Privacy
This notice explains how Soniverse GmbH (“we”, “us”) processes personal data in connection with Soni API (the website, documentation, registration, and API endpoints). It is intended to meet transparency duties under the EU General Data Protection Regulation (GDPR) and the German BDSG.
1. Controller
Soniverse GmbH
Lindenstraße 3
91361 Pinzberg
Germany
Email: info@soniverse.de
Phone: +49 (0) 9191 71873-0
See also the Imprint.
2. What we process
2.1 Account registration
- First name and last name
- Email address
- Password (stored only as a one-way hash; we cannot read your plaintext password)
- Account and API-key metadata (identifiers, description, creation time, plan/rate-limit settings, per-endpoint permissions)
- API key secrets stored as an HMAC for authentication and additionally encrypted so you can redisplay them in your account after login
-
Cloudflare Turnstile challenge response (verified server-side for web registration at
/register and for programmatic registration at
POST /api/registervia theturnstileTokenfield; Cloudflare may process connection metadata as described in their privacy notice)
Purpose: create and administer your account, authenticate API access, prevent automated abuse, communicate about the Service where necessary.
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract / pre-contractual steps) and, for the bot-protection challenge, Art. 6 (1) (f) GDPR (legitimate interest in securing registration against abuse).
2.2 Account login (session)
After registration you may log in with email and password. We store a session cookie that is strictly necessary to keep you signed in while you manage API keys on /login and /account,
and briefly for form flash messages (for example validation errors on /register).
Failed login attempts may be rate-limited to reduce credential stuffing.
Legal basis: Art. 6 (1) (b) GDPR and, for login abuse prevention, Art. 6 (1) (f) GDPR.
2.3 API usage logs
When you call protected endpoints we log, for abuse prevention, security, and product analytics:
- User id and API key id (not the raw API key)
- Endpoint path and HTTP method
- Timestamp and latency
- Target URL you submitted (length-capped)
- Outcome and HTTP status
- Hashed client IP (HMAC; not stored in clear text) and truncated User-Agent
We do not store full HTML bodies of checked pages by default, raw API keys, or Authorization header values.
Legal basis: Art. 6 (1) (b) GDPR (providing the Service) and Art. 6 (1) (f) GDPR (legitimate interest in securing the Service, preventing abuse, and understanding aggregate product usage).
2.4 Public aggregate statistics
We publish non-identifying aggregates on /stats (e.g. request counts, outcome distribution, average latency, count of API keys that have made requests). That page does not expose emails, target URLs, IP hashes, User-Agents, or API keys.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in transparent operation of a public utility API).
2.5 Server and delivery logs
Our hosting and reverse-proxy infrastructure may process connection metadata (IP address, time, requested URL, status code, User-Agent) as technically necessary to operate and secure the Service. Retention depends on the hosting setup and is limited to what is required for those purposes.
Legal basis: Art. 6 (1) (f) GDPR (IT security and reliable delivery).
3. Cookies and similar technologies
The public marketing and documentation pages of Soni API do not set analytics or advertising cookies. Viewing /stats does not set analytics cookies. Strictly necessary cookies may be used by the application framework only when a feature requires them (for example a session cookie for login, account management, or form flash messages). The registration page (/register) loads Cloudflare Turnstile, which may set cookies or similar storage on Cloudflare’s domains as part of the challenge. If we introduce non-essential cookies or third-party tracking later, we will update this notice and obtain consent where required (e.g. TTDSG / ePrivacy). Web fonts are self-hosted on this origin (no Google Fonts requests from visitors’ browsers).
4. Recipients and processors
Personal data may be processed by IT service providers that host, store, or transmit the Service on our behalf (e.g. hosting, database, email), bound by contracts under Art. 28 GDPR where applicable. Cloudflare, Inc. processes Turnstile challenge data as a processor / sub-processor for bot protection on registration. We do not sell your personal data.
5. Transfers outside the EU/EEA
We aim to process data in the EU/EEA. If a provider processes data outside the EU/EEA, we will ensure an appropriate safeguard (e.g. adequacy decision or Standard Contractual Clauses) as required by GDPR.
6. Retention
- Account data: for the life of the account and thereafter as long as legal retention or defence of claims requires.
- Usage logs: retained as long as needed for abuse prevention, security, and operational analytics, then deleted or anonymised.
- Aggregate stats: derived figures may be retained indefinitely once personal identifiers are not included.
7. Your rights
Under GDPR you may have the right to access, rectification, erasure, restriction, data portability, and to object to processing based on Art. 6 (1) (f) GDPR.
To exercise these rights, contact info@soniverse.de. You also have the right to lodge a complaint with a supervisory authority. For Bavaria, this is typically the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).
8. No automated decision-making
We do not use automated decision-making including profiling that produces legal or similarly significant effects on you within the meaning of Art. 22 GDPR.
9. Changes
We may update this notice when our processing or the Service changes. The current version is published on this page.