP addresses, networks or user agents. ### Usage events and the API credit ledger Every charge of API credits is recorded in our API credit ledger: the workspace, the operation, the API credits, the client, the API key ID if a key made the call, the request ID, and the product, shop or keyword the call returned. The ledger is the billing record of API credits. `GET /v1/usage/events` shows each charge from the last 90 days to the workspace, with the same fields. `GET /v1/usage` and `GET /v1/usage/by-day` show totals. Any API key or grant with the `usage:read` scope can read them, and so can owners and admins in settings. We keep the ledger while the workspace is active and for up to 60 months after it is closed, unless the law requires us to keep it longer. Bookkeeping law can require billing records for several years. ### Security audit events We record security events: API keys created, rotated, revoked or revoked automatically; grants created or revoked; workspaces removed from a grant; every consent; workspace switches; Free workspaces created; and consent refused during a support session. Each event holds the time, the action, who did it (a user ID, an operator or the system), the workspace, the key or grant, the IP address, the user agent, and details such as the client, its redirect address and the scopes. These events cannot be edited or deleted by the API. We keep them while the workspace is active and for up to 12 months after it is closed, unless the law requires us to keep them longer. ### Load balancer and server logs Google Cloud's load balancer in front of the API, the MCP server and the OAuth service logs every request: the full URL including query parameters, the IP address, the user agent, the status and the time taken. A query parameter can hold a search term, a keyword or an Etsy link you looked up. Our services also write operational log lines, such as alerts. Google Cloud Logging keeps these logs for 30 days (checked 2026-10-15). Alura staff with access to the Google Cloud project can read them. ### Error reports When the API fails with an internal error, it sends one report to Sentry: the error type, its message, the stack trace, the request ID and the operation or tool. Reports never include request headers, the request body, the path or query parameters. We remove anything that looks like an API key, a bearer token or a cookie before sending. Sentry stores the reports in the United States and keeps them for up to 90 days. ### Cached data and rate limits We keep short-lived data in Upstash Redis databases: request counters for rate limits, which expire within minutes; the enumeration throttle's record of which shops and products a workspace opened in the last hour; and copies of research results for up to 5 minutes. The OAuth service has its own Redis database, separate from the API's (see the table above). ### Saved research Folders, lists and saved items you create through the API are the same saved research you see in the Alura app, and the Privacy Policy covers them. A folder or list is visible to everyone in the workspace, or only to the person who created it. An API key acts as the person who created it, so it sees that person's private lists. ## Data about other people: Etsy shops and reviews Research data comes from public Etsy pages and Etsy's API: products, shops, reviews and keywords. Some of it is about people: a shop name can be a person's name, and a review is written by a buyer. * We never return buyer names, buyer IDs, transaction IDs or shop owner names. * Review text, review photos and shop announcements are returned as written. They can contain personal details that the writer chose to post on Etsy. * A shop that asked Alura not to track it is never returned. A direct request for it gets `404 shop_opted_out`. The rule applies to every request, from the moment the opt-out is recorded. * To opt a shop out, or to ask about data about you in Etsy research data, write to [hello@alura.io](mailto:hello@alura.io). * If a review has been removed from Etsy and Alura still serves it, write to [hello@alura.io](mailto:hello@alura.io). We stop serving it within 30 days of your request. ## What your AI client receives When you connect Claude, ChatGPT, Cursor or another MCP client, the client sends us tool calls and we send back results. The client's provider receives those results and processes them under its own terms and privacy policy, not ours. Results can include: * Etsy research data: product and shop details, sales estimates, keywords and trends; * review text and review photos written by buyers, and shop announcements written by sellers; * your saved folders and lists, with their names and items; * the names and plans of your workspaces, if you belong to more than one; * your workspace's API credit usage. Results never include your email address. Request IDs and API credits charged go in the result's metadata for the client, not in the text the model reads. The provider's terms decide how long it keeps your conversations and whether it uses them to train models. Check them, and your settings with each provider: * Claude: [Anthropic's privacy policy](https://www.anthropic.com/legal/privacy) * ChatGPT: [OpenAI's privacy policy](https://openai.com/policies/privacy-policy) * Cursor: [Cursor's privacy policy](https://cursor.com/privacy) A script you run with an API key receives the same data. Where it goes next is up to you. ## How to stop access * **Revoke a grant you made:** in Alura, open **Settings**, then **Connected apps**, and revoke it. The client's next call gets `401`, and its refresh token stops working. * **Remove a grant from your workspace:** owners and admins open **Settings**, then **API**. Under **Connected apps**, remove any member's grant from the workspace. It stops working in this workspace at once and can never switch back to it. * **Revoke an API key:** owners and admins open **Settings**, then **API**, and revoke the key. It stops working within about a second. * You can also remove Alura in the AI client's own settings. That stops the client from calling us. Revoke the grant in Alura as well, so the grant cannot be used again. Leaving a workspace removes it from your grants, and revokes the API keys you created there. ## Who receives data | Recipient | What for | What they receive | | - | - | - | | Google Cloud (Google LLC) | Hosting: servers, database, load balancer, logs and secrets, in the us-central1 region (Iowa, USA) | Everything described on this page | | Google Firebase Authentication | Sign-in on platform.alura.io | Your sign-in, under the Privacy Policy | | Vercel | Hosts platform.alura.io, including the consent screen and the API settings pages | Your session, IP address and the settings you change | | Upstash | Redis databases for rate limits, the research cache and OAuth sessions and refresh tokens | Counters, cached research results, OAuth session data | | Resend | Security emails to workspace owners | Recipient addresses, the workspace name, the app or key concerned | | Sentry | Error reports | As described under "Error reports" | | Slack | Our internal alerts | Workspace IDs, API key IDs, and for abuse alerts an IP address, IP network or network number | | Mintlify | Hosts docs.alura.io | Visits to the documentation: pages viewed, IP address and browser details, for usage statistics | | GitHub | Secret scanning | Hashes of keys GitHub reported to us | Claude, ChatGPT, Cursor and other AI clients are not on this list. They receive data because you connect them, as described in "What your AI client receives". Some of these recipients are in the United States. Each processes personal data for us under its data processing terms. Where data leaves the EEA, the transfer relies on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses. ## Why we process this data We rely on these legal bases under the GDPR: * To provide the API and MCP server you asked for: performance of our contract with you. * To keep the service secure, stop scraping and abuse, and protect our Etsy API access: our legitimate interests. * To keep billing records of API credits: our legitimate interests, and legal obligations where bookkeeping law applies. * To serve research data from public Etsy pages that mentions people: our legitimate interests, balanced by leaving out buyer and owner identities and by honoring shop opt-outs. ## Your rights Your rights are listed in the Privacy Policy under "Your rights". They cover this data too. To use them, write to [hello@alura.io](mailto:hello@alura.io). Workspace owners and admins can see their workspace's usage in settings and through `GET /v1/usage/events`. ## Security contact Report a security problem to [security@alura.io](mailto:security@alura.io). If you find an Alura API key in public, report it there too. Keys found by GitHub's secret scanning are revoked automatically. ## Changes We change this addendum the same way as the Privacy Policy. We tell workspace owners by email before a significant change takes effect. Last updated: October 16, 2026 This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.