Privacy Policy

Last updated: 27 October 2026

1. Who is responsible

The data controller is Alessio Bussolari · Via del Prete 121, 47841 Cattolica (RN) · VAT no. 02037590383.

Contact: [email protected].

This policy covers the website proxanything.com and the proxanything API gateway.

2. What we process

• Account data. Name and email address of the people who use the dashboard. Passwords are stored only as a hash.
• API keys. The key, its status and the services it can use.
• Request metrics. For each API call: service, path, HTTP method, status code, upstream response time, time of the call, the API key and the email of its owner. We do not store your IP address or the request content in these metrics. We keep only a sample of successful calls, plus hourly totals.
• AI requests. POST /ai/* calls go through a queue. We store the request body, the response body, the callback URL, token counts and timings, so we can deliver the result.
• Webhook calls. When you pass webhook_url, we keep the request and the webhook address in our job queue until delivery.
• Dashboard sessions. IP address and browser user agent at login.
• Technical logs. Our application logs record path, status, duration, service and key owner. Our proxy and load balancer may record your IP address. Error reports go to our own error tracker, with emails and secrets removed.

3. Data inside your requests

Your requests may contain personal data, for example text, audio or TikTok usernames.

For that content you are the controller. We act as your processor and use it only to run the request you asked for. A data processing agreement is available on request.

4. Why we process it

• To provide the service you asked for: issue keys, route requests, deliver results. Legal basis: contract (Art. 6(1)(b) GDPR).
• To keep the service safe: stop abuse, enforce limits, fix errors, plan capacity. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• To meet legal duties, such as invoicing and tax records. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

5. How long we keep it

• Metrics of successful calls: 7 days.
• Metrics of failed calls: 30 days.
• Hourly totals per key: 400 days.
• AI request and response bodies: removed after 3 days (success) or 30 days (failure). The rest of the record is deleted after 30 or 90 days.
• Finished queue jobs, including webhook calls: 7 days.
• Technical logs: up to 30 days.
• Dashboard sessions (IP address and user agent): until you log out, reset your password or the account is deleted.
• Account data and API keys: while the account is active, then deleted.
• Invoices and tax records: 10 years, as Italian law requires.

6. Who receives it

• Hetzner Online GmbH (Germany): servers, database and load balancer. Data stays in the EU.
• RunPod (Runpod, Inc., United States): GPU servers for /ai, /embed and /stt. They receive the content of those requests.
• TikWM (tikwmapi.com): upstream provider for /tiktok. TikWM does not publish its legal name or address. Its domain is registered from Beijing, China, so we treat it as located in China; its site is delivered through Cloudflare, Inc. (United States). For each /tiktok request it receives only the path and parameters you send, for example the TikTok link, video ID or username you ask about, with the Content-Type and Accept headers, our TikWM key and a fixed user agent (proxanything). It never receives your IP address, your user agent, your API key, cookies, authorization or other headers.
• Your own endpoints: results sent to the webhook or callback URL you choose.
• Provider of a file loaded by your browser on the dashboard: see section 7.

For RunPod we forward your request headers, except your API key. They may include your user agent and your IP address (X-Forwarded-For).

We do not sell data and we do not use it for advertising.

7. Transfers outside the EU

RunPod (Runpod, Inc., United States): the transfer relies on the Standard Contractual Clauses approved by the European Commission, included in RunPod's data processing agreement.

TikWM (China, see section 6): China has no adequacy decision. We have no data processing agreement, no Standard Contractual Clauses and no other safeguard of Art. 46 GDPR with TikWM. Data reaches TikWM only when you, or the application that uses your API key, call /tiktok: each call is started by you, one request at a time, and carries only the path and parameters you put in it (see section 6). We never send TikWM data that identifies you: no IP address, no user agent of yours, no account data, no email, no API key, no metrics. If you do not accept this, do not use /tiktok, and do not put in your requests personal data of other people that you may not share with a provider in China.

Files loaded by your browser. The public pages and the API docs page load their fonts, styles and scripts only from our own server. The dashboard, used only by customers, makes your browser download its chart library from this provider. To deliver the file, it receives your IP address, your browser user agent and the address of the page:

• cdn.jsdelivr.net (charts of the dashboard): Volentio JSD Limited, United Kingdom, covered by the European Commission adequacy decision for the United Kingdom. The files are delivered by Cloudflare, Inc. and Fastly, Inc. (United States, both certified under the EU-US Data Privacy Framework), and by BunnyWay d.o.o. (Slovenia) and G-Core Labs S.A. (Luxembourg) inside the EU.

We send this provider no other data. It uses what it receives under its own privacy policy.

You can ask for a copy of the safeguards for these transfers by writing to [email protected].

8. Your rights

You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. Write to [email protected]. We reply within one month.

You can also complain to the Italian data protection authority: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it.

9. Cookies

The public pages of this site set no cookies and use no analytics.

They load their fonts, styles and scripts from our own server, so your browser contacts no third party when you read them.

The dashboard and the job queue pages, used only by customers, set strictly necessary cookies: session_id (dashboard login), api_key_token (job queue login) and _proxanything_session (security token for forms, short messages and the page to open after login; it has no set expiry and normally ends when you close the browser). The two login cookies have a technical expiry of 20 years, so they keep you signed in until you log out. The server can end them earlier. The dashboard session is deleted on the server when you log out, when you reset your password or when the account is deleted: the cookie stops working at once. The job queue cookie stops working, at the latest within 5 minutes, when its API key is deactivated or the account is deleted. These cookies need no consent.

10. Changes

We may update this policy. The date at the top shows the latest version. We will tell customers by email about important changes.